riposte-marketplace/integrations/cyberark-pas/manifest.yaml

id: cyberark_pas
name: CyberArk PAS
version: 1.1.0
description: "CyberArk Privileged Access Security (PVWA REST API) — PAM containment and IR: list and read privileged accounts, rotate/verify/reconcile credentials (CPM), retrieve a password for incident response, add/delete accounts, and list safes and vault users. Session (logon) authentication; stdlib-only, no extra Python dependencies."
changelog: "1.1.0 — Declare the risk tier on the 6 commands that carried none: 2 safe_write, 4 destructive. An unset risk is read as destructive by the agent approval gate, so the 2 that only annotate sat behind the same prompt as the ones that change the estate. | 1.0.0 — Initial release: list/get accounts, change/verify/reconcile credentials, retrieve password, add/delete account, list safes, list users."
category: identity

# Per-instance configuration. Each command logs on to PVWA (returns a session
# token used as the Authorization header), performs the action, then logs off.
config_schema:
  properties:
    url:
      type: string
      description: "PVWA base URL (e.g. https://pvwa.example.com)"
    username:
      type: string
      description: "Vault username"
    password:
      type: string
      description: "Vault password"
      x-soar-sensitive: true
    auth_method:
      type: string
      description: "Logon method: Cyberark, LDAP, RADIUS, or Windows (default Cyberark)"
      default: "Cyberark"
    insecure:
      type: boolean
      description: "Trust any TLS certificate (not secure)"
      default: false
  required:
    - url
    - username
    - password

commands:
  - id: list_accounts
    name: cyberark-list-accounts
    description: "List/search privileged accounts."
    risk: read
    inputs_schema:
      properties:
        search: { type: string, description: "Free-text search (username, address, name)" }
        filter: { type: string, description: "Filter expression (e.g. safeName eq MySafe)" }
        limit: { type: number, description: "Max accounts (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: get_account_details
    name: cyberark-get-account-details
    description: "Get a single account's details by account ID."
    risk: read
    inputs_schema:
      properties:
        account_id: { type: string, description: "Account ID" }
      required: [account_id]
    outputs_schema: { properties: {} }
  - id: change_credentials
    name: cyberark-change-credentials
    description: "Rotate an account's credential immediately to a new random password (CPM change). Use to contain a compromised privileged account."
    risk: destructive
    inputs_schema:
      properties:
        account_id: { type: string, description: "Account ID" }
        change_entire_group: { type: boolean, description: "Also change dependent accounts in the group (default false)" }
      required: [account_id]
    outputs_schema: { properties: {} }
  - id: verify_credentials
    name: cyberark-verify-credentials
    description: "Mark an account's credential for verification by the CPM."
    risk: safe_write
    inputs_schema:
      properties:
        account_id: { type: string, description: "Account ID" }
      required: [account_id]
    outputs_schema: { properties: {} }
  - id: reconcile_credentials
    name: cyberark-reconcile-credentials
    description: "Mark an account's credential for reconciliation by the CPM."
    risk: destructive
    inputs_schema:
      properties:
        account_id: { type: string, description: "Account ID" }
      required: [account_id]
    outputs_schema: { properties: {} }
  - id: get_password
    name: cyberark-get-password
    description: "Retrieve an account's current password (for incident response). Requires a reason."
    risk: destructive
    inputs_schema:
      properties:
        account_id: { type: string, description: "Account ID" }
        reason: { type: string, description: "Reason for retrieval (audited)" }
      required: [account_id]
    outputs_schema: { properties: {} }
  - id: add_account
    name: cyberark-add-account
    description: "Add a new privileged account to a safe."
    risk: safe_write
    inputs_schema:
      properties:
        name: { type: string, description: "Account name" }
        address: { type: string, description: "Target machine address" }
        user_name: { type: string, description: "Account username" }
        platform_id: { type: string, description: "Platform ID (e.g. WinServerLocal)" }
        safe_name: { type: string, description: "Safe name" }
        secret: { type: string, description: "The password/secret to store" }
        secret_type: { type: string, description: "password or key (default password)" }
      required: [name, address, user_name, platform_id, safe_name]
    outputs_schema: { properties: {} }
  - id: delete_account
    name: cyberark-delete-account
    description: "Delete an account by ID."
    risk: destructive
    inputs_schema:
      properties:
        account_id: { type: string, description: "Account ID" }
      required: [account_id]
    outputs_schema: { properties: {} }
  - id: list_safes
    name: cyberark-list-safes
    description: "List safes."
    risk: read
    inputs_schema:
      properties:
        search: { type: string, description: "Optional safe-name search" }
        limit: { type: number, description: "Max safes (default 50)" }
      required: []
    outputs_schema: { properties: {} }
  - id: list_users
    name: cyberark-list-users
    description: "List vault users."
    risk: read
    inputs_schema:
      properties:
        search: { type: string, description: "Optional username search" }
        filter: { type: string, description: "Filter (e.g. userType eq EPVUser)" }
      required: []
    outputs_schema: { properties: {} }

  - id: test_connection
    name: cyberark-test-connection
    description: "Verify connectivity and logon credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }