Centrify Add-on for Splunk

Overview

Centrify, a recognized worldwide leader in Identity-Centric Privileged Access Management solutions, offers its customers seamless integration with Splunk Enterprise Security. Through the Centrify Add-On for Splunk, customers who leverage Splunk to monitor, search, analyze, and visualize IT machine-generated data can now enrich that data with Centrify-specific events.

The Centrify Add-On for Splunk categorizes event log data captured from the Centrify Platform related to privileged access activity and normalizes these events for the Splunk Common Information Model (CIM). This allows real-time analysis and risk mitigation to identify a potential breach in progress.

Key Features:
· Minimize the risk associated with privileged access abuse.
· Centralize visibility across enterprise deployments.
· Easily import categorized data sets from privileged user activity.
· Leverage existing investments in SIEM and alert tools without additional costs.

Release Notes

Version 2.4.0

March 16, 2021

Extend support to Splunk 8.x

Version 2.3.0

March 29, 2018

Fixed Issues to make the App compatible w/ Centrify Infrastructure Services 2017.1, 2017.2 and 2017.3 versions

Version 2.2

Oct. 16, 2017

Changed categorization of Centrify Infrastructure Services Audit events to centrify_css_winlog & centrify_css_syslog sourcetypes
Added the feature to replay session from Splunk with Centrify Infrastructure Services
Changed the name to Centrify Add-On for Splunk from Centrify Splunk Add-on

Version 2.1

Sept. 15, 2016

Version 2.0

Aug. 19, 2016

The Centrify Add-On V2.0 for Splunk:
- Deprecated the Centrify Splunk Insight Application
- This Add-On helps normalize the Centrify Server Suite events into Splunk and at the same time make it CIM complaint

2,618

Downloads

Share Subscribe

Version

Built by

Centrify Corporation

Support

Not Supported

Questions on Splunk Answers Flag as inappropriate