Centrify Server Suite

OverviewResources

Once Centrify Server Suite is configured to deliver events to EventTracker Manager; alerts, dashboards and reports can be configured into EventTracker.

Some of the Knowledge Packs available in EventTracker are listed below. For more information please refer Integration Guide.

Security

Alerts

Centrify DirectAuthorize agent stopped: This alert is generated by Centrify Windows Agent when DirectAuthorize Agent service stopped.
Centrify Dzdo execution denied: This alert is generated by Centrify Linux/Unix agent when dzdo command execution denied.
Centrify Dzdo execution granted: This alert is generated by Centrify Linux/Unix agent when dzdo execution granted.

Reports

Centrify PAM Account management granted: This report provides information related to PAM account management granted Service Name, User Name, Service Status, Reason, ClientIP from fields.
Centrify PAM Authentication Failed: This report provides information related to PAM authentication failures Service Name, User Name, Service Status, reason from fields.
Centrify PAM Authentication successful: This report provides information related to successful PAM authentications Service Name, User Name, Service Status, reason from fields.

Operations

Alerts

Centrify Adclient agent stopped: This alert is generated by Centrify Linux/Unix agent when Unix agent service stopped.
Centrify Configuration settings reloaded: This alert is generated by Centrify Linux/Unix agent when Configuration settings reloaded.
Centrify Create desktop failure: This alert is generated by Centrify Windows Agent when user failed to create desktop.

Reports

Centrify Adclient agent started: This report provides information related to when adclient agent service has started which include Service Name, User Name, Service Status from fields.
Centrify Adclient agent stopped: This report provides information related to adclient agent stopped which include Service Name, User Name, Service Status from fields.
Centrify Dzdo execution denied: This report provides information related to dzdo (command for Centrify privileged access) command execution denied which include Service Name, User Name, Service Status, reason from fields.
Centrify Dzdo execution granted: This report provides information related to dzdo (command for Centrify privileged access) command execution granted which include Service Name, User Name, Service Status, reason from fields.

Compliance

Alerts

Centrify PAM Authentication failed: This alert is generated by Centrify Linux/Unix agent when PAM authentication is failed.
Centrify Remote login failed: This alert is generated by Centrify Windows Agent when remote log in failed.
Centrify Run as role attempt failed: This alert is generated by Centrify Windows Agent when Run as role attempt failed.
Centrify SSHD denied: This alert is generated by Centrify Linux/Unix agent when Centrify SSHD denied.

Reports

Centrify PAM Session closed: This report provides information related to closed PAM sessions Service Name, User Name, Service Status, TTY, reason from fields.
Centrify PAM Session opened: This report provides information related to opened PAM sessions Service Name, User Name, Service Status, TTY, Reason from fields.
Centrify SSHD denied: This report provides information related to Centrify SSHD denied Service Name, User Name, Service Status, Reason from fields.
Centrify SSHD granted: This report provides information related to Centrify SSHD granted Service Name, User Name, Service Status, Reason from fields.

Scope

The configuration details in this guide are consistent with EventTracker version 7.X and later,Centrify Server Suite 2015 or higher.

Documentation:

For more information please refer to the Integration guide.