systemparm.properties

Date format of the organization. For example, for US users the format is MM/dd/yyyy.

MM/dd/yyyy, dd/MM/yyyy

MM/dd/yyyy

The full pathname of the loglist.csv report generated by the ExportVaultData utility.

Full pathname. For example, /tmp/loglist.csv.

None

The full pathname of the PVWA Inventory Report .csv file.

Full pathname

The protocol to use for the LDAP connection.

Valid protocol

None

The LDAP base context.

String

None

The port of the LDAP server.

Number between 1024 and 65535

None

The IP of the LDAP server to integrate with.

IP

None

The name of the domain where the LDAP server resides.

String

None

The name of the LDAP PTA group.

String

PTA_GROUP

The netbios (Pre2000) name of the domain.

String

Outbound configuration that enables PTA to integrate with your SIEM.

This property is formatted as a Json list, where each item defines a single outbound target.

A list of outbound targets. Each outbound target has the following fields:

• siem - The name of the outbound configuration, such as HP ArcSight, McAfee, QRadar, RSA, or Splunk

• format - The syslog message format, either CEF or LEEF

• host - The target host FQDN or IP

• port - port number

• protocol - UDP , TCP, or TLS

• syslogType (optional) - The syslog header format, either RFC3164 or RFC5424. If this field is not valued, the default is RFC3164

• tcpOctetCounting (optional) - Whether to add octet counting for syslog transmission over TCP, either true or false

None

List of all physical IP addresses in a cluster or distributed Vault environment.

IP address

None

The timezone configured in the Vault.

NA

The PTA machine timezone.

List of non-human usernames whose syslog messages PTA will ignore.

Vault users

passwordmanager,prov_,pvwaappuser,psmapp

The port used to receive syslog data in a secure channel.

Number between 1 and 65535. The number must represent an unused port.

6514

The port used to receive statistics data in a secure channel.

Number between 1 and 65535. The number must represent an unused port.

7514

Enable or disable the option to send PTA events to the Vault.

true/false

true

Port and protocol for receiving syslog data, either secure (over TLS 1.2) or unsecure.

A list of the following information: {port, protocol, clientVerification}

Acceptable values are:

• port – Number of the port used for incoming syslog records sent from the Vault, SIEM, and Unix machines on the TCP or UDP protocol. Number between 1 and 65535. The number must represent an unused port.
• protocol - UDP, TCP, TLS

• clientVerification - true or false. The default value for clientVerification is false. Value with true to enable client verification using certificates.

List of sensors that are parsed by the PTA Server. By default, PTA is set to parse all sensor data. To improve performance, you can use this parameter to specify the sensors for which PTA will parse data. The value is not case sensitive.

• PTAAgent
• Unix
• Arcsight
• QRadar
• Splunk
• Logrhythm
• RSA
• Correlog
• McAfee
• AWS
• Azure
• None
• All

A regular expression that defines the legacy syslog format.

Regular expression

(<\\d+>)?([\\d\\.]+)?\\s*([a-zA-Z]+\\s+\\d{1,2}\\s+\\d{1,2}:\\d{1,2}:\\d{1,2})\\s+([^\\s]+)\\s+(.*)

The index that corresponds to the date field defined in the syslog_format_regex_legacy property.

Number greater than zero

3

The index that corresponds to the machine field defined in the syslog_format_regex_legacy property.

Number greater than zero

4

The index that corresponds to the body field defined in the syslog_format_regex_legacy property.

Number greater than zero

A regular expression that defines the syslog format 5424.

Regular expression

<(\\d+)>([\\d\\.]+)\\s+(\\d{4}-\\d{2}-\\d{1,2}T\\d{1,2}:\\d{1,2}:\\d{1,2}Z)\\s+([^\\s]+)\\s+(.*)

The index that corresponds to the date field defined in the syslog_format_regex_5424 property.

Number greater than zero

3

The index that corresponds to the machine field defined in the syslog_format_regex_5424 property.

Number greater than zero

4

The index that corresponds to the body field defined in the syslog_format_regex_5424 property.

Number greater than zero

A regular expression that defines the data format in a syslog string that the audit creator detects.

Regular expression

\\s*\\|\\s*([^\\s\\|]+)\\s*\\|\\s*([^\\|]*)\\s*\\|\\s*(Retrieve password|Use Password)\\s*\\|\\s*([^\\s\\|]*)\\s*\\|\\s*([^\\s\\|]*)\\s*\\|(.*)

The index that corresponds to the user who retrieved the password from the Vault in the audit_creator_body_regex_vault_retrieve_password property.

Number greater than zero

1

The index that corresponds to the date when the password was retrieved from the Vault in the audit_creator_body_regex_vault_retrieve_ password property.

Number greater than zero

2

The index that corresponds to the user specified in the account that was retrieved from the Vault in the audit_creator_body_regex_vault_retrieve_ password property.

Number greater than zero

4

The index that corresponds to the address specified in the account that was retrieved from the Vault in the audit_creator_body_regex_vault_retrieve_ password property.

Number greater than zero

A regular expression that defines the data format in a syslog string that the audit creator detects.

Regular expression

\\s*[a-zA-Z0-9\\[\\]]+:\\s+pam_unix\\((.+):session\\):\\s*session opened for user\\s+(\\S+) by.*

The index of the user who opened the unix session in the audit_creator_body_regex_unix_session_opened property.

Number greater than zero

2

The index of the type of session that was opened in the audit_creator_body_regex_unix_session_opened property.

Number greater than zero

A regular expression that defines the data format in a syslog string that the audit creator detects.

Regular expression

CEF:(?<cefVersion>\\d+)\\|(?<vendor>(?:[^\\\\\\|]|\\\\.)*+)\\|(?<product>(?:[^\\\\\\|]|\\\\.)*+)\\|(?<version>(?:[^\\\\\\|]|\\\\.)*+)\\|(?<id>(?:[^\\\\\\|]|\\\\.)*+)\\|(?<name>(?:[^\\\\\\|]|\\\\.)*+)\\|(?<severity>(?:[^\\\\\\|]|\\\\.)*+)\\|(?<extension>.*)

Custom vendor and product name for Windows logon support

Json string

Enables or disables a generic delimiter for splitting SIEM syslog messages retrieved in bulk.

true/false

The time for frequent updates of the excessive access (user) baseline. The default is midnight of every day.

Cron expression

0 0 0 * * ? 

Cron expression

0 0 0 * * ? 

The time for frequent updates of the Vault accounts reload. The default is 1:00 AM of every day.

Cron expression

0 0 1 * * ? 

The time for frequent updates of the Vault users reload. The default is midnight of every day.

Cron expression

0 0 0 * * ? 

The time for frequent updates of the irregular hours (machine) baseline. The default is midnight of every day.

Cron expression

0 0 0 * * ? 

The time for frequent updates of the irregular hours (user) baseline. The default is midnight of every day.

Cron expression

0 0 0 * * ? 

The time for deleting raw data that has passed the retention period. The default is 3:30 AM every day.

Cron expression

0 30 3 * * ?

The time for frequent updates of the cloud privileged accounts based on privileged permissions. The default is 5:15 AM every day.

Cron expression

0 15 5 * * ? 

The time to archive or delete the archived VaultServices, CasosServices and tomcat logs

The list of anomalies whose detections are disabled.

ExcessiveAccessAssetAnomalyAlgorithm,
LogonIrrSourceMachineToTgtMachineByTgtAccAnomalyAlgorithm,
LogonIrrTgtAccFromMachineAnomalyAlgorithm,
LogonIrrTgtMachineByTgtAccAnomalyAlgorithm,
MachineAccessViaIrregularIpAnomalyAlgorithm,
IrregularPSMActivityAnomalyAlgorithm

PTA can send outbound notifications of security events to SIEM solutions, email, or to the Vault.

In the UI, when the same event occurs multiple times, the events are aggregated. PTA can send each occurrence of the aggregated event as a separate outbound notification or it can send only the first occurrence of the event.

Use this parameter to select the events that you want to send as separate outbound notifications.

• All
• None
• ActiveDormantUserAnomalyAlgorithm
• AggregativeIceAnomalyAlgorithm
• ExcessiveAccessUserAnomalyAlgorithm
• GoldenTicketAnomalyAlgorithm
• IrregularHoursUserAnomalyAlgorithm
• MaliciousRetrievalOfDomainAccountsAnomalyAlgorithm
• OverPassTheHashAnomalyAlgorithm
• PacAsRequestAttackAnomalyAlgorithm
• SuspectedCredentialsTheftAnomalyAlgorithm
• UnmanagedPrivilegedAccessAnomalyAlgorithm
• VaultAccessViaIrregularIpAnomalyAlgorithm
• IrregularDayUserAnomalyAlgorithm
• RiskySPNRisk
• UnconstrainedDelegationRisk
• ExposedCredentialsRisk
• InteractiveServiceAccountRisk

The list of users to be excluded from the Irregular Hours baseline calculation. Multiple names must be separated by commas.

Vault users

None

Determines how the baseline is created.

true/false

The list of machines which are allowed to execute DC replication operations. Multiple names must be separated by commas.

Fully-qualified machine names, IPs

A list of users considered privileged in the organization, and who should be managed by PAM - Self-Hosted.

A list of the following information: {platform, case sensitivity of user, regular expression}

Acceptable values are:

If this value is not defined by the user, the system will use the following default value:
[{"mPlatform":"UNIX","mIsCaseSensitive":true, "mUsers" :[root]},{"mPlatform":"WINDOWS","mIsCaseSensitive":false,"mUsers":[.*admin.*]},{"mPlatform":"ORACLE", "mIsCaseSensitive": false,"mUsers":[sys,system,sysman]},{"mPlatform":"CLOUD","mIsCaseSensitive":true,"mUsers":["root",".*admin.*"]}]

A list of groups considered privileged in the organization, and whose members should be managed by PAM - Self-Hosted.

A list of the following information: {Domain, Group_name}

Acceptable values are:

None

The unmanaged privileged access anomaly score.

Number between 1-100

30

A list of local groups considered privileged in the organization, and whose members should be managed by PAM - Self-Hosted.

A list of the following information: {Domain, Group_name}

Acceptable values are:

• Domain

  You can specify either a domain name or a regular expression. For example, enter .*winserver to specify a range of machines.

• Group Name

The base taken in the exponent of the proportion of the tail of the given IP which was not spanned by the tree.
Specify a number greater than ‘1’.

8.0

A list of usernames that PTA will ignore when analyzing Vault access via irregular IP addresses.

DR,BATCH,BACKUP

A list of IP addresses that PTA will ignore when analyzing Vault access via irregular IP addresses.

IPs

The list of domain accounts to be excluded from the Asset Connection baseline calculation.

A list of the following information: {domain, list of users that belong to the domain}

Acceptable values are:

The number of minutes of the default check-out time period of a password.

Number

480

A list of usernames that PTA will ignore when analyzing connections to remote machines without first retrieving the required credentials from the Vault.

A list of the following information: {platform, Machine/domain, DB instance, User}

Acceptable values are:

All fields except Platform can be configured as a list with a ‘,’ delimiter and support asterisks.

For example: #sct_excluded_account_list=[{"mPlatforms":["WINDOWS"],"mUsers":["user"],"mDomains":["domain.com"]},{"mPlatforms":["WINDOWS"],"mUsers":["localUser"],"mMachines":["prod.domain.com"]},{"mPlatforms":["ORACLE"],"mUsers":["localUser"],"mMachines":["prodDB.domain.com","mInstanceNames":["MyDB"]}]

None

A list of privileged account names that PTA will ignore and not alert UPA even if they are not stored in the Vault.

A list of the following information: {platform, Machine/domain, DB instance, User}

Acceptable values are:

All fields except Platform can be configured as a list with a ‘,’ delimiter and support asterisks.

For example: #upa_excluded_account_list=[{"mPlatforms":["WINDOWS"],"mUsers":["user"],"mDomains":["domain.com"]},{"mPlatforms":["WINDOWS"],"mUsers":["localUser"],"mMachines":["prod.domain.com"]},{"mPlatforms":["ORACLE"],"mUsers":["localUser"],"mMachines":["prodDB.domain.com","mInstanceNames":["MyDB"]}]

The time, in minutes, PTA waits before indicating a password change was not done by CPM and is suspicious.

Number between 1-60

2

The suspicious password change anomaly score.

Number between 1-100

A regular expression that defines the suspicious session activities that PTA analyzes.

A list of the following information: {regular expression of the command, score, description, category}

Acceptable values are:

For example:{"regex":"kill(.*)","score":"70","description":"description2","category":"SSH","response":"NONE",“active”:true}]

A set of best practices that CyberArk recommends.

Determines the platforms that will be used for processing and detecting suspicious activities in privileged session security events.

If the parameter is empty, all session related audits are processed. Otherwise, only session audits from the platforms listed in the parameter are processed.

Platform names

Whether the learning process of the Irregular activities detected in a privileged session detection is enabled.

true/false

false

Whether an integration of the Irregular activities detected in a privileged session detection with the Suspicious activities detected in a privileged session detection is enabled.

true/false

A list of usernames, domains and service principal names that PTA will ignore when analyzing privileged accounts that contain service principal names.

A list of the following information: {user, domain, service}

Acceptable values are:

All fields can be configured as a list with a ‘,’ delimiter, and can support asterisks.

For example:

risky_spn_excluded_account_list=[{"mUsers":["user1"],"domain":["domain.com"],"service":["host\service","fqdn\service"]},{"mUsers":["sqladmin"],"domain":["domain.com"],"service":["*"]}]

Enables the user to add custom accounts for detecting the "Service account logged on interactively" risk.

This list supports wildcard based patterns.

string

Determine the uniqueness of local accounts for the entire system.

By default, local accounts are defined as username@machine. To change the unique identifier to Host, the environment must have a unique host name across the entire environment that is monitored by PTA.

When setting this parameter to Host, you must also:

• Set domain mapping by running the domainMappingConfiguration.sh utility. See Manage PTA Server.

• The host name cannot be the same as the short domain name or the NETBIOS name.
  Examples:

  • If the domain name is example.com, the host name cannot be "example".
  • if the NETBIOS name is EXAMPLES, the host name cannot be "examples".

• FQDN
• Host

The timeframe, in minutes, during which the number of failed authentication attempts to the Vault exceeds the configured threshold

An increment in percentage for the "Suspicious multiple authentication failures to the Vault" security event score until the maximum score for the event

The IP of the mail server in the organization.

IP address

None

The SMTP port for emails.

25, 587

25

Whether the authentication method is on.

true/false

true

Whether the debug messages of the email process appear in the log.

true/false

false

The protocol used for email integration. We recommend using one of the supported secured protocols.

StartTls, SSL, None

StartTls

Supported SSL protocols, separated by spaces.

TLSv1.2, TLSv1

TLSv1.2

Whether the communication between PTA and SMTP is trusted and the SMTP certificate is validated by the PTA Server.

true/false

true

The email address of the sender.

Email address in lowercase characters.

None

A list of the recipient email addresses that will receive an email when an incident is discovered. Specify email addresses using only lowercase characters. Multiple addresses are separated by a semi-colon (;).

Email address; email address, ...

The format of a DNS service record (SRV).

Regular expression

\\s*\\d+\\s+\\d+\\s+\\d+\\s+((?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\\.?)\\.

The prefix that identifies an SRV record for a domain.

String

_ldap._tcp.dc._msdcs.

The timeout period for DNS resolving, in milliseconds.

Numbers in milliseconds

List of domain and domain controllers.

{"domain_name":[{"mAddress":"dc1_ip_address","mHostName":"dc1_host_name"},{"mAddress":"dc2_ip_address","mHostName":"dc2_host_address"}]}

None

List of DNS names with their corresponding pre-Windows 2000 names.

{"preWin2000DomainName":"fullDNSDomainName", "preWin2000DomainName2":"fullDNSDomainName2"}

The number of suspicious session activity incidents for the selected timeframe that will be displayed in individual bubbles on the dashboard. The rest of the incidents will be displayed in a single aggregated bubble.

Number

0

The period of time before all configurations under the Settings tab in the PTA classic UI will load without the PAM - Self-Hosted Connectivity configurations, if there is a failure to retrieve the configurations during the configured time.

Whether PTA will analyze, detect, and alert on AWS events

Boolean

False

Whether PTA will analyze, detect, and alert on Microsoft Azure events

Boolean

False

Cloud bind user to query cloud vendor to enhance PTA's privileged users list

Array

For example, [{\"safeName\":\"Cloud Accounts\",\"folderName\":\"Root\",\"fileName\":\"Cloud Service-Cloud\",\"vendor\":\"azure\",...]

Determines whether PTA will integrate with PAM - Self-Hosted to react automatically to detected credential thefts.

true/false

Determines whether PTA will integrate with PAM - Self-Hosted to automatically add unmanaged privileged accounts to the PVWA pending accounts queue.

False

Determines whether PTA will integrate with PAM - Self-Hosted to automatically rotate passwords to accounts.

False

Determines whether PTA will integrate with PAM - Self-Hosted to react automatically to any detected CyberArk Password Manager bypass.

True

Allows a user to enable or all automatic mitigation of PSM suspicious activities.

True

Allows a user to enable or disable automatic mitigation session termination of PSM suspicious activities.

False

Allows a user to enable or disable automatic mitigation session suspension of PSM suspicious activities.

False

Determines whether PTA will integrate with PAM - Self-Hosted to automatically rotate passwords when a Suspected Credential Theft event is detected.

False

Determines whether PTA will integrate with PAM - Self-Hosted to automatically rotate passwords when an Over Pass the Hash event is detected.

Allows users to determine when raw data is purged from the PTA Server.

This property defines the retention period (number of days) for raw data to be stored in PTA before it will be deleted. This does not apply to events that PTA has detected.

Note: This property applies to the following audit types:

• change password

• reset password

• Vault audits

Number

90

Allows users to determine when raw cloud traffic data is purged from the PTA Server.

This property defines the retention period (number of days) for cloud raw data to be stored in PTA before it will be deleted. This does not apply to events that PTA has detected.

Note: This property applies to audits created in PTA from Amazon Web Service and Microsoft Azure cloud activity data.

Number

2

Allows users to determine when raw network traffic data is purged from the PTA Server.

This property defines the retention period (number of days) for network raw data to be stored in PTA before it will be deleted. This does not apply to events that PTA has detected.

Note: This property applies to audits created in PTA from the following network protocols:

• DCRPC

• LDAP

• Kerberos

Number

10

Determines the period of time that closed security and risk events are stored on the PTA Server database before being deleted.

Number

Enables client verification for the secured syslog.

True

Enables PTA Windows Agent connection to the PTA Server.

Determines the number of security events that will be fetched and presented in the new PAS-PTA UI.

Number

500

Whether the communication between PTA and PVWA is trusted, and the PVWA certificate is validated by the PTA Server.

true/false

true

Whether PTA will connect to PAM - Self-Hosted though https.

true/false

true

The name of PAM - Self-Hosted that PTA will connect to. Enter the FQDN.

String

-

The port through which PTA will connect to PAM - Self-Hosted.

Port number

The PVWA application name.

String

PasswordVault

Whether PTA will send a privileged session risk score to PSM to make the score available in PVWA.

true/false

Enables uploading certificates with signature algoritms lower than SHA-256.

Determines the period of time that the following logs are kept on the PTA Server before being compressed to *.tar.gz files.

• /var/log/pta/vaultServices_old/*.log
• /var/log/pta/casosServices_old/*.log

Number

5

Determines the period of time that compressed VaultServices and CasosServices log files are kept on the PTA Server before being deleted.

Number

60

Determines the period of time that the following logs are kept before being compressed into /var/log/pta/app/tomcat_logs_<date>.tar.gz:

• /var/log/pta/app/manager.*.log
• /var/log/pta/app/localhost_access_log.*.txt
• /var/log/pta/app/localhost.*.log
• /var/log/pta/app/host-manager.*.log
• /var/log/pta/app/catalina.*.log

Number

5

Determines the period of time that /var/log/pta/app/tomcat_logs_<date>.tar.gz files are kept on the PTA Server before being deleted.

Number