Copy page

Idira

Raw Events

Ingests raw audit events from Idira (formerly CyberArk EPM / Endpoint Privilege Manager), capturing privileged-access and policy-enforcement activity across all configured Sets.

Sync Type: Incremental

Prerequisites

Before connecting Monad to Idira, you need:

1. An active Idira (CyberArk EPM) tenant with access to the EPM API
2. A CyberArk Identity tenant configured with an OAuth application for service-to-service authentication
3. An OAuth2 service user (client ID and client secret) with permission to read audit events from the EPM API
4. The region-specific EPM API hostname for your tenant (e.g. na101.epm.cyberark.com)
5. The CyberArk Identity tenant hostname used for OAuth2 token exchange (e.g. monad321.cyberark.cloud)

Authentication

Idira uses OAuth2 client credentials (service user) for authentication. The connector exchanges a client ID and client secret against the CyberArk Identity tenant to obtain a bearer token, which is then used for all EPM API calls.

To set up authentication:

1. Identify your CyberArk Identity tenant hostname — this is the base URL for the OAuth2 token endpoint (e.g. monad321.cyberark.cloud).
2. Create or identify an OAuth application in your Identity tenant. Note the OAuth Application ID (e.g. EPMforMonad) — this is appended to the token URL path.
3. Create a service user in CyberArk Identity and note the username (Client ID) and password (Client Secret). The service user must have sufficient permissions to call the EPM audit events API.
4. Identify your EPM API hostname — this is the region-specific base URL for EPM REST API calls (e.g. na101.epm.cyberark.com).

See Authenticate with Identity Administration for step-by-step instructions on generating the Client ID and Client Secret.

Configuration

Settings

Setting	Type	Required	Description
Identity Host	string	Yes	CyberArk Identity tenant hostname used for OAuth2 token exchange (e.g. monad321.cyberark.cloud).
EPM Host	string	Yes	Region-specific Idira (formerly CyberArk EPM) API hostname used as the base URL for all EPM API calls (e.g. na101.epm.cyberark.com).
OAuth Application ID	string	Yes	OAuth application ID configured on the CyberArk Identity tenant. Sent as the trailing segment of the token URL (e.g. EPMforMonad).
Client ID	string	Yes	OAuth2 client ID — the service user's username sent as HTTP Basic auth to the token endpoint.
Set IDs	array of strings	No	List of EPM Set IDs to fetch audit events for. When empty, all Sets accessible to the authenticated user are enumerated automatically.
Backfill Start Time	string	No	The date to start fetching audit events from (RFC3339 format, e.g. 2024-01-15T00:00:00Z). If not specified, defaults to the last 24 hours on first run.
API Rate Limit	object	No	Optional limit on the connector's outbound request rate to the source API. Maximum 3 requests per second. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value.
Use Synthetic Data	boolean	No	Generate synthetic demo data instead of connecting to the real data source.

Secrets

Secret	Type	Required	Description
Client Secret	string	Yes	OAuth2 client secret — the service user's password sent as HTTP Basic auth to the token endpoint.

Setup Walk-through

1. Gather your Idira credentials — collect the Identity Host, EPM Host, OAuth Application ID, Client ID, and Client Secret as described in the Authentication section above.

2. In Monad, create a new pipeline and select Idira as the input source.

3. Select Audit Events as the data type.

4. Enter the Settings:

   • Set Identity Host to your CyberArk Identity tenant hostname.
   • Set EPM Host to your region-specific EPM API hostname.
   • Set OAuth Application ID to the OAuth application configured in your Identity tenant.
   • Set Client ID to your service user's username.
   • Optionally enter one or more Set IDs to restrict collection to specific EPM Sets. Leave empty to collect from all visible Sets.
   • Optionally set Backfill Start Time to a past date (RFC3339) if you want to retrieve historical audit events.

5. Enter the Secret:

   • Set Client Secret to your service user's password.

6. Save and activate the pipeline. Monad will begin collecting audit events incrementally, advancing the cursor per Set as events are processed.

Troubleshooting

Common Issues

1. Authentication Failures (401 Unauthorized)

   • Verify the Client ID and Client Secret are correct and belong to the service user configured in your Identity tenant.
   • Confirm the OAuth Application ID exactly matches the application configured in CyberArk Identity.
   • Check that the Identity Host is the correct hostname for your tenant's Identity endpoint.

2. Connection Errors / Wrong Hostname

   • Confirm the EPM Host is the region-specific hostname for your EPM deployment. EPM hostnames vary by region (e.g. na101.epm.cyberark.com for North America).
   • Ensure hostnames do not include a scheme prefix (https://) — enter the bare hostname only.

3. Missing Audit Events

   • If specific Sets are configured via Set IDs, confirm the IDs are correct and that the service user has access to those Sets.
   • If no Set IDs are provided, confirm the service user has permission to call the /Sets enumeration endpoint.
   • Adjust Backfill Start Time to extend the historical window if expected events are not appearing.

4. Rate Limiting

   • The connector enforces a maximum of 3 requests per second. If you encounter rate limit errors from the EPM API, reduce the configured API Rate Limit below the default maximum.

Related Articles

• CyberArk EPM Documentation
• Authenticate with Identity Administration
• CyberArk EPM REST API Reference
• Get Policy Audit Raw Event Details