Thycotic Secret Server

OverviewResources

Once Thycotic Secret Server is configured to deliver events to EventTracker Manager; alerts, dashboards and reports can be configured into EventTracker.

Security

Alerts

Thycotic SS - A configuration change has been detected: This alert is triggered by EventTracker when it detects an event, that is flagged as “configuration changes made by any user.”
Thycotic SS - A failed user login has been detected: This alert is triggered, when an event is detected by EventTracker, pointing towards a login failure attempt made by any user.

Reports

Thycotic SS - User login fails: This report provides a detailed overview of all the failed login attempts, made by any user. It contains information such as login timestamp, username, and source IP address.
Thycotic SS - Configuration Changes: This report provides a detailed overview of all the configuration changes made by any user in Thycotic SS console. It contains information such as old and new values, username, and source IP along with the timestamp at which activity was performed.

Operations

Alerts

Thycotic SS - A folder permissions have been changed: This alert is triggered by EventTracker when it detects a change in folder permissions.
Thycotic SS - A role has been assigned to a user or group: This alert is triggered by EventTracker when a user or group is assigned a new role.
Thycotic SS - A role has been removed from a user or group: This alert is triggered by EventTracker when a role is removed from a user or a group.
Thycotic SS - A Secret has expired today: This alert is triggered by EventTracker when a secret is expired.
Thycotic SS - A user password has been changed: This alert is triggered by EventTracker when a user has changed password.

Reports

Thycotic SS - User and Group Management: This report provides a detailed overview of all the user and group management activities such as, user create/ delete, group create/delete, etc. It contains information such as, user who made the changes, target user or group name, source IP, and event timestamp.
Thycotic SS - Role Management: This report provides a detailed overview of all the role management activities such as, user or group assigned to a role, or disabled role, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.
Thycotic SS - Secrets Management: This report provides a detailed overview of all the secrets management activities such as, secret created, secret viewed, secret copied, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.
Thycotic SS - Folder Management: This report provides a detailed overview of all the folder management activities such as, folder created, folder deleted, folder's permissions changed, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.
Thycotic SS - Script Management: This report provides a detailed overview of all the script management activities such as, PowerShell script created/deleted, SSH script created/deleted, etc. It contains information such as, user who made the changes, target object name/type, source IP, and event timestamp.

Scope

The configuration details are consistent with EventTracker version 9.X and later, and Thycotic Secret Server (Cloud and On-Prem) version 10.9.

Documentation

To configure Thycotic Secret Server to send logs to EventTracker, refer to the How-to Guide.

For more information, please refer to the Integration guide.