BeyondTrust Privileged Remote Access Integration

TL;DR

Overview

BeyondTrust Privileged Remote Access (PRA) is a privileged access management appliance that brokers secure, audited remote sessions for internal and third-party privileged users to on-premises and cloud systems. In addition to session-level audit logs, the PRA appliance's web tier (httpd and haproxy processes) emits per-HTTP-request access logs documenting all traffic to the appliance's web portal and API, including login/authentication endpoints, administrative API calls, and static asset requests. Each log line is a syslog-framed JSON object shaped like OCSF HTTP Activity, capturing client IP, HTTP method/URL, response code, TLS parameters, and timing. Integrating these logs with Hunters enables detection of anomalous access to the PRA appliance itself — brute-force login attempts, malformed/rejected requests, unusual client IPs or user agents hitting administrative API paths, and TLS downgrade or malformed-handshake activity — which can indicate reconnaissance or attack against the privileged access broker.

Supported data types

BeyondTrust PRA Web Access Logs

Table name: beyondtrust_pra_web_access_logs

This data type contains per-HTTP-request access logs generated by the httpd and haproxy processes on the BeyondTrust PRA appliance's web tier. Each record documents a single request to the PRA web portal or API — including the client IP and port, HTTP method, URL path and query string, response code, user agent, TLS version/cipher, and request duration — with httpd and haproxy each emitting a correlated record (via metadata.correlation_uid) for the same request. These logs cover security-relevant events such as authentication attempts, administrative API calls, malformed or rejected requests (BADREQ), and TLS handshake details.

Expected format

Logs are expected in Syslog format.

<30>Nov  3 10:05:39 LOG-PR-INF-NODE haproxy[38803]: {"src_endpoint":{"ip":"10.20.30.41","port":64833},"metadata":{"correlation_uid":"a1b2c3d4-1111-4a2b-8c3d-000000000001"},"time":1793700339597,"http_request":{"http_method":"GET","url":{"hostname":"portal.example.com","scheme":"https","path":"/api/config/v1/vault/account/609/user","query_string":"current_page=1&per_page=100"},"version":"HTTP/1.1","user_agent":"Mozilla/5.0 (Windows NT; Windows NT 6.2; fr-FR) WindowsPowerShell/5.1.17763.8510","length":306},"http_response":{"code":200,"length":894},"tls":{"version":"TLSv1.2","cipher":"ECDHE-RSA-AES256-GCM-SHA384","sni":"portal.example.com"},"duration":57}

Send data to Hunters

Hunters supports the collection of BeyondTrust logs using S3 Notifications.

To connect BeyondTrust logs:

Connect using S3 Notifications

1. Route BeyondTrust logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in this section.