Configure BeyondTrust Privileged Remote Access for Integration with Splunk
The Splunk integration supports consumption of syslog output directly from the B Series Appliance.
To enable this, follow the steps below. These steps are completed in the BeyondTrust/appliance administrative interface.
- Access your BeyondTrust interface by going to the hostname of your B Series Appliance followed by /appliance, for example, .
- Go to /appliance >Security > Appliance Administration and locate the Syslog section.
- Enter the hostname or IP address for your remote syslog server.
- Select your preferred message format.
- Click Submit.
Verify the API is Enabled
This integration requires the BeyondTrust XML API to be enabled. This feature is used by the BeyondTrust Middleware Engine to communicate with the BeyondTrust APIs.
Go to /login > Management > API Configuration and verify that Enable XML API is checked.
Create an OAuth API Account
The Splunk API account is used from within Splunk to make Privileged Remote Access Command API calls to Privileged Remote Access.
- In /login, navigate to Management > API Configuration.
- Click Add.
- Check Enabled.
- Enter a name for the account.
- OAuth Client ID and OAuth Client Secret is used during the OAuth configuration step in Splunk.
- Under Permissions, check the following:
- Command API: Full Access.
- Reporting API: Allow Access to Support Session Reports and Recordings, and Allow Access to Presentation Session Reports and Recordings.
- Click Save at the top of the page to create the account.