Purpose
This guide explains how to forward BeyondTrust Password Safe and BeyondInsight events to Logsign USO through the BeyondInsight Syslog Event Forwarder connector. The integration covers Password Safe activity (managed account operations, release requests and approvals, sessions, password retrieval and automatic password changes) and BeyondInsight application audit events (console logins and logouts, failed logins, user, group and configuration changes). Native parsing for this source is available starting with Logsign USO version 6.4.119.
Prerequisites
- A BeyondInsight account that is allowed to create and edit connectors.
- Network connectivity from the BeyondInsight management server to the Logsign USO collector on your syslog port (TCP or UDP 514 by default).
- Logsign USO 6.4.119 or later.
Step 1: Configure the Syslog Event Forwarder in BeyondInsight
Menu names can differ between BeyondInsight releases. If a path below does not match your console, check the BeyondInsight documentation for SNMP trap and syslog event forwarding for your version.
- Log in to the BeyondInsight console and go to Configuration > General > Connectors.
- Create a new connector and choose Syslog Event Forwarder as the connector type.
- Set the Output Pipeline to TCP or UDP, and enter the IP address of the Logsign USO collector and the syslog port.
- Set the Formatter to Tab Delimited. Newline Delimited is also parsed and produces the same fields, but Tab Delimited keeps every event on a single line, which is safer if anything in the path splits messages at line breaks. Do not use Comma Delimited (see Notes and Limits).
- Leave the output as the default key/value layout. CEF, LEEF and JSON output are not handled by this integration.
- In the event selection, include the Password Safe events and the BeyondInsight application audit events you want to collect, then save the connector.
Step 2: Add the Data Source in Logsign USO
Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select BeyondTrust as the vendor and Password Safe as the product, and enter the IP address of the BeyondInsight server as the host. Click Save. Once the connector starts sending, events appear under Search.
Supported Message Format
Each message starts with an ISO 8601 timestamp and the address of the forwarding server, followed by Key: Value pairs. A shortened Password Safe session event with the Newline Delimited formatter looks like this (anonymized):
2026-09-11T10:01:34Z 192.0.2.10 Agent ID: PBPS
Agent Ver: 26.1.0.878
Category: System
Source Host: PAM-01
User: corp.local\jdoe
LogID: 34672
LogTime: 9/11/2026 10:00:19 AM
Details: Type=RDP ReleaseRequestId=2038
UserName: corp.local\jdoe
ObjectType: Session
ObjectID: 4377
Operation: Add
Failed: 0
Target: Asset:SRV-APP-01 Account:svc.app
UserID: 95
IPAddress: 10.1.1.10With Tab Delimited the same pairs are separated by tab characters instead of line breaks. Pairs separated by CRLF, LF or TAB (with or without a trailing space before the tab) are all accepted, and a leading syslog priority such as <14> is optional. A message is only recognized when it carries an Agent ID value.
What Gets Collected
| Logsign Field | BeyondTrust Field |
|---|---|
| Time.Generated |
LogTime, CreateDate or ChangeDt. If none of them is present in the M/D/YYYY h:mm:ss AM/PM form, the timestamp at the start of the message is used. |
| Event.ID | LogID |
| Audit.ID | AuditID |
| Event.Category | Category |
| Event.Action |
ActionType, otherwise Operation
|
| Event.Info |
Details, otherwise Event Desc when it is not just a repeat of the category |
| Operation.Result | Success or Failure, derived from Result (S/F), Failed (0/1, True/False) or a category name that contains Failure |
| Source.UserName |
UserName or User Name
|
| Source.UserID |
UserID, AppUserID or User ID
|
| Source.IP, Source.City, Source.Country | IPAddress |
| Destination.HostName, Destination.Domain, TargetUser.Name | Taken from Target in the forms Asset:host Account:user, ManagedSystem=host ManagedAccount=user, Domain:domain MAccount:user and host/user, Account #N. TargetUser.Name is also filled from AccountName. |
| Object.Type, Object.ID |
ObjectType, ObjectID
|
| Session.ID |
ObjectID when ObjectType is Session |
| Request.ID | Release request number found in Details (ReleaseRequestId=, ReleaseRequest #, ISA Release # or a leading Request #) |
| System.Approval | Approver |
| Auth.Type | Authentication Type |
| Error.Message | Message |
| Browser.Name | Browser Info |
| Group.ID, Group.Name |
Group ID, Group Name
|
| Rule.Name |
SmartRule Name or Quick Rule Name
|
| Policy.ID | Access Policy Schedule ID |
| Device.Name | Source Host |
| Application.Name |
Agent ID (for example PBPS or AppAudit) |
| EventSource.Version | Agent Ver |
Every event is recorded with Vendor BeyondTrust, Product Password Safe, EventSource Type Security System and Category Access Control.
Event Classification
Password Safe events (Agent ID: PBPS) are classified by object type and operation. Automatic password changes (Category: Change) are classified by their result, and any other Password Safe operation reported with Failed set to 1 or True is classified as a failed operation.
| Password Safe event | EventMap | Severity | Event.VendorID |
|---|---|---|---|
| Account, Add | Identity / User / Add | information | 101 |
| Account, Delete | Identity / User / Delete | information | 102 |
| Release Request, Add | Identity / User / Request | information | 103 |
| Release Request, Approve | Identity / User / Grant | information | 104 |
| Request Response, Approve | Identity / User / Grant | information | 105 |
| Session, Add | Network / Session / Open | information | 106 |
| Password, Retrieve | Identity / Password / Other | information | 107 |
| Any object, Update | System / Configuration / Change | information | 108 |
| Password change, Result S | Identity / Password / Change | information | 109 |
| Password change, Result F | Identity / Password / Fail | warning | 110 |
| Any operation with Failed = 1 | Identity / User / Error | warning | 111 |
BeyondInsight application audit events (Agent ID: AppAudit) are classified by category and action type. When a category has no specific entry, the action type decides the classification.
| Application audit event | EventMap | Severity | Event.VendorID |
|---|---|---|---|
| Login, PMM Login | Identity / User / Login | information | 1, 2 |
| Login Failure, PMM Login Failure | Identity / User / Deny | warning | 3, 4 |
| Logout | Identity / User / Logout | information | 5 |
| User: Add, Edit, Delete | Identity / User / Add, Modify, Delete | information | 6, 7, 8 |
| User Group: Add, Edit, Delete | Identity / Group / Create, Change, Delete | information | 9, 10, 11 |
| Account Lockout | Identity / User / Lock | warning | 12 |
| Change Password | Identity / Password / Change | information | 13 |
| TOTP Authentication Failure, PMM API Authentication Rule Failure, Direct Connect Failure | Identity / User / Deny | warning | 14, 15, 16 |
| Other categories: Add, Edit, Delete, Schedule, Update, Import, Rename, Copy, Reset | System / Configuration / Change | information | 17 to 25 |
| Other categories: Assign | Object / Permission / Change | information | 26 |
| Other categories: Session End | Network / Session / Close | information | 27 |
| Other categories: Bulk Password Change | Identity / Password / Change | information | 28 |
| Other categories: Unlock | Identity / User / Unlock | information | 29 |
| Other categories: Read, Download, Generate, Validate | System / Configuration / Info | information | 30 to 33 |
Events that do not match any of the entries above, including events from other BeyondInsight agents, are still parsed and classified as Application / Other / Info with Event.VendorID 999. Their severity is warning when the result is Failure and information otherwise.
Notes and Limits
- Comma Delimited output is not supported. Several BeyondTrust values contain commas themselves (for example
Target: host/user, Account #16), so the pairs cannot be separated reliably, and such messages are not recognized. - Only the key/value output is parsed. If the connector is set to CEF, LEEF or JSON, the events are not recognized by this integration.
- Logsign does not use the BeyondTrust
Event Severityvalue. Severity comes from the classification tables above, and success or failure is taken fromResultorFailed. - Only Password Safe and application audit events have specific classifications. If you enable other event types in the connector, they are collected under Application / Other / Info, so filter on Application.Name and Event.Category when you build searches for them.
- With Newline Delimited output, every event must reach Logsign as a single syslog message. If an event is split at its line breaks on the way, the lines are not recognized. Tab Delimited avoids this.
Verification
After both sides are saved, you can check the integration end to end with a single console login.
- In Logsign USO, open Settings > Data Collection and confirm that the BeyondTrust Password Safe source is receiving data.
- Log in to the BeyondInsight console to generate a test event. In Logsign USO, go to Search and look for events with Vendor BeyondTrust and Product Password Safe. The login should appear with EventMap Identity / User / Login, Application.Name AppAudit and your user name in Source.UserName.
- If the source is receiving data but no events show Vendor BeyondTrust, the messages are not in a format this integration recognizes. Check that the connector uses the Tab Delimited or Newline Delimited formatter with the default key/value output.