diff --git a/solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md b/solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md index 863f86f381..d7719605ca 100644 --- a/solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md +++ b/solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md @@ -28,12 +28,26 @@ Privileged users typically include accounts with elevated access rights that all You can define privileged users in the following ways: +* {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview` [Add a supported integration](#privmon-integrations) with your organization’s user identities. If your environment is already ingesting data from a supported integration, the setup steps are skipped—you're taken directly to the Privileged user monitoring dashboard, where you can start [monitoring user activity](/solutions/security/advanced-entity-analytics/monitor-privileged-user-activitites.md). * [Select an existing index](#privmon-index) or create a new custom index with privileged user data. * [Bulk-upload](#privmon-upload) a list of privileged users using a CSV or TXT file. * Use the Entity analytics APIs to [mark individual users as privileged]({{kib-apis}}/operation/operation-createprivmonuser) or [bulk-upload multiple privileged users]({{kib-apis}}/operation/operation-privmonbulkuploaduserscsv). To get started, find the **Privileged user monitoring** page in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). +### Add a supported integration [privmon-integrations] +```yaml {applies_to} +stack: preview 9.2 +serverless: preview +``` + +1. On the **Privileged user monitoring** page, select an integration. The supported integrations are: + * [Active Directory Entity Analytics](integration-docs://reference/entityanalytics_ad.md). Users in the following security groups will be automatically assigned as privileged: + * Domain Admins + * Enterprise Admins + * [Okta Entity Analytics](integration-docs://reference/entityanalytics_okta.md). Refer to [Standard administrator roles and permissions](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm) for a list of Okta roles that will be automatically assigned as privileged users. +2. Follow the steps to install the integration. + ### Select or create an index [privmon-index] 1. On the **Privileged user monitoring** page, click **Index**. @@ -78,6 +92,7 @@ You can use multiple data source types, such as an index and a CSV file, at the On this page, you can: +* {applies_to}`stack: preview 9.2` {applies_to}`serverless: preview` Change which integrations you're using as data sources. * View, remove, and change indices after initially defining them. * Import a new supported file with a list of privileged users.