Monitored Events
The Add-On supports monitoring of the following syslog events from CyberArk PAS:
| Event ID | Description |
|---|---|
| 22 | Password verification by Central Policy Manager (success) |
| 24 | Password stored in EPV changed by Central Policy Manager (success) |
| 31 | Password reconciliation by Central Policy Manager (success) |
| 38 | Password verification by Central Policy Manager (failure) |
| 57 | Password stored in Enterprise Password Vault changed by Central Policy Manager (failure) |
| 60 | Password reconciliation by Central Policy Manager (failure) |
| 130 | Password stored in Enterprise Password Vault disabled by Central Policy Manager |
| 295 | User retrieved a password stored in Enterprise Password Vault |
| 300 | User session started in Privileged Session Manager |
| 302 | User session ended in Privileged Session Manager |
| 308 | User used a password stored in Enterprise Password Vault |
| 411 | A window was activated by user in Privileged Session Manager |