Answers for "Is there any way to monitor cyberark logs?" The latest answers for the question "Is there any way to monitor cyberark logs?" Answer by koshyk Why you want to translate the file in your syslog server? Splunk is the best regex engine and you could do within Splunk If you need to use CyberArk addon directly is: 1. Put the Translator (xsl) file in the CyberARk Vault System. This has to be done by your cyberark admin. 2. After you put the translator file, it will send syslog message to the destination & port 3. Use your syslog server to capture this message. Please use rfc5424 if possible. This will put all the data correctly in your syslog server 4. Use Splunk to index this data and put the sourcetype as mentioned in CyberArk addon. If you don't want to use CyberARk addon 1. You need to put some translator file in cyberark and point to your syslog. Try to use a key-value translator if possible 2. Just use inputs.conf and collect into Splunk into an index and put your own sourcetype eg. custom:cyberark:vault 3. You can write your own extraction rules in your TA and is flexible. Ensure you collect important fields including safe-name, address,messageId,requestorId etc. Sun, 12 Aug 2018 17:36:18 GMT koshyk