Overview

The CyberArk EPM connector enables your Leena AI Agents to integrate with your organization's CyberArk Endpoint Privilege Manager (EPM) platform, facilitating automated endpoint security workflows such as policy management, endpoint administration, application group maintenance, and security event investigation.

CyberArk Endpoint Privilege Manager (EPM) is an endpoint security solution that provides application control, privilege management, and threat detection on endpoints. The CyberArk EPM connector allows Leena AI to list and inspect EPM sets, manage endpoints (search, inventory, secure tokens, agent upgrades and uninstalls), create and maintain policies and application groups, and retrieve aggregated, raw, and policy-audit security events.

API Details

Leena AI integrates with CyberArk EPM via REST APIs (EPM web services).

Documentation link: https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm

Setup

The CyberArk EPM connector uses the EPM Login (Username + Password) authentication type — Leena AI logs on to EPM with a dedicated EPM user's credentials and an application identifier, and uses the returned session token to authorize API calls.

Prerequisites

Before setting up the CyberArk EPM connector, ensure you have:

• Administrator access to your CyberArk EPM tenant
• Your regional EPM Dispatcher URL — the host you use to sign in to the EPM console (e.g. https://in.epm.cyberark.com)
• A dedicated EPM user account for the integration, permitted to use the EPM web services (EPM logon API), with access to the sets you want to manage
• Access to your Leena AI workspace with connector management permissions

Get credentials

CyberArk EPM authenticates API calls with a dedicated EPM user rather than a registered OAuth application. Here is how to prepare the credentials:

1. Identify your regional Dispatcher URL — the base URL of your EPM tenant (e.g. https://in.epm.cyberark.com)
2. Create (or identify) a dedicated EPM user account for Leena AI:
   1. Log in to the EPM console as an account administrator
   2. Go to the Account Management page and select Create > Create User
   3. Enter the user's email address (used as the username) and a password
   4. Grant the user set administrator access on the sets you want Leena AI to manage, with a role that covers the required operations (predefined Full Control or View Only, or a custom role)
3. Note the Username and Password of this account
4. Choose an Application ID to identify Leena AI to EPM (default: LeenaAI) — this is the application name that EPM records as the origin of the REST API calls

Add connection

Here is how to add a connection on Leena AI:

1. Log in to your Leena AI workspace
2. Navigate to Settings > Integrations
3. Search for "CyberArk EPM" and select it from the list to add its new connector
4. Select the Auth Type: EPM Login (Username + Password)
5. Configure the connector fields
   1. Dispatcher URL: Your regional EPM base URL (must start with http:// or https://), e.g. https://in.epm.cyberark.com
   2. Username: The dedicated EPM user account for the integration
   3. Password: Password for the EPM user account
   4. Application ID: Application identifier sent with the EPM logon (default: LeenaAI)
6. Click Test Connection — Leena AI performs a fresh EPM logon to validate the Dispatcher URL and credentials, and reports precisely whether the URL is unreachable, the credentials were rejected, or the endpoint did not behave like the EPM logon API
7. Save the connector

Actions

The following actions are supported for the CyberArk EPM connector:

Get Sets List

Retrieves the list of all EPM sets. Sets are the top-level containers for policies and endpoints in EPM — most other actions require a Set ID. The Agent can leverage the skill (workflow), which has been designed to list the EPM sets, once the user raises a query to do so. Here are some common use cases:

• Set discovery: Look up the Set ID required by the other CyberArk EPM actions
• Account overview: List all sets with their names and descriptions
• Chained workflows: Let the user pick a set and feed its ID into downstream endpoint or policy actions

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

None.

Optional

Here is a sample JSON input:

{
  "offset": 0,
  "limit": 50
}

Response

The action returns a paginated list of all EPM sets, including:

• Set ID, name, and description of each set
• Total set count

Get Set Permissions

Retrieves the permissions of a specific set. The Agent can leverage the skill (workflow), which has been designed to fetch a set's permissions, once the user raises a query to do so. Here are some common use cases:

• Access review: Check which roles are associated with a set
• Troubleshooting: Verify the integration user's access before running set-level operations

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
}

Response

The action returns:

• The set's metadata (ID, name, description)
• The roles associated with the set

Get Server Information

Retrieves the EPM server's version information. The Agent can leverage the skill (workflow), which has been designed to fetch the EPM server details, once the user raises a query to do so. Here are some common use cases:

• Connectivity check: Confirm the connector can reach the EPM server
• Version awareness: Check the server version and build date before version-dependent operations

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

None.

Optional

None.

Here is a sample JSON input:

{}

Response

The action returns:

• The EPM server's version
• The server's build date

Get All Computers in Set

Lists all computers (endpoints) in a set. The Agent can leverage the skill (workflow), which has been designed to list the computers of a set, once the user raises a query to do so. Here are some common use cases:

• Fleet inventory: List the endpoints managed under a set
• Agent audit: Review agent versions and last-seen timestamps across computers
• Bulk workflows: Iterate the returned computers for per-endpoint processing

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "offset": 0,
  "limit": 50
}

Response

The action returns a paginated list of computers in the specified set, each including:

• Agent ID and computer name
• Platform and agent version
• Last-seen timestamp

Search Endpoints

Searches endpoints in a set using a filter expression. The Agent can leverage the skill (workflow), which has been designed to search endpoints in a set, once the user raises a query to do so. Here are some common use cases:

• Targeted lookup: Find a specific endpoint by its name
• Segmented views: Filter endpoints by platform or connection status
• Pre-operation checks: Confirm which endpoints match a filter before running bulk delete, upgrade, or uninstall actions

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "filter": "name EQ \"PSL-5CD4178B8D\" AND platform EQ \"Windows\"",
  "offset": 0,
  "limit": 50
}

Response

The action returns:

• The filtered count and returned count
• The list of matching endpoints with ID, set ID, name, platform, agent version, connection status, and logged-in user

Get Endpoint Details

Retrieves the details of a specific endpoint, including hardware and software inventory. The Agent can leverage the skill (workflow), which has been designed to fetch an endpoint's inventory details, once the user raises a query to do so. Here are some common use cases:

• Machine profile: Fetch OS, hardware, and network details of an endpoint
• Software audit: Review the programs installed on a computer
• Support workflows: Pull endpoint inventory while investigating a user's issue

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "endpointId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "filter": "inventoryType IN \"OsInfo, Hardware, Network\""
}

Response

The action returns detailed inventory information for the specified endpoint, filtered by the optional inventory-type criteria.

Generate Secure Token for Endpoint

Generates a self-defense token for an endpoint, enabling endpoint self-defense capabilities for the specified duration. The Agent can leverage the skill (workflow), which has been designed to generate a secure token for an endpoint, once the user provides the endpoint and duration. Here are some common use cases:

• Maintenance windows: Issue a token so a technician can perform protected operations on the endpoint
• Controlled overrides: Time-box the token validity to the approved window

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "endpointId": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "duration": 60
}

Response

The action returns:

• The generated token
• The token's expiry timestamp

Delete Endpoint

Deletes the endpoints matching a filter from a set (bulk operation). Either a filter or the Include All flag must be provided. The Agent can leverage the skill (workflow), which has been designed to delete endpoints from a set, once the user specifies the endpoints to be removed. Here are some common use cases:

• Decommissioning: Remove retired machines from EPM
• Cleanup: Delete stale endpoints matched by name or platform filters

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "filter": "name EQ \"PSL-5CD4178B8D\" AND platform EQ \"Windows\"",
  "returnIds": true,
  "includeAll": false
}

Response

The action returns:

• The count of deleted endpoints
• The IDs of the deleted endpoints (when Return IDs is enabled)

Upgrade Endpoint Agent

Upgrades the EPM agent on the endpoints matching a filter (bulk operation). Either a filter or the Include All flag must be provided. The Agent can leverage the skill (workflow), which has been designed to upgrade the agent on matching endpoints, once the user provides the target versions. Here are some common use cases:

• Fleet upgrades: Roll out a new agent version to all endpoints of a platform in a set
• Targeted updates: Upgrade specific machines matched by a filter

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "filter": "platform EQ Windows",
  "versions": [
    {
      "platform": "Windows",
      "architecture": "x64",
      "version": "26.5.0.3092"
    }
  ],
  "includeAll": false
}

Response

The action returns:

• The IDs of the endpoints the upgrade was applied to
• The per-endpoint upgrade statuses

Uninstall Endpoint Agent

Uninstalls the EPM agent from the endpoints matching a filter (bulk operation). Either a filter or the Include All flag must be provided. The Agent can leverage the skill (workflow), which has been designed to uninstall the agent from matching endpoints, once the user specifies the endpoints. Here are some common use cases:

• Offboarding: Remove the EPM agent from machines leaving management
• Scoped removal: Uninstall the agent from endpoints matched by a filter

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "filter": "name EQ \"PSL-5CD4178B8D\" AND platform EQ \"Windows\"",
  "returnIds": true,
  "includeAll": false
}

Response

The action returns:

• The count of uninstalled endpoints
• The IDs of the uninstalled endpoints (when Return IDs is enabled)

Get All Policies in Set

Lists all policies in a set. The Agent can leverage the skill (workflow), which has been designed to list the policies of a set, once the user raises a query to do so. Here are some common use cases:

• Policy inventory: List the policies configured in a set
• Quick search: Filter policies by name
• Chained workflows: Pick a policy to activate, deactivate, update, or delete in a follow-up action

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "filter": "PolicyName CONTAINS elevate",
  "offset": 0,
  "limit": 50
}

Response

The action returns a paginated list of policies, each including:

• Policy ID and name
• Policy type and action
• Active status
• Total policy count

Get Policy Details

Retrieves the details of a specific policy. The Agent can leverage the skill (workflow), which has been designed to fetch a policy's configuration, once the user raises a query to do so. Here are some common use cases:

• Configuration review: Inspect a policy's applications and executors
• Pre-change snapshot: Fetch the full policy before updating it

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "policyId": "c3d4e5f6-a7b8-9012-cdef-123456789012"
}

Response

The action returns the full policy details, including:

• Policy ID, name, and type
• Active status and action
• Executors and applications

Activate Policy

Activates an existing policy in a set. The existing policy is fetched first and updated in full, so its applications, executors, and other configuration are preserved. The Agent can leverage the skill (workflow), which has been designed to activate a policy, once the user specifies the policy to turn on. Here are some common use cases:

• Enforcement: Turn on a prepared policy after review and approval
• Incident response: Activate a blocking policy during an investigation

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "policyId": "c3d4e5f6-a7b8-9012-cdef-123456789012"
}

Response

The action returns the activated policy object with its active flag set to true and all original policy fields preserved.

Deactivate Policy

Deactivates an existing policy in a set. The existing policy is fetched first and updated in full, so its applications, executors, and other configuration are preserved. The Agent can leverage the skill (workflow), which has been designed to deactivate a policy, once the user specifies the policy to turn off. Here are some common use cases:

• Rollback: Temporarily switch off a policy causing false positives
• Staged changes: Deactivate a policy while it is being reworked

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "policyId": "c3d4e5f6-a7b8-9012-cdef-123456789012"
}

Response

The action returns the deactivated policy object with its active flag set to false and all original policy fields preserved.

Delete Policy

Deletes a policy from a set. The Agent can leverage the skill (workflow), which has been designed to delete a policy, once the user specifies the policy to be removed. Here are some common use cases:

• Cleanup: Remove obsolete or duplicate policies
• Lifecycle management: Delete temporary policies created for one-off scenarios

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "policyId": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
}

Response

The action deletes the specified policy from the set and returns the operation status.

Create Policy

Creates (provisions) a new policy in a set. The Agent can leverage the skill (workflow), which has been designed to create a policy, once the user provides the policy details. Here are some common use cases:

• Application control: Create block or allow policies for specific applications
• Privilege elevation: Create elevation policies for approved software
• Detection first: Create detect-mode policies to observe behavior before enforcing

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Block Unauthorized Software",
  "policyType": 11,
  "isActive": true,
  "action": 0,
  "isAppliedToAllComputers": false,
  "description": "Prevents execution of unapproved applications",
  "priority": 1,
  "audit": true,
  "applications": [{ "id": "app-uuid-1", "applicationType": 2 }],
  "executors": [{ "Id": "endpoint-uuid-1", "IsIncluded": true, "ExecutorType": 1 }]
}

Response

The action returns the created policy's ID, name, and additional policy properties.

Update Policy

Updates (provisions) an existing policy. This is a true partial update: the existing policy is fetched, only the fields you provide are overlaid, and the full object is written back — so fields you omit keep their existing values. The Agent can leverage the skill (workflow), which has been designed to update a policy, once the user provides the details to be changed. Here are some common use cases:

• Scope changes: Add applications or executors to an existing policy
• Reprioritisation: Adjust a policy's priority or action
• Safe edits: Update selected fields without erasing existing applications, executors, and other collections

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "policyId": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
  "name": "Updated Block Unauthorized Software",
  "isActive": false,
  "applications": [{ "id": "app-uuid-2", "applicationType": 2 }]
}

Response

The action returns the updated policy's ID, name, and full policy object. Omitted fields preserve their existing values, preventing unwanted erasure of existing applications, executors, and other collections.

Get Application Groups

Lists the application groups in a set. The Agent can leverage the skill (workflow), which has been designed to list application groups, once the user raises a query to do so. Here are some common use cases:

• Group inventory: List the application groups configured in a set
• Lookup: Find a group by name before attaching it to a policy

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "limit": 50,
  "offset": 0,
  "filter": "name CONTAINS test"
}

Response

The action returns the application groups in the set along with the total count, paginated.

Get Application Group Details

Retrieves the details of an application group. The Agent can leverage the skill (workflow), which has been designed to fetch an application group's details, once the user raises a query to do so. Here are some common use cases:

• Content review: See which applications a group contains
• Pre-update snapshot: Inspect the group before modifying it

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "groupId": "550e8400-e29b-41d4-a716-446655440111"
}

Response

The action returns the group's details, including:

• Group ID, name, and description
• OS type (1 = Windows, 3 = macOS, 6 = Linux)
• The group's applications and additional group properties

Create Application Group

Creates an application group in a set. The Agent can leverage the skill (workflow), which has been designed to create an application group, once the user provides the group details. Here are some common use cases:

• Allow-listing: Group approved applications for use in allow policies
• Platform grouping: Maintain separate application groups per operating system

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Windows Security Applications",
  "osType": 1,
  "description": "Security applications approved for Windows endpoints",
  "applications": [{ "id": "app-uuid-1", "appName": "defender.exe" }]
}

Response

The action returns the created group's ID, name, and additional group properties.

Update Application Group

Updates an application group in a set. This is a true partial update: the existing group is fetched, only the fields you provide are overlaid, and the full object is written back — so fields you omit keep their existing values. The Agent can leverage the skill (workflow), which has been designed to update an application group, once the user provides the details to be changed. Here are some common use cases:

• Membership updates: Add or replace the applications in a group
• Renaming: Update the group's name or description without touching its applications

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "groupId": "550e8400-e29b-41d4-a716-446655440111",
  "name": "Windows Security Applications Updated",
  "applications": [{ "id": "app-uuid-2", "appName": "securityapp.exe" }]
}

Response

The action returns the updated group's ID, name, and group properties, with untouched properties preserved.

Delete Application Group

Deletes an application group from a set. The Agent can leverage the skill (workflow), which has been designed to delete an application group, once the user specifies the group to be removed. Here are some common use cases:

• Cleanup: Remove application groups that are no longer referenced by policies
• Restructuring: Delete groups being replaced by a new grouping scheme

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "groupId": "550e8400-e29b-41d4-a716-446655440111"
}

Response

The action deletes the specified application group from the set and returns the operation status.

Get Endpoint Groups

Lists the endpoint groups in a set. The Agent can leverage the skill (workflow), which has been designed to list endpoint groups, once the user raises a query to do so. Here are some common use cases:

• Segmentation review: List the endpoint groups defined in a set
• Lookup: Find an endpoint group by name

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "filter": "name CONTAINS prod",
  "offset": 0,
  "limit": 50
}

Response

The action returns the endpoint groups in the set, each including:

• Group ID, name, and description
• Last-updated timestamp and additional properties

Get Endpoint Group Details

Retrieves the details of an endpoint group. The Agent can leverage the skill (workflow), which has been designed to fetch an endpoint group's details, once the user raises a query to do so. Here are some common use cases:

• Membership insight: Check a group's filter expression and member count
• Configuration review: Inspect how a dynamic endpoint group is defined

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

None.

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "groupId": "550e8400-e29b-41d4-a716-446655440222"
}

Response

The action returns the endpoint group's details, including:

• Group ID, name, and type
• Description and filter expression
• Member count and additional properties

Get Aggregated Events

Retrieves aggregated policy events for a set (events summarized by configuration). The Agent can leverage the skill (workflow), which has been designed to fetch aggregated policy events, once the user raises a query to do so. Here are some common use cases:

• Security review: Summarize policy events by application, publisher, or policy
• Trend analysis: Identify which policies generate the most events
• Paged retrieval: Continue long result sets with the returned cursor

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "filter": "policyName CONTAINS Block",
  "arrivalTime": "2026-01-15T10:30:00Z"
}

Response

The action returns:

• An array of aggregated events
• A next-cursor string when additional pages exist (cursor-based pagination, 1000-event page threshold)

Get Detailed Raw Events

Retrieves detailed raw policy events (one event per execution, as opposed to aggregated summaries). The Agent can leverage the skill (workflow), which has been designed to fetch raw policy events, once the user raises a query to do so. Here are some common use cases:

• Incident investigation: Trace the individual executions of a suspicious file
• Forensics: Pull complete per-execution records for an endpoint or policy
• Event drill-down: Move from an aggregated summary to the underlying raw events

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "filter": "fileName CONTAINS notepad",
  "arrivalTime": "2026-01-15T10:30:00Z"
}

Response

The action returns:

• An array of raw events (complete per-execution records)
• A next-cursor string for pagination

Get Policy Audit Raw Event Details

Retrieves raw policy-audit event details — the audit trail of administrative policy changes, as distinct from policy violation events. The Agent can leverage the skill (workflow), which has been designed to fetch policy-audit events, once the user raises a query to do so. Here are some common use cases:

• Change auditing: Review which administrators changed which policies
• Compliance reporting: Retrieve administrative policy-change records for audits

Input Parameters

Here are the input parameters required to set up this action:

Mandatory

Optional

Here is a sample JSON input:

{
  "setId": "550e8400-e29b-41d4-a716-446655440000",
  "filter": "userName CONTAINS admin"
}

Response

The action returns:

• An array of policy-audit records
• A next-cursor string for pagination