If you're having trouble at any stage please contact us at email@example.com.
Centrify platform provides unified solution to manage user's access to apps, endpoints and infrastructure through single sign-on, multi-factor authentication and privileged access security.
For more information on the different Centrify platform's services see:
The main challenges and needs are to:
- Get and retain full audit of activities in Centrify account.
- Retrieve Centrify account activities as users’ access to remote servers, files/folder permission activities and scope, password activities and more.
- The granular activities should be available at the organization’s central log or event management system for compliance, investigation or forensic needs.
- Detect security threats and policy violations
What is it
SkyFormation for Centrify Cloud Connector, is part of the SkyFormation Collect (c) module.
It continuously retrieves audit events from the different audit sources in the Centrify platform account, unifies the events into a common application events format, enrich the events with needed detection context and send the events to any existing SIEM/SOC system.
How it works
SkyFormation for Centrify Cloud Connector retrieves the events from Centrify service through its APIs. Before sending the events to the existing SIEM/SOC system the connector will
- Unify the events into the SkyFormation unified application events format
- Embed the origin event into the SkyFormation event as a blob
- Parse the origin event into a set of dedicated key-value fields
- Enrich the event with detection context (e.g. AD identity information)
- Encode the resulted event into the target SIEM/SOC system standard format (e.g. CEF)
- Send the event to the existing SIEM/SOC system over syslog
Connector's API/Audit Sources & Events Supported
|Audit Source (API)||Service/Module Covered||Event Included|