Skip to content

Commit fbf03d5

Browse files
[Security] Privileged user monitoring - integrations
1 parent f2b151d commit fbf03d5

File tree

1 file changed

+15
-0
lines changed

1 file changed

+15
-0
lines changed

solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,26 @@ Privileged users typically include accounts with elevated access rights that all
2828

2929
You can define privileged users in the following ways:
3030

31+
* {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview` [Add a supported integration](#add-integration) with your organization’s user identities. If your environment is already ingesting data from a supported integration, the setup steps are skipped—you're taken directly to the Privileged user monitoring dashboard, where you can start [monitoring user activity](/solutions/security/advanced-entity-analytics/monitor-privileged-user-activitites.md).
3132
* [Select an existing index](#privmon-index) or create a new custom index with privileged user data.
3233
* [Bulk-upload](#privmon-upload) a list of privileged users using a CSV or TXT file.
3334
* Use the Entity analytics APIs to [mark individual users as privileged]({{kib-apis}}/operation/operation-createprivmonuser) or [bulk-upload multiple privileged users]({{kib-apis}}/operation/operation-privmonbulkuploaduserscsv).
3435

3536
To get started, find the **Privileged user monitoring** page in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
3637

38+
### Add a supported integration [add-integration]
39+
```yaml {applies_to}
40+
stack: preview 9.2
41+
serverless: preview
42+
```
43+
44+
1. On the **Privileged user monitoring** page, select an integration. The supported integrations are:
45+
* [Active Directory Entity Analytics](integration-docs://reference/entityanalytics_ad.md). Users in the following security groups will be automatically assigned as privileged users:
46+
* Domain Admins
47+
* Enterprise Admins
48+
* [Okta Entity Analytics](integration-docs://reference/entityanalytics_okta.md). Refer to [Standard administrator roles and permissions](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm) for a list of Okta roles that will be automatically assigned as privileged users.
49+
2. Follow the steps to install the integration.
50+
3751
### Select or create an index [privmon-index]
3852
3953
1. On the **Privileged user monitoring** page, click **Index**.
@@ -78,6 +92,7 @@ You can use multiple data source types, such as an index and a CSV file, at the
7892

7993
On this page, you can:
8094

95+
* {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview` Change which integrations you're using as data sources.
8196
* View, remove, and change indices after initially defining them.
8297
* Import a new supported file with a list of privileged users.
8398

0 commit comments

Comments
 (0)