Fetch PAN data

You get PAN data into CyberArk Identity User Behavior Analytics by adding the PAN source using the Idaptive Sensor. Idaptive Sensor is a data collector software that you must install and configure before you can add data sources. If you have not installed and configured it, see Use the CyberArk Identity User Behavior Analytics sensor.

Each data source instance is defined by its own time range, so you must create multiple data sources if you want to use data from different time ranges. For example, if you want to use PAN data for the month of January, then you create a data source using an absolute time range. If you then need data for the last 10 hours from the current time, then you create another data source using a relative time range.

To fetch PAN data:

  1. Log in to CyberArk Identity User Behavior Analytics.

  2. Click Settings > Sensor.

  3. Click Add Source link associated with the relevant sensor.

    The Add Data Source window opens.

    1. Click the Palo Alto Networks Cloud Services Source radio button then click Next.

    2. Provide the following information:

      • Source Name – A descriptive name to identify the source.

      • Time Range – Select the time range you want the PAN data to be fetched. Options are Absolute Range or Relative Range.

        Absolute Range requires that you select a start and end date/time.

        Relative Range requires that you select a time relative to the current timestamp. For example, selecting 2 hours in the Relative Time field means the data source will contain data starting 2 hours prior to the current time.

      • Integration – Select the relevant integration entry. This should be the integration entry you created in the Create the integration entry procedure.

    3. Click Next.

    4. Click Done on the Choose Filter page, unless you want to specify filters for the data we receive from PAN.

      The source creation process begins. When done, you will see the Success status.

The newly added source is shown on the Sensor page with the Running status. The source must be deployed before you can see and utilize PAN data. PAN data in CyberArk Identity User Behavior Analytics are grouped into Models and you can create different versions of the data called Snapshots. See Start a snapshot.