Managing Cyberark

CyberArk Management Skill

Safely read and audit CyberArk — the privileged access management platform.

MANDATORY: Discovery-First Pattern

Always discover safes, platforms, and account categories before accessing specific credentials. Never guess safe names or account IDs.

Phase 1: Discovery

#!/bin/bash

cyberark_api() {
    local endpoint="$1"
    local method="${2:-GET}"
    curl -s -X "$method" \
         -H "Authorization: $CYBERARK_SESSION_TOKEN" \
         -H "Content-Type: application/json" \
         "${CYBERARK_BASE_URL}/PasswordVault/api/${endpoint}"
}

# Authenticate first
cyberark_auth() {
    CYBERARK_SESSION_TOKEN=$(curl -s -X POST \
        -H "Content-Type: application/json" \
        -d "{\"username\":\"$CYBERARK_USER\",\"password\":\"$CYBERARK_PASS\"}" \
        "${CYBERARK_BASE_URL}/PasswordVault/api/auth/cyberark/logon" | tr -d '"')
}

echo "=== Server Info ==="
cyberark_api "ServerWebServices.svc/rest/server" 2>/dev/null | jq '.' || echo "Server info endpoint may vary by version"

echo ""
echo "=== Safes ==="
cyberark_api "Safes?limit=25" | jq -r '.value[]? | "\(.SafeUrlId)\t\(.SafeName)\t\(.Description // "N/A")\tMembers:\(.NumberOfDaysRetention // "N/A")"' | column -t

echo ""
echo "=== Platforms ==="
cyberark_api "Platforms" | jq -r '.Platforms[]? | "\(.PlatformID)\t\(.Name)\t\(.Active)"' | column -t

echo ""
echo "=== Account Summary ==="
cyberark_api "Accounts?limit=1" | jq '.count // .Total // "N/A"'

Phase 1 outputs: Safe list, platform inventory, account summary — only reference these in subsequent operations.

Anti-Hallucination Rules

• NEVER guess safe names — always list safes in Phase 1
• NEVER assume account IDs — always search accounts first
• NEVER fabricate platform names — always list platforms
• ONLY read and list — never retrieve passwords, create, update, or delete without explicit request

Safety Rules

• READ-ONLY by default: GET requests only — Safes, Accounts, Platforms, LiveSessions, Recordings
• NEVER retrieve passwords: Never call Accounts/{id}/Password/Retrieve unless explicitly requested
• MASK sensitive data: Redact all credential values, secret keys, and certificate contents
• FORBIDDEN without explicit request: Password retrieval, account creation/deletion, safe modifications, credential rotation triggers
• NEVER display passwords in output: Even if retrieved, mask with *** REDACTED ***

Core Helper Functions

#!/bin/bash

cyberark_api() {
    local endpoint="$1"
    local method="${2:-GET}"
    curl -s -X "$method" \
         -H "Authorization: $CYBERARK_SESSION_TOKEN" \
         -H "Content-Type: application/json" \
         "${CYBERARK_BASE_URL}/PasswordVault/api/${endpoint}"
}

# Search accounts with safe filtering
search_accounts() {
    local search="$1"
    local safe="${2:-}"
    local filter=""
    [ -n "$safe" ] && filter="&filter=safeName eq ${safe}"
    cyberark_api "Accounts?search=${search}&limit=20${filter}"
}

# Paginated fetch
cyberark_paginated() {
    local endpoint="$1"
    local max_results="${2:-200}"
    local offset=0
    local limit=50

    while [ $offset -lt $max_results ]; do
        local sep="?"
        [[ "$endpoint" == *"?"* ]] && sep="&"
        result=$(cyberark_api "${endpoint}${sep}limit=${limit}&offset=${offset}")
        echo "$result" | jq '.value // .Accounts // []' 2>/dev/null
        count=$(echo "$result" | jq '.value // .Accounts // [] | length' 2>/dev/null)
        [ "${count:-0}" -lt "$limit" ] && break
        offset=$((offset + limit))
    done
}

Common Operations

Safe Management & Members

#!/bin/bash
SAFE_NAME="${1:?Safe name required — discover via Phase 1}"

echo "=== Safe Details: $SAFE_NAME ==="
cyberark_api "Safes/${SAFE_NAME}" | jq '{
    safe_name: .SafeName,
    description: .Description,
    location: .Location,
    managing_cpm: .ManagingCPM,
    number_of_versions: .NumberOfVersionsRetention,
    number_of_days: .NumberOfDaysRetention,
    olac_enabled: .OLACEnabled,
    creation_time: .CreationTime
}'

echo ""
echo "=== Safe Members ==="
cyberark_api "Safes/${SAFE_NAME}/Members" | jq -r '.value[]? | {
    name: .MemberName,
    type: .MemberType,
    permissions: {
        use_accounts: .Permissions.UseAccounts,
        retrieve_accounts: .Permissions.RetrieveAccounts,
        list_accounts: .Permissions.ListAccounts,
        manage_safe: .Permissions.ManageSafe,
        manage_safe_members: .Permissions.ManageSafeMembers,
        view_audit_log: .Permissions.ViewAuditLog
    }
}'

Account Discovery & Search

#!/bin/bash
SEARCH="${1:?Search term required (account name, address, or username)}"

echo "=== Account Search: $SEARCH ==="
cyberark_api "Accounts?search=${SEARCH}&limit=20" | jq -r '.value[]? | {
    id: .id,
    name: .name,
    address: .address,
    username: .userName,
    safe: .safeName,
    platform_id: .platformId,
    secret_type: .secretType,
    secret_management: {
        automatic: .secretManagement.automaticManagementEnabled,
        last_modified: .secretManagement.lastModifiedTime,
        last_reconciled: .secretManagement.lastReconciledTime,
        last_verified: .secretManagement.lastVerifiedTime,
        status: .secretManagement.status
    },
    created_time: .createdTime
}'

echo ""
echo "=== Accounts by Platform ==="
cyberark_api "Accounts?limit=100" | jq -r '[.value[]? | .platformId] | group_by(.) | map({platform: .[0], count: length}) | sort_by(-.count) | .[] | "\(.platform)\t\(.count)"' | column -t

Session Monitoring

#!/bin/bash
echo "=== Active PSM Sessions ==="
cyberark_api "LiveSessions?limit=20" | jq -r '.LiveSessions[]? | {
    session_id: .SessionID,
    user: .User,
    target_user: .AccountUserName,
    target_address: .RemoteMachine,
    from_ip: .FromIP,
    protocol: .Protocol,
    start_time: .Start,
    duration: .Duration,
    risk_score: .RiskScore
}'

echo ""
echo "=== Recent Session Recordings ==="
cyberark_api "Recordings?limit=20&Sort=Start&SortDirection=desc" | jq -r '.Recordings[]? | "\(.SessionID)\t\(.User)\t\(.AccountUserName)\t\(.RemoteMachine)\t\(.Start)\t\(.Duration)s"' | column -t

echo ""
echo "=== High-Risk Sessions ==="
cyberark_api "LiveSessions?limit=50" | jq -r '.LiveSessions[]? | select(.RiskScore > 50) | "\(.SessionID)\t\(.User)\t\(.RiskScore)\t\(.RemoteMachine)"' | column -t

Credential Rotation Status

#!/bin/bash
echo "=== CPM Status — Recent Rotation Activity ==="
cyberark_api "Accounts?limit=50" | jq -r '.value[]? | select(.secretManagement.automaticManagementEnabled == true) | {
    name: .name,
    safe: .safeName,
    last_modified: .secretManagement.lastModifiedTime,
    last_verified: .secretManagement.lastVerifiedTime,
    status: .secretManagement.status
}'

echo ""
echo "=== Accounts with Failed Rotation ==="
cyberark_api "Accounts?limit=100" | jq -r '.value[]? | select(.secretManagement.status != "success" and .secretManagement.status != null) | "\(.name)\t\(.safeName)\t\(.secretManagement.status)"' | column -t

echo ""
echo "=== Accounts Not Rotated (>90 days) ==="
THRESHOLD=$(date -u -v-90d +%s 2>/dev/null || date -u -d '90 days ago' +%s)
cyberark_api "Accounts?limit=100" | jq -r --arg t "$THRESHOLD" '.value[]? | select(.secretManagement.lastModifiedTime < ($t | tonumber)) | "\(.name)\t\(.safeName)\t\(.secretManagement.lastModifiedTime | todate)"' | column -t 2>/dev/null

Security Audit

#!/bin/bash
echo "=== Safe Permissions Audit ==="
cyberark_api "Safes?limit=50" | jq -r '.value[]?.SafeUrlId' | while read safe; do
    echo "--- Safe: $safe ---"
    cyberark_api "Safes/${safe}/Members" | jq -r '.value[]? | select(.Permissions.RetrieveAccounts == true) | "  RETRIEVE access: \(.MemberName) (\(.MemberType))"'
done | head -40

echo ""
echo "=== Accounts with Manual Management ==="
cyberark_api "Accounts?limit=100" | jq -r '.value[]? | select(.secretManagement.automaticManagementEnabled == false) | "\(.name)\t\(.safeName)\t\(.address)\tManual management"' | column -t | head -20

Output Format

Present results as a structured report:

Managing Cyberark Report
════════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Counter-Rationalizations

Common Pitfalls

• Authentication methods: PVWA supports CyberArk, LDAP, RADIUS, and SAML auth — endpoint path differs (auth/cyberark/logon vs auth/ldap/logon)
• Session token expiry: Tokens expire after inactivity (default 20 min) — re-authenticate if getting 401
• API versions: Self-hosted (PVWA) and Privilege Cloud have different API base URLs and some endpoint differences
• Safe URL encoding: Safe names with spaces must be URL-encoded — use SafeUrlId instead of SafeName in paths
• CPM dependency: Automatic credential rotation requires CPM to be running and configured — check CPM status separately
• Password retrieval auditing: Every password retrieval is logged — even read-only access to passwords creates audit entries
• Dual control: Some safes require dual-control approval before password retrieval — API calls will return pending status
• PSM vs direct access: Session recordings are only available for PSM-proxied connections — direct connections are not recorded