---
title: "BeyondTrust Privileged Remote Access Integration"
slug: "beyondtrust-privileged-remote-access-integration"
updated: 2026-11-03T11:15:05Z
published: 2026-11-03T11:15:05Z
canonical: "docs.hunters.ai/beyondtrust-privileged-remote-access-integration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# BeyondTrust Privileged Remote Access Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| BeyondTrust PRA Web Access Logs |  | ✅ | ✅ | ✅ | `beyondtrust_pra_web_access_logs` | Syslog | S3 |

## Overview

BeyondTrust Privileged Remote Access (PRA) is a privileged access management appliance that brokers secure, audited remote sessions for internal and third-party privileged users to on-premises and cloud systems. In addition to session-level audit logs, the PRA appliance's web tier (httpd and haproxy processes) emits per-HTTP-request access logs documenting all traffic to the appliance's web portal and API, including login/authentication endpoints, administrative API calls, and static asset requests. Each log line is a syslog-framed JSON object shaped like OCSF HTTP Activity, capturing client IP, HTTP method/URL, response code, TLS parameters, and timing. Integrating these logs with Hunters enables detection of anomalous access to the PRA appliance itself — brute-force login attempts, malformed/rejected requests, unusual client IPs or user agents hitting administrative API paths, and TLS downgrade or malformed-handshake activity — which can indicate reconnaissance or attack against the privileged access broker.

## Supported data types

### BeyondTrust PRA Web Access Logs

**Table name:** `beyondtrust_pra_web_access_logs`

This data type contains per-HTTP-request access logs generated by the httpd and haproxy processes on the BeyondTrust PRA appliance's web tier. Each record documents a single request to the PRA web portal or API — including the client IP and port, HTTP method, URL path and query string, response code, user agent, TLS version/cipher, and request duration — with httpd and haproxy each emitting a correlated record (via `metadata.correlation_uid`) for the same request. These logs cover security-relevant events such as authentication attempts, administrative API calls, malformed or rejected requests (`BADREQ`), and TLS handshake details.

**Expected format**

Logs are expected in Syslog format.

```
<30>Nov  3 10:05:39 LOG-PR-INF-NODE haproxy[38803]: {"src_endpoint":{"ip":"10.20.30.41","port":64833},"metadata":{"correlation_uid":"a1b2c3d4-1111-4a2b-8c3d-000000000001"},"time":1793700339597,"http_request":{"http_method":"GET","url":{"hostname":"portal.example.com","scheme":"https","path":"/api/config/v1/vault/account/609/user","query_string":"current_page=1&per_page=100"},"version":"HTTP/1.1","user_agent":"Mozilla/5.0 (Windows NT; Windows NT 6.2; fr-FR) WindowsPowerShell/5.1.17763.8510","length":306},"http_response":{"code":200,"length":894},"tls":{"version":"TLSv1.2","cipher":"ECDHE-RSA-AES256-GCM-SHA384","sni":"portal.example.com"},"duration":57}
```

## Send data to Hunters

Hunters supports the collection of BeyondTrust logs using S3 Notifications.

**To connect BeyondTrust logs:**

### Connect using S3 Notifications

1. Route BeyondTrust logs into an AWS S3 bucket.
2. Once logs are in S3, follow the steps in [this section](https://docs.hunters.ai/docs/connect-data-through-aws-s3).