---
title: "iam.cyberark"
canonical: "https://docs.devo.com/space/latest/369393779/iam.cyberark"
format: markdown
---
> Macro (toc)

## Purpose

Use tags in this category to identify events generated by <u>[Cyberark](https://www.cyberark.com/)</u>*.*

An analyst wants to detect credentials access vulnerability in the organization. Sending data to Devo by using this parser, the analyst will manage the necessary information to monitor and prevent identity impersonation.

## Send it

Vendor sending data integration: [https://www.cyberark.com/solutions/secure-external-access/](https://www.cyberark.com/solutions/secure-external-access/)

Use the following collectors to extracting and ingesting from CyberArk data sources.

- [CyberArk EPM collector](https://docs.devo.com/space/latest/336855041/CyberArk+EPM+collector)
- [CyberArk Identity collector](https://docs.devo.com/space/latest/568229915/Cyberark+Identity+collector)

## Secure it

### Monitoring account manipulation

An analyst aiming to detect suspicious authentication behavior where authentication credentials may have been recently modified.

```
from aim.cyberark.identity.event
select internal_session_id
group by auth_method, from_ip_address, normalized_user
```

 

## Tags and tables

| **[Tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204)** | **[Tables](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94764298)** |
| --- | --- |
| `iam.cyberark.audit` | `iam.cyberark.audit` |
| `iam.cyberark.identity.event` | `iam.cyberark.identity.event` |
| `iam.cyberark.vault.cef` | `iam.cyberark.vault` |
| `iam.cyberark.vault_leef` | `iam.cyberark.vault_leef` |
| `iam.cyberark.audit_stream.dpa` | `iam.cyberark.audit_stream.dpa` |
| `iam.cyberark.audit_stream.idp` | `iam.cyberark.audit_stream.idp` |
| `iam.cyberark.audit_stream.sca` | `iam.cyberark.audit_stream.sca` |