# Raw Events

Ingests raw audit events from Idira (formerly CyberArk EPM / Endpoint Privilege Manager), capturing privileged-access and policy-enforcement activity across all configured Sets.

**Sync Type: Incremental**

## Prerequisites

Before connecting Monad to Idira, you need:

1. An active Idira (CyberArk EPM) tenant with access to the EPM API
2. A CyberArk Identity tenant configured with an OAuth application for service-to-service authentication
3. An OAuth2 service user (client ID and client secret) with permission to read audit events from the EPM API
4. The region-specific EPM API hostname for your tenant (e.g. `na101.epm.cyberark.com`)
5. The CyberArk Identity tenant hostname used for OAuth2 token exchange (e.g. `monad321.cyberark.cloud`)

## Authentication

Idira uses OAuth2 client credentials (service user) for authentication. The connector exchanges a client ID and client secret against the CyberArk Identity tenant to obtain a bearer token, which is then used for all EPM API calls.

To set up authentication:

1. **Identify your CyberArk Identity tenant hostname** — this is the base URL for the OAuth2 token endpoint (e.g. `monad321.cyberark.cloud`).
2. **Create or identify an OAuth application** in your Identity tenant. Note the OAuth Application ID (e.g. `EPMforMonad`) — this is appended to the token URL path.
3. **Create a service user** in CyberArk Identity and note the username (Client ID) and password (Client Secret). The service user must have sufficient permissions to call the EPM audit events API.
4. **Identify your EPM API hostname** — this is the region-specific base URL for EPM REST API calls (e.g. `na101.epm.cyberark.com`).

See [Authenticate with Identity Administration](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-identity-administration.htm) for step-by-step instructions on generating the Client ID and Client Secret.

## Configuration

### Settings

| Setting | Type | Required | Description |
| ------- | ---- | -------- | ----------- |
| Identity Host | string | Yes | CyberArk Identity tenant hostname used for OAuth2 token exchange (e.g. `monad321.cyberark.cloud`). |
| EPM Host | string | Yes | Region-specific Idira (formerly CyberArk EPM) API hostname used as the base URL for all EPM API calls (e.g. `na101.epm.cyberark.com`). |
| OAuth Application ID | string | Yes | OAuth application ID configured on the CyberArk Identity tenant. Sent as the trailing segment of the token URL (e.g. `EPMforMonad`). |
| Client ID | string | Yes | OAuth2 client ID — the service user's username sent as HTTP Basic auth to the token endpoint. |
| Set IDs | array of strings | No | List of EPM Set IDs to fetch audit events for. When empty, all Sets accessible to the authenticated user are enumerated automatically. |
| Backfill Start Time | string | No | The date to start fetching audit events from (RFC3339 format, e.g. `2024-01-15T00:00:00Z`). If not specified, defaults to the last 24 hours on first run. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Maximum 3 requests per second. Leave blank to use the connector's default behavior. See [API Rate Limiting](../../../guides/rate-limiting) for the field format, limits, and how to choose a value. |
| Use Synthetic Data | boolean | No | Generate synthetic demo data instead of connecting to the real data source. |

### Secrets

| Secret | Type | Required | Description |
| ------ | ---- | -------- | ----------- |
| Client Secret | string | Yes | OAuth2 client secret — the service user's password sent as HTTP Basic auth to the token endpoint. |

## Setup Walk-through

1. **Gather your Idira credentials** — collect the Identity Host, EPM Host, OAuth Application ID, Client ID, and Client Secret as described in the Authentication section above.

2. **In Monad, create a new pipeline** and select **Idira** as the input source.

3. **Select Audit Events** as the data type.

4. **Enter the Settings**:
   - Set **Identity Host** to your CyberArk Identity tenant hostname.
   - Set **EPM Host** to your region-specific EPM API hostname.
   - Set **OAuth Application ID** to the OAuth application configured in your Identity tenant.
   - Set **Client ID** to your service user's username.
   - Optionally enter one or more **Set IDs** to restrict collection to specific EPM Sets. Leave empty to collect from all visible Sets.
   - Optionally set **Backfill Start Time** to a past date (RFC3339) if you want to retrieve historical audit events.

5. **Enter the Secret**:
   - Set **Client Secret** to your service user's password.

6. **Save and activate** the pipeline. Monad will begin collecting audit events incrementally, advancing the cursor per Set as events are processed.

## Troubleshooting

### Common Issues

1. **Authentication Failures (401 Unauthorized)**
   - Verify the Client ID and Client Secret are correct and belong to the service user configured in your Identity tenant.
   - Confirm the OAuth Application ID exactly matches the application configured in CyberArk Identity.
   - Check that the Identity Host is the correct hostname for your tenant's Identity endpoint.

2. **Connection Errors / Wrong Hostname**
   - Confirm the EPM Host is the region-specific hostname for your EPM deployment. EPM hostnames vary by region (e.g. `na101.epm.cyberark.com` for North America).
   - Ensure hostnames do not include a scheme prefix (`https://`) — enter the bare hostname only.

3. **Missing Audit Events**
   - If specific Sets are configured via **Set IDs**, confirm the IDs are correct and that the service user has access to those Sets.
   - If no Set IDs are provided, confirm the service user has permission to call the `/Sets` enumeration endpoint.
   - Adjust **Backfill Start Time** to extend the historical window if expected events are not appearing.

4. **Rate Limiting**
   - The connector enforces a maximum of 3 requests per second. If you encounter rate limit errors from the EPM API, reduce the configured **API Rate Limit** below the default maximum.

## Related Articles

- [CyberArk EPM Documentation](https://docs.cyberark.com/epm/latest/en/content/resources/_topnav/cc_home.htm)
- [Authenticate with Identity Administration](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-identity-administration.htm)
- [CyberArk EPM REST API Reference](https://docs.cyberark.com/epm/latest/en/content/webservices/api%20commands.htm)
- [Get Policy Audit Raw Event Details](https://docs.cyberark.com/epm/latest/en/content/webservices/getpolicyauditraweventdetails.htm)