Sectona PAM

Sectona PAM Integration

This integration ingests the following logs:

• Administrative events: PAM Administration related events such as creating a new User, adding a new server, adding a privileged account, modifying User access policy in PAM, etc.

• Security events: Security events such as Failed User login, Access for a server/ device, Failed Password change for privileged account, etc. All these events should be configured in the SIEM solution to get an alert for unusual login attempts from completely different IP addresses, too many failed login attempts, multiple Failed Privileged password changes, etc.

• System events: These are events that populated on the PAM solution, such as network failure and PAM system critical service failure; the event log displays the type and category (low, medium, critical) of error that occurred, which can be configured into an alert through SIEM and sent to PAM administrator for the quick address of the issue. This is crucial as these events may fail User access which may impact Businesses inadvertently.

Steps to configure Log Forwarding

The steps below will help you configure Log Forwarding:

• Navigate to the Setup option in the navigation bar and select SIEM & Log Forwarding from the sidebar.

• Description: Provide a description of SIEM logs for the Central Logging server.

• IP Address: Provide the IP address of the Log Collector.

• Port No: Enter port number shared by BluSapphire.

• Check the Active checkbox for activation and click the Save button

Configuring event-specific forwarding

To select what types of event logs you want to forward to an external Syslog or SIEM solution, follow the below steps to configure:

• Click on the Event Configuration button, and an event configuration window opens.

• Use the checkbox to select an event(s) you want to forward.

• Event ID: The unique ID of a particular event.

• Event Name: The event whose logs are to be received.

• Click the Save button to save the selected event you want PAM to forward.

• Navigate to the System option in the navigation bar and select System Status from the sidebar. Click on the App Services tab.

• Search for a service named SystemEventService, and click on Start / Stop button to start the service to enable log forwarding.

• Click on View Trail, it populates any addition or modification done on the parameters mentioned above with details of changes done by the PAM administrator.

Event ID	Event name	Event description
111	Asset	Displays events related to configuration activity on the assets in the system
112	Accounts	Displays events related to configuration activity on the accounts in the system
113	User	Displays events related to configuration activity on the users in the system
126	Server Access Policy Unix	Displays events related to configuration activity on the Server Access Policy that are applied on Unix Server in the system
127	Server Access Policy Windows	Displays events related to configuration activity on the Server Access Policy that are applied on Windows Server in the system
128	Password Policy	Displays events related to configuration activity on the Password Policy in the system
501	Session Initiated	Displays events when the session is initiated in the system
502	Login Failed	Displays events related to login failed activity in the PAM system
503	Login Success	Displays events related to login success activity in the PAM system
504	User Locked	Displays events when the user is locked in the PAM system
505	Password Change Success	Displays events related to successful password change activity on the target server
506	Password Change Failed	Displays events related to failed password change activity on the target server
507	Password Change Aborted	Displays events related when the password change is aborted on the target server
508	Command Executed	Displays events when a command is executed during a session in the system
509	Command Execution Denied	Displays events when a command execution is disapproved during a session in the system
510	Command Execution Confirmed	Displays events when a command execution is confirmed during a session in the system
511	Process Execution Completed	Displays events when a process is executed through WMON during a session in the system
512	Process Execution Denied	Displays events when a process execution is disapproved through WMON during a session in the system
513	Process Execution Confirmed	Displays events when a process execution is approved through WMON during a session in the system
514	File Transfer Completed	Displays events when a file is transferred during a session in the system
515	File Deleted	Displays events when a file is deleted during a session in the system
801	System Health Information	Displays events when the CPU, memory and disk utilization exceeds the base configured value.
517	Password Checkout	When a user checks out a password for any account.
518	Concurrent session Account wise	When a user initiates multiple concurrent sessions for the same account.
519	Concurrent session Asset wise	When a user initiates multiple concurrent sessions for the same asset.