Configure Idira Identity Security Platform for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform identity-based response actions in your network using Idira Identity Security Platform (formerly CyberArk Identity Security Platform)®.

Idira Identity Security Platform (formerly CyberArk Identity Security Platform) supports these response actions:
  • Disable/Enable a user
  • Close user sessions
  • Add/Remove a user from a security group or role
  • Add/Remove a user from a restricted role

For more information, see Response action descriptions.

Note:

Configure this integration with your primary identity provider in a cloud-based environment. Arctic Wolf does not support hybrid or on-premises environments for identity-based response actions.

These resources are required:

  • A user account with the System Administrator role
  • Contact your CST to validate the Active Response integration. Have an account or environment ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create an Idira service user

  1. In the Identity Administration portal, navigate to Core Services > Users.
  2. Click Add User.
  3. Configure these settings:
    • Login name — Enter a name for the service account name. For example, arctic-wolf-siem-service-user.
    • Email address — Enter a valid email address, and then save it in a safe, encrypted location.

      You will provide this value to Arctic Wolf later.

    • Display name — Enter descriptive name.
  4. In the Password Type section, click Generated.
  5. Copy the password and then save it in a safe, encrypted location.

    You will provide this value to Arctic Wolf later.

  6. In the Status section, select the Is OAuth confidential client checkbox.
  7. Click Create User.

Configure Idira service user permissions for Active Response

  1. On the left navigation menu, navigate to Core Services > Roles.
  2. Click Add Role.
  3. Configure these settings:
    • Name — Enter a name for the role. For example, Arctic Wolf Active Response.
    • Description — (Optional) Enter a description for the role.
    • Role Type — Make sure that Static is selected.
  4. Click Save.
    The role details page opens.
  5. Click the Members tab.
  6. Click Add.
  7. Search for and select the service account that you created in Create an Idira service user.
  8. Click Add.
  9. Click the Administrative Rights tab.
  10. Click Add.
  11. Search for and select these permissions:
    • User Management
    • Role Management
  12. Click Add.
  13. Click Save.

Configure the Restricted Access Role for role-based response actions

Configure a restricted access role and an authentication policy to support the Add/Remove a user from a conditional access policy response action.

  1. In the Identity Administration portal, navigate to Core Services > Roles.
  2. Click Add Role.
  3. In the Name field enter AWN - Restricted Access Role. Do not add any permissions to the role.
  4. On the navigation menu, navigate to Core Services > Policies.
  5. Click Add Policy Set.
  6. In the Name field enter AWN - Restrict User Policy.
  7. In the Policy Assignment section, select Specified Role, and then add the role that you created in the previous step.
  8. In the Authentication Policies section, open Idira Identity Security Platform.
  9. For Enable authentication policy controls, select Yes.
  10. Select Use authentication rules.
  11. For Default profile, select -Not Allowed-.
    Note:

    This setting prevents users with the restricted role from signing in through a web browser.

Provide Idira Identity Security Platform Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click Idira Identity.
  5. On the New Active Response Integration page, configure these settings:
  6. Click Save Integration.