--- title: "CyberArk EPM" slug: "cyberark-epm" updated: 2025-03-24T16:39:53Z published: 2025-03-24T16:39:53Z canonical: "docs.databee.buzz/cyberark-epm" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # CyberArk EPM CyberArk Endpoint Privilege Manager (EPM) is a security solution that helps organizations protect their endpoints from cyber threats and reduce the risk of data theft or encryption. EPM helps block and contain attacks on endpoint computers. For detailed information, please refer to the [CyberArk’s official documentation](https://docs.cyberark.com/epm/25.2.1/en/content/landingpages/lpgetstarted.htm). **Integration Method:** API **Tables**: Detection Finding (2004), Process Activity (1007) This integration supports the following events. | **Event** | **Description** | | --- | --- | | Events | Retrieve raw events from EPM, according to filters. | This integration supports the following versions. | CyberArk EPM Version | 25.2.1 | | --- | --- | | CyberArk EPM API version | 24.9.0 | ## Prerequisites - The user should have enabled **Account Administrator** with **View Only** permission and **Allow to manage Sets** option. - The sets should be bound to the user. - The user should have access to the DataBee console. ## Configuration Overview 1. Create a User in the CyberArk console with the required permissions. 2. Add the [CyberArk EPM data feed](/user-manual/docs/cyberark-epm#databee-configuration) in the DataBee console with the below parameters | **DataBee Parameter** | **Dropbox Parameter** | | --- | --- | | Username | Username of the user | | Password | Password of the user | | Token URL | CyberArk dispatcher server name | | API Base URL | CyberArk EPM instance URL | ## CyberArk EPM Configuration 1. Go to your CyberArk EPM login page and get the **Dispatcher Server name** as highlighted below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-eezuapwm.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 2. Log in to CyberArk EPM console. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-gchuydpf.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 3. Get the CyberArk EPM **instance URL** as highlighted below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-qf51lr4b.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 4. Click on **Administration**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-6liyku6b.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 5. Click on the **Create** > **Create User** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-gpajinps.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 6. Fill out the required details on the form like Email and Password. Ensure that **Account Administrator** with **View Only** permission and **Allow to manage Sets** are checked. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-ij44sfyv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 7. This email and password will be used later while configuring data source. Click on **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-tp1tuqae.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 8. Select **View Only Set Admin** as roles for each set to bound this user to each set then click on the **Finish** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-dmfpzwml.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) > [!NOTE] > **Note:** > > After creating new user, there will be an email verification. Login to CyberArk EPM console with newly created user credentials. ### Binding user to new set > [!NOTE] > **Note**: > > This step is not required initially but if we create a new set then we must bound new set to user which we have created previously. Only Administrator user can bind newly created user to new set. 1. Login into CyberArk EPM console using Administrator user credentials and then click on **Administration**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-gnivjvak.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 2. In the **Account Management** portal, you can see the list of sets as highlighted below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-485mbuer.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 3. Select the set which you have newly created. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-gqq38h1d.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 4. Click on **Bind** > **Change binding for Set “”**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-s2jcxvcq.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 5. Update Roles to **View Only Set Admin** for user which we have created previously. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-wahk5vnx.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 6. Click on the **OK** button**.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-h8eoxnal.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-t3plky7n.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 2. Search for the **CyberArk EPM** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-3dr30jfr.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 3. Click on the **API Ingest** option for collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-nwfrn6qw.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 4. Enter feed contact information and click **Next.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-zvpmccig.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) 5. In the configuration page, confirm the following: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/cyberark-epm-mar2025-image-czn3j8kz.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A09Z&se=2026-10-30T12%3A37%3A09Z&sr=c&sp=r&sig=pzWl78LFKBojUNQ9C3lknwGi%2F7Kle%2FhXa3eDcuCKVxw%3D) - Authorization Method: Token Url Auth - API Base URL: replace the with your CyberArk EPM instance URL. - Username: enter the Email Id of the user which we have created earlier. - Password: enter the Password of the user which we have created earlier. - Token URL: replace the with your CyberArk EPM dispatcher server name. - Event Types: preselected for all the event types that integration pulls. 6. Click **Submit**. ## Troubleshooting Tips - Make you we have provided correct CyberArk EPM dispatcher server name and Instance URL. - If we are creating new set, then make sure we bind our user which we have created earlier to the newly created set - Make sure we do the email verification by login into CyberArk EPM console for newly created user if we are getting **401** error.