Thycotic Secret Server Integration

Thycotic Secret Server

Version: Thycotic Secret Server version 10.9.

Thycotic Secret Server (SS) is an enterprise-grade, privileged access management solution that is quickly deployable and easily managed. With Thycotic SS, user can automatically discover and manage their privileged accounts through an intuitive interface, protecting against malicious activity, across the enterprise.

Netsurion's Open XDR platform helps to monitor events from Thycotic SS. It's reports, alerts, and dashboards will help you to analyze the activity logs such as, user management, secret view/delete, heartbeat failure, etc. Reports are provided to get a detailed summary of events during specific time. This contains critical information such as, time of occurrence of events, user source IP and action taken by user.

Dashboards are basically a graphical representation of the events, which allows administrators to take an overview of key information found such as, total number or percentage of audit events or operational events. Alerts, such as, secret heartbeat failure or unsuccessful login attempts, will be triggered in real time to let administrators know, critical events are occurring within their networks.

After the Thycotic Secret Server is configured to deliver events to the Netsurion's Open XDR platform, the dashboards and reports can be configured into Netsurion's Open XDR platform.

Some of the Data Source Integrations available in Netsurion are listed below.

Alerts

Type	Name	Description
Security	Thycotic SS - A configuration change has been detected	This alert is triggered by Netsurion when it detects an event, that is flagged as “configuration changes made by any user.”
Security	Thycotic SS - A failed user login has been detected	: This alert is triggered, when an event is detected by Netsurion, pointing towards a login failure attempt made by any user.
Operations	Thycotic SS - A folder permissions have been changed	This alert is triggered by Netsurion when it detects a change in folder permissions.
Operations	Thycotic SS - A role has been assigned to a user or group	This alert is triggered by Netsurion when a user or group is assigned a new role.
Operations	Thycotic SS - A role has been removed from a user or group	This alert is triggered by Netsurion when a role is removed from a user or a group.
Operations	Thycotic SS - A Secret has expired today	This alert is triggered by Netsurion when a secret is expired.
Operations	Thycotic SS - A user password has been changed	This alert is triggered by Netsurion when a user has changed password.

Reports

Type	Name	Description
Security	Thycotic SS - User login fails	This report provides a detailed overview of all the failed login attempts, made by any user. It contains information such as login timestamp, username, and source IP address.
Security	Thycotic SS - Configuration Changes	This report provides a detailed overview of all the configuration changes made by any user in Thycotic SS console. It contains information such as old and new values, username, and source IP along with the timestamp at which activity was performed.
Operations	Thycotic SS - User and Group Management	This report provides a detailed overview of all the user and group management activities such as, user create/ delete, group create/delete, etc. It contains information such as, user who made the changes, target user or group name, source IP, and event timestamp.
Operations	Thycotic SS - Role Management	This report provides a detailed overview of all the role management activities such as, user or group assigned to a role, or disabled role, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.
Operations	Thycotic SS - Secrets Management	This report provides a detailed overview of all the secrets management activities such as, secret created, secret viewed, secret copied, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.
Operations	Thycotic SS - Folder Management	This report provides a detailed overview of all the folder management activities such as, folder created, folder deleted, folder's permissions changed, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.
Operations	Thycotic SS - Script Management	This report provides a detailed overview of all the script management activities such as, PowerShell script created/deleted, SSH script created/deleted, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.

Documentation

The configuration details are consistent with Netsurion's Open XDR platform version 9.x or later, and Thycotic Secret Server version 10.9.

Download Integration Guide and How-to Guide for more information and to configuration instructions.