feat(cyberark-pas): new CyberArk PAS privileged-access integration
PVWA REST API, 11 commands: list/get accounts, change/verify/reconcile credentials (CPM rotation), retrieve password, add/delete account, list safes, list users. Session (logon) auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,140 @@
|
||||
id: cyberark_pas
|
||||
name: CyberArk PAS
|
||||
version: 1.0.0
|
||||
description: "CyberArk Privileged Access Security (PVWA REST API) — PAM containment and IR: list and read privileged accounts, rotate/verify/reconcile credentials (CPM), retrieve a password for incident response, add/delete accounts, and list safes and vault users. Session (logon) authentication; stdlib-only, no extra Python dependencies."
|
||||
changelog: "1.0.0 — Initial release: list/get accounts, change/verify/reconcile credentials, retrieve password, add/delete account, list safes, list users."
|
||||
category: identity
|
||||
|
||||
# Per-instance configuration. Each command logs on to PVWA (returns a session
|
||||
# token used as the Authorization header), performs the action, then logs off.
|
||||
config_schema:
|
||||
properties:
|
||||
url:
|
||||
type: string
|
||||
description: "PVWA base URL (e.g. https://pvwa.example.com)"
|
||||
username:
|
||||
type: string
|
||||
description: "Vault username"
|
||||
password:
|
||||
type: string
|
||||
description: "Vault password"
|
||||
x-soar-sensitive: true
|
||||
auth_method:
|
||||
type: string
|
||||
description: "Logon method: Cyberark, LDAP, RADIUS, or Windows (default Cyberark)"
|
||||
default: "Cyberark"
|
||||
insecure:
|
||||
type: boolean
|
||||
description: "Trust any TLS certificate (not secure)"
|
||||
default: false
|
||||
required:
|
||||
- url
|
||||
- username
|
||||
- password
|
||||
|
||||
commands:
|
||||
- id: list_accounts
|
||||
name: cyberark-list-accounts
|
||||
description: "List/search privileged accounts."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
search: { type: string, description: "Free-text search (username, address, name)" }
|
||||
filter: { type: string, description: "Filter expression (e.g. safeName eq MySafe)" }
|
||||
limit: { type: number, description: "Max accounts (default 50)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_account_details
|
||||
name: cyberark-get-account-details
|
||||
description: "Get a single account's details by account ID."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_id: { type: string, description: "Account ID" }
|
||||
required: [account_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: change_credentials
|
||||
name: cyberark-change-credentials
|
||||
description: "Rotate an account's credential immediately to a new random password (CPM change). Use to contain a compromised privileged account."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_id: { type: string, description: "Account ID" }
|
||||
change_entire_group: { type: boolean, description: "Also change dependent accounts in the group (default false)" }
|
||||
required: [account_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: verify_credentials
|
||||
name: cyberark-verify-credentials
|
||||
description: "Mark an account's credential for verification by the CPM."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_id: { type: string, description: "Account ID" }
|
||||
required: [account_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: reconcile_credentials
|
||||
name: cyberark-reconcile-credentials
|
||||
description: "Mark an account's credential for reconciliation by the CPM."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_id: { type: string, description: "Account ID" }
|
||||
required: [account_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_password
|
||||
name: cyberark-get-password
|
||||
description: "Retrieve an account's current password (for incident response). Requires a reason."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_id: { type: string, description: "Account ID" }
|
||||
reason: { type: string, description: "Reason for retrieval (audited)" }
|
||||
required: [account_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: add_account
|
||||
name: cyberark-add-account
|
||||
description: "Add a new privileged account to a safe."
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Account name" }
|
||||
address: { type: string, description: "Target machine address" }
|
||||
user_name: { type: string, description: "Account username" }
|
||||
platform_id: { type: string, description: "Platform ID (e.g. WinServerLocal)" }
|
||||
safe_name: { type: string, description: "Safe name" }
|
||||
secret: { type: string, description: "The password/secret to store" }
|
||||
secret_type: { type: string, description: "password or key (default password)" }
|
||||
required: [name, address, user_name, platform_id, safe_name]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: delete_account
|
||||
name: cyberark-delete-account
|
||||
description: "Delete an account by ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
account_id: { type: string, description: "Account ID" }
|
||||
required: [account_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_safes
|
||||
name: cyberark-list-safes
|
||||
description: "List safes."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
search: { type: string, description: "Optional safe-name search" }
|
||||
limit: { type: number, description: "Max safes (default 50)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: list_users
|
||||
name: cyberark-list-users
|
||||
description: "List vault users."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
search: { type: string, description: "Optional username search" }
|
||||
filter: { type: string, description: "Filter (e.g. userType eq EPVUser)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: test_connection
|
||||
name: cyberark-test-connection
|
||||
description: "Verify connectivity and logon credentials (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
Reference in New Issue
Block a user