Skip to content

Commit af2a651

Browse files
natasha-moore-elasticnaemono
authored andcommitted
[Security] Privileged user monitoring - integrations (elastic#3483)
Resolves elastic#3419 by documenting the support for Okta and Active Directory integrations within privileged user monitoring. Users can now use these integrations to define which user roles or groups in their environment are considered privileged. Preview: [Set up privileged user monitoring](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/3483/solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup)
1 parent 5b750ae commit af2a651

File tree

1 file changed

+14
-0
lines changed

1 file changed

+14
-0
lines changed

solutions/security/advanced-entity-analytics/privileged-user-monitoring-setup.md

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,12 +28,25 @@ Privileged users typically include accounts with elevated access rights that all
2828

2929
You can define privileged users in the following ways:
3030

31+
* {applies_to}`stack: preview 9.2` [Add a supported integration](#privmon-integrations) with your organization’s user identities. If your environment is already ingesting data from a supported integration, the setup steps are skipped—you're taken directly to the Privileged user monitoring dashboard, where you can start [monitoring user activity](/solutions/security/advanced-entity-analytics/monitor-privileged-user-activitites.md).
3132
* [Select an existing index](#privmon-index) or create a new custom index with privileged user data.
3233
* [Bulk-upload](#privmon-upload) a list of privileged users using a CSV or TXT file.
3334
* Use the Entity analytics APIs to [mark individual users as privileged]({{kib-apis}}/operation/operation-createprivmonuser) or [bulk-upload multiple privileged users]({{kib-apis}}/operation/operation-privmonbulkuploaduserscsv).
3435

3536
To get started, find the **Privileged user monitoring** page in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
3637

38+
### Add a supported integration [privmon-integrations]
39+
```yaml {applies_to}
40+
stack: preview 9.2
41+
```
42+
43+
1. On the **Privileged user monitoring** page, select an integration. The supported integrations are:
44+
* [Active Directory Entity Analytics](integration-docs://reference/entityanalytics_ad.md). Users in the following security groups will be automatically assigned as privileged:
45+
* Domain Admins
46+
* Enterprise Admins
47+
* [Okta Entity Analytics](integration-docs://reference/entityanalytics_okta.md). Refer to [Standard administrator roles and permissions](https://help.okta.com/en-us/content/topics/security/administrators-admin-comparison.htm) for a list of Okta roles that will be automatically assigned as privileged users.
48+
2. Follow the steps to install the integration.
49+
3750
### Select or create an index [privmon-index]
3851
3952
1. On the **Privileged user monitoring** page, click **Index**.
@@ -78,6 +91,7 @@ You can use multiple data source types, such as an index and a CSV file, at the
7891

7992
On this page, you can:
8093

94+
* {applies_to}`stack: preview 9.2` Change which integrations you're using as data sources.
8195
* View, remove, and change indices after initially defining them.
8296
* Import a new supported file with a list of privileged users.
8397

0 commit comments

Comments
 (0)