Adding CyberArk Vault via Syslog

Updated October 12, 2026 08:17

Purpose

This guide explains how to forward CyberArk Vault (Privileged Access Manager) audit events to Logsign USO over syslog and what Logsign does with them. The CyberArk Vault integration reads the CEF (ArcSight) output of the Vault. Other Vault syslog formats are not parsed by this integration.

Prerequisites

A CyberArk administrator who can edit the Vault dbparm.ini file and restart the Vault service.
Network connectivity from the Vault (or from your syslog relay) to the Logsign USO collector on your syslog port (UDP or TCP 514 by default).
The Logsign user account that will add the data source needs access to Settings > Data Collection.

Step 1: Send Vault events in CEF format

The Vault writes syslog through the [SYSLOG] section of dbparm.ini. Set the translator file to the CyberArk ArcSight sample so that every event is written as CEF:

[SYSLOG]
SyslogServerIP=<Logsign collector or relay IP>
SyslogServerPort=514
SyslogServerProtocol=UDP
SyslogMessageCodeFilter=0-999
SyslogTranslatorFile=Syslog\Arcsight.sample.xsl

Parameter names, the message code range and the translator file location can differ between Vault releases. Check the CyberArk documentation for your version before you restart the Vault. Pipe-delimited or other non-CEF translator output (for example a custom XSL) is not recognized by the CyberArk Vault integration, and those messages do not show up as CyberArk Vault events.

Step 2: Keep the message intact if you use a syslog relay

If the Vault sends to an intermediate collector (rsyslog, syslog-ng or a similar relay) and the relay forwards to Logsign, the relay must pass the original message on without rewriting it. A relay that re-wraps the message, treats part of it as an application tag, inserts - - - placeholders or cuts long messages breaks the CEF record, and Logsign cannot parse it. Typical raw forwarding options are a template that sends %rawmsg% in rsyslog and flags(no-parse) on the source in syslog-ng. Switching the Vault to CEF does not help on its own while the relay still rewrites the messages.

Step 3: Add the data source in Logsign USO

Open the Logsign USO web interface and click + Device under Settings > Data Collection. Choose Syslog as the collection method, select CyberArk as the vendor and Vault as the product, and enter the IP address that the messages come from (the Vault, or the relay if you use one) as the host. Click Save. Once the Vault starts sending, events appear under Search.

Supported message format

Each message has a syslog header, the host name of the Vault, and the CEF record. The CEF record must start with CEF: directly after the host name. Logsign accepts three header timestamps:

Classic syslog (RFC 3164): Apr 20 11:53:35
RFC 5424 with whole seconds: 1 2017-04-20T11:53:35Z
RFC 5424 with fractional seconds: 1 2026-09-23T00:29:44.000000Z (one to six digits after the dot)

An example event with an RFC 5424 header (anonymized):

1 2026-09-23T00:29:44.000000Z PAM-DC-VAULT CEF:0|Cyber-Ark|Vault|9.81.0000|105|Add File Category|5|act=Add File Category suser=PSMApp_PSM1 fname=Root\example.session dvc= shost=192.0.2.16 dhost= duser= externalId= app= reason= cs1Label="Affected User Name" cs1= cs2Label="Safe Name" cs2=PSMRecordings cs3Label="Device Type" cs3= cs4Label="Database" cs4= cs5Label="Other info" cs5=ProviderID cn1Label="Request Id" cn1= cn2Label="Ticket Id" cn2=  msg=

Support for the fractional-second RFC 5424 header was added in a recent CyberArk Vault plugin update. On an appliance with an older plugin, messages with a .000000Z timestamp are not parsed. Contact Logsign support to confirm the version you need.

Notes and limits

The CyberArk Vault integration only reads CEF. A message whose body does not start with CEF: is left to other parsers and is not stored as a CyberArk Vault event.
The classic syslog header has no year, so Logsign adds the current year to Time.Generated for those messages.
Messages that are cut on the way (for example by a UDP relay with a short frame limit) lose the end of the CEF extension and the fields in it.

Verification

After both sides are saved, a single Vault action is enough to check the integration end to end.

In Logsign USO, open Settings > Data Collection and confirm that the CyberArk Vault source is receiving data.
Log in to the PVWA or retrieve a password to generate a test event. In Search, look for events with Vendor CyberArk and Product Vault. The user name should appear in Source.UserName and the Vault message code in Event.VendorID.
If the source is receiving data but no events show Vendor CyberArk, the messages are not in a format this integration recognizes. Capture a few raw lines and check that each one contains CEF:0|Cyber-Ark|Vault| right after the host name and that nothing was added to or cut from the line on the way.