---
title: "Cyberark Identity collector"
canonical: "https://docs.devo.com/space/latest/568229915/Cyberark%20Identity%20collector"
format: markdown
---
## Overview

[CyberArk Identity](https://www.cyberark.com/products/secure-cloud-access/)** **provides a secure platform for managing application access, endpoints, and your network infrastructure.

## Devo collector features

| **Feature** | **Details** |
| --- | --- |
| Allow parallel downloading (`multipod`) | `not allowed` |
| Running environments | - `collector server`
- `on-premise` |
| Populated Devo events | `table` |
| Flattening preprocessing | `no` |

## Data sources

| **Data source** | **Description** | **API endpoint** | **Collector service name** | **Devo table** | **Available from release** |
| --- | --- | --- | --- | --- | --- |
| `Custom` | An existing event type source | `/Redrock/query` | An existing event type service | `iam.cyberark.identity.event` | `v1.1.3` |

For more information on how the events are parsed, [visit our page](https://docs.devo.com/space/latest/94661194/cloud.gcp).

## Flattening preprocessing

| **Data source** | **Collector service** | **Optional** | **Flattening details** |
| --- | --- | --- | --- |
| `Custom` | An existing event type service | no | not required |

## Configuration required

Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.

| **Setting** | **Details** |
| --- | --- |
| `tenant` | The Tenant_id for cyberark identity. |
| `client_id` | The Client_Id for cyberark identity . |
| `client_secret` | The Client_secret for cyberark identity. |
| `app_id` | The App_id for cyberark identity. |

## Authentication methods

| **Authentication method** | **tenant** | **client_id** | **client_secret** | **scope** |
| --- | --- | --- | --- | --- |
| `OAuth client credentials` | [REQUIRED] | [REQUIRED] | [REQUIRED] | [REQUIRED] |

## Authorize it

Follow [Cybrark Identity enabling steps](https://www.cyberark.com/products/authentication-authorization/#2-0-support) to securely connect and send data to Devo.

## Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (<u>Cloud collector</u>), or deploy and host the collector in your own machine using a Docker image (<u>On-premise collector</u>).

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> In the Cloud Collector App, [create a CyberArk Identity Collector instance](https://docs.devo.com/space/latest/409305131). **Remove **the default collector parameters and insert this parameters template, replacing the values enclosed in `< >`.
> 
> ```
> {
>   "inputs": {
>     "cyberark_identity": {
>       "id": "<short_unique_id>",
>       "enabled": true,
>       "credentials": {
>         "tenant": "<TENANT>",
>         "client_id": "<CLIENT_ID>",
>         "client_secret": "<CLIENT_SECRET>",
>         "app_id": "<APP_ID>"
>       },
>       "services": {
>         "<cyberark_identity_event_type_value>": {
>           "types": ["redrock_events"],
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "extra_fields": ["<extra_field_name_values>"],
>           "override_page_size": "<override_page_size_value>",
>           "override_base_url": "<override_base_url_value>",
>           "override_token_url": "<override_token_url_value>",
>           "override_scope": "<override_scope_value>",
>           "override_fetch_gap_seconds": "<override_fetch_gap_seconds_value>",
>           "override_tag": "<override_tag_value>"
>         }
>       }
>     }
>   }
> }
> ```
> 
> > Macro (rw-tab)
> 
> This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.
> 
> ### Structure
> 
> The following directory structure should be created for being used when running the collector:
> 
> ```
> <any_directory>
> └── devo-collectors/
>     └── <product_name>/
>         ├── certs/
>         │   ├── chain.crt
>         │   ├── <your_domain>.key
>         │   └── <your_domain>.crt
>         ├── state/
>         └── config/ 
>             └── config.yaml 
> ```
> 
> > ⚠️ > Macro (toc)
> > ⚠️ 
> > ⚠️ Replace `<product_name>` with the proper value.
> 
> ### Devo credentials
> 
> In Devo, go to **Administration → Credentials → X.509 Certificates**, download the **Certificate**, **Private key** and **Chain CA** and save them in `<product_name>/certs/`. Learn more about security credentials in Devo [here](#).
> 
> ![image-20240402-104530.png](media://19d57c9d-a22f-4ec1-bf9e-322a26c03703)
> 
> > ⚠️ Replace `<product_name>` with the proper value.
> 
> ### Editing the config.yaml file
> 
> ```
> globals:
>   debug: false
>   id: <collector_id_value>
>   name: cyberark_identity_collector
>   persistence:
>     type: filesystem
>     config:
>       directory_name: state
> outputs:
>   devo_us_1:
>     type: devo_platform
>     config:
>       address: <devo_address>
>       port: 443
>       type: SSL
>       chain: <chain_filename>
>       cert: <cert_filename>
>       key: <key_filename>
> 
> inputs:
>   cyberark_identity:
>     id: <short_unique_id>
>     enabled: true
>     credentials:
>       tenant: <tenant_value>
>       client_id: <client_id_value>
>       client_secret: <client_secret_value>
>       app_id: <app_id_value>
>     services:
>       <cyberark_identity_event_type_value>:
>         types: ["redrock_events"]
>         start_time_in_utc: <start_time_in_utc_value>
>         extra_fields: [<extra_field_name_values>]
>         override_page_size: <override_page_size_value>
>         override_tag: <override_tag_value>
>         override_base_url: <override_base_url_value>
>         override_token_url: <override_token_url>
>         override_scope: <override_scope_value>
>         override_fetch_gap_seconds: <override_fetch_gap_seconds_value>
> ```
> 
> > ℹ️ All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.
> 
> Replace the placeholders with your required values following the description table below:
> 
> | **Parameter** | **Data type** | **Type** | **Value Range / Format** | **Details** |
> | --- | --- | --- | --- | --- |
> | `collector_id_value` | str | mandatory | minimum length: 1  
> maximum length: 5 | Use this parameter to give a unique ID to this collector. |
> | `collector_name_value` | str | mandatory | minimum length: 1  
> maximum length: 10 | Use this parameter to give a name to this collector. |
> | `devo_address` | str | mandatory | One of:<br>- `collector-us.devo.io`
> - `collector-eu.devo.io` | Use this parameter to identify the Devo Cloud where the events will be sent. |
> | `chain_filename` | str | mandatory | minimum length: 4  
> maximum length: 20 | Use this parameter to identify the chain.cert file downloaded from your Devo domain. Usually this file's name is: `chain.crt`. |
> | `cert_filename` | str | mandatory | minimum length: 4  
> maximum length: 20 | Use this parameter to identify the `file.cert` downloaded from your Devo domain. |
> | `key_filename` | str | mandatory | minimum length: 4  
> maximum length: 20 | Use this parameter to identify the `file.key` downloaded from your Devo domain. |
> | `short_unique_id` | str | mandatory | minimum length: 1  
> maximum length: 5 | Use this parameter to give a unique ID to this input service.  
> This parameter is used to build the persistence address; do not use the same value for multiple collectors. It could cause a collision. |
> | `tenant_id_value` | str | mandatory | minimum length: 1 | This is the Tenant ID you created in Cyberark Identity. |
> | `client_id_value` | str | mandatory | minimum length: 1 | This is the Client ID you created in Cyberark Identity. |
> | `client_secret_value` | str | mandatory | minimum length: 1 | The application ID of the CyberArk Identity OAuth application created during the setup. |
> | `app_id_value` | str | mandatory | minimum length: 1 | This is the App ID you created in Cyberark Identity. |
> | `environment_value` | str | optional | minimum length: 1 | This is an optional control parameter that is injected into the events and allows you to differentiate the environment. For example: dev and prod. |
> | `request_period_in_seconds_value` | int | optional | minimum: 60 | Period in seconds used between each data pulling. This value will overwrite the default value (300 seconds). |
> | `cyberark_identity_event_type_value` | str | mandatory | one of: [CyberArk application event types](https://docs.cyberark.com/Idaptive/Latest/en/Content/Developer/data-dictionary/event.htm#ApplicationEventTypesandProperties)  
> minimum length: 1 | Specify one of the CyberArk application event types as a service name.<br>The puller will fetch all events corresponding to this event type during the pull execution |
> | `start_time_in_utc_value` | str | optional | UTC datetime string having datetime string format `%Y-%m-%dT%H-%M-%SZ` (e.g., “2020-01-01T00:00:01Z”) | This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (one month back for example) before downloading new events. |
> | `extra_fields` | str | optional | minimum length: 1 | A parameter that allows you to select additional fields beyond the common and event type default fields. |
> | `override_tag_value` | str | optional | Devo tag-friendly string (no special characters, spaces, etc.) For more information see [Devo Tags](https://docs.devo.com/confluence/ndt/data-management/data-tables/about-devo-tags) | An optional tag that allows users to override the service default tags. |
> | `override_page_size` | int | optional | default value: `1000` | A parameter that allows you to override the page size. |
> | `override_base_url_value` | str | optional | default value: `https://{tenant}.my.idaptive.app` | A parameter that allows you to override the base URL. |
> | `override_token_url_value` | str | optional | default value: `https://{tenant}.my.idaptive.app/oauth2/token/{app}` | A parameter that allows you to override the login URL. |
> | `override_scope_value` | str | optional | default value: `Redrock` | A parameter that allows you to override the scope value. |
> | `override_fetch_gap_seconds_value` | int | optional | default value: 5 | This value specifies the lookback period to fetch data from current timestamp. Default value is 5 seconds. |
> 
> **Download the Docker image**
> 
> The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:
> 
> | **Collector Docker image** | **SHA-256 hash** |
> | --- | --- |
> | [collector-cyberark_identity-docker-image-1.4.0](https://drive.google.com/file/d/1H2ghbq4WacwFDh_dGdkkEA3OEltZW3vt/view?usp=drive_link) | e2ff5d6e3883a0495fe7981f14b0b140e9b05f53beddb50c391c87207d5de8b4 |
> 
> Use the following command to add the Docker image to the system:
> 
> ```
> gunzip -c <image_file>-<version>.tgz | docker load
> ```
> 
> > ⚠️ Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace `<image_file>` and `<version>` with a proper value.
> 
> The Docker image can be deployed on the following services:
> 
> #### Docker
> 
> Execute the following command on the root directory `<any_directory>/devo-collectors/<product_name>/`
> 
> ```
> docker run 
> --name collector-<product_name> 
> --volume $PWD/certs:/devo-collector/certs 
> --volume $PWD/config:/devo-collector/config 
> --volume $PWD/state:/devo-collector/state 
> --env CONFIG_FILE=config.yaml 
> --rm 
> --interactive 
> --tty 
> <image_name>:<version>
> ```
> 
> > ⚠️ Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.
> 
> #### Docker Compose
> 
> The following Docker Compose file can be used to execute the Docker container. It must be created in the `<any_directory>/devo-collectors/<product_name>/` directory.
> 
> ```
> version: '3'
> services:
>   collector-<product_name>:
>     image: <image_name>:${IMAGE_VERSION:-latest}
>     container_name: collector-<product_name>
>     volumes:
>       - ./certs:/devo-collector/certs
>       - ./config:/devo-collector/config
>       - ./credentials:/devo-collector/credentials
>       - ./state:/devo-collector/state
>     environment:
>       - CONFIG_FILE=${CONFIG_FILE:-config.yaml}
> ```
> 
> To run the container using docker-compose, execute the following command from the `<any_directory>/devo-collectors/<product_name>/` directory:
> 
> ```
> IMAGE_VERSION=<version> docker-compose up -d
> ```
> 
> > ⚠️ Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

## Monitor it

Create an [inactivity alert](https://docs.devo.com/space/latest/95126785/Inactivity+alert) to detect interruptions of transfer of data from Cyberark Identity using the query

```
from iam.cyberark.identity.event 
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id
```

Set the inactivity alert to keep track of the `collector_id`.

## Change log

| **Release** | **Released on** | **Release type** | **Details** | **Recommendations** |
| --- | --- | --- | --- | --- |
| `v1.4.0` | 7/18/2025 | [improvement] | **Improvements**<br>- Improve the way it handles signals such as SIGTERM
- Updated DCSDK to 1.16.3
- Upgraded docker base image to 1.5.1 | `Recommended version` |
| `v1.3.0` | 3/20/2025 | [improvement] | **Improvements**<br>- Updated base url.
- Updated DCSDK to 1.15.0
  - Differentiated error codes for SdkPersistenceServiceError.
  - Use of DOCKER_IMAGE environment variable to show docker_image property.
  - Now the property service_thread_execution_periods_in_seconds in collector_definition.yaml is optional.
  - Reduced Redis connections per collector to 2.
  - Implemented a mechanism to control if the certificates have expired.
  - Fixed [CVE-2024](https://devoinc.atlassian.net/browse/CVE-2024?atlOrigin=eyJpIjoiYjM0MTA4MzUyYTYxNDVkY2IwMzVjOGQ3ZWQ3NzMwM2QiLCJwIjoianN3LWdpdGxhYlNNLWludCJ9)-12797 vulnerability in cryptography library (updated from version 44.0.0 to 44.0.1).
- Upgraded docker base image to 1.4.1 | `Upgrade` |
| `v1.2.0` | 11/7/2024 | [IMPROVEMENT]<br>[Fixes] | ##### Improvements<br>- Updated the DCSDK from 1.11.1 to 1.13.1
- upgraded dcsdk-docker-base-image to 1.3.1<br>##### Fixes<br>- Fixed the user config and schemas to allow overrides. | `Upgrade` |
| `v1.1.3` | 4/4/2024 | [IMPROVEMENT] | Updated the tag and removed the usage of tag_mapper | `Upgrade` |
| `v1.1.2` | 3/18/2024 | [FIRST RELEASE] | Released the first version of the Cyberark Identity collector. | `Initial version` |