Skip to main content

IBM Security Privilage Vault

IBM Security Privilege Vault is an enterprise privileged access management (PAM) solution designed to secure, manage, and monitor access to critical systems, applications, and sensitive data through centralized credential management and privileged session control. This platform protects organizations from insider threats, credential theft, and unauthorized privileged access by providing a secure vault for storing and rotating privileged credentials, passwords, SSH keys, API keys, certificates, and other secrets.

CategorySecrets management
DirectionQuery source
Sign-inNone
Query languagesSTIX

Before you start​

warning

The setup page can't take credentials for IBM Security Privilage Vault yet. Create the connection, then contact Huntbase support to finish signing it in.

Watch out for
  • Before you connect, log in to Secret Server, open the Reports tab and create a custom report. Set Report Name to exactly Secret Server Events Logs, since events are read through the report with that name. Set Report Category to Activity, Chart Type to None, and Report SQL to SELECT a.EventDetails AS [EventDetails],a.EventNote,a.EventTime,a.ItemId,a.UserId,u.UserName as Name, u.EmailAddress as Unique_Identtification,a.EventSubject, s.secretname As [SecretName], a.ipaddress AS [IpAddress] FROM tbEventAudit a WITH (NOLOCK) INNER JOIN tbuser u WITH (NOLOCK) ON u.userid = a.userid INNER JOIN tbsecret s WITH (NOLOCK) ON s.secretid = a.ItemId WHERE a.EventTime >= #StartDate AND a.EventTime <= #EndDate ORDER BY a.EventTime DESC. Save the report. It appears in the General section of the Reports tab.

For the vendor's own instructions, see IBM Security Secret Server REST API documentation.

Connect IBM Security Privilage Vault​

  1. Go to Connections and click New connection, or click New connection on the IBM Security Privilage Vault product page.
  2. On Product, pick IBM Security Privilage Vault and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your IBM Security Privilage Vault lives:

FieldRequiredNotes
Server AddressYesThe hostname of your IBM Security Verify Privilege Vault (Secret Server) instance, without https://.
PortYesSet the port number that is associated with the hostname or IP address. Defaults to 443.
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.

Query it​

Once connected, IBM Security Privilage Vault can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​