Beyond Trust - AirMDR

Purpose

The BeyondTrust integration enables AirMDR to connect with BeyondTrust APIs and retrieve relevant access, session, audit, and security event information. This helps SOC teams investigate privileged access activity, correlate incidents, and automate response actions from AirMDR playbooks.

Supported Versions

Component	Supported Version
BeyondTrust Remote Support	Supported
BeyondTrust Privileged Remote Access (PRA)	Supported
BeyondTrust BeyondInsight	Supported
BeyondTrust Password Safe	Supported
Deployment Models	Cloud & On-Premises
Authentication Method	OAuth 2.0
AirMDR Integration Type	API-Based

Menu names may vary slightly depending on your BeyondTrust deployment version.

Authentication

AirMDR uses OAuth 2.0 authentication to securely connect to BeyondTrust APIs.

Credential	Description
Base URL	BeyondTrust tenant URL or appliance URL	`https://company.beyondtrustcloud.com`
OAuth Client ID	Unique client identifier generated for the API account	`e52a9aa6*****3a40601a736b230a1bebcd1`
OAuth Client Secret	API Client Secret generated for the API account	`***************`

Role-Based Access Considerations

Create a dedicated API account specifically for AirMDR.
Follow the Principle of Least Privilege.
Avoid using personal administrator accounts.
Periodically rotate OAuth credentials.
Store secrets securely.

BeyondTrust Integration Setup Steps

Open a supported browser.
Go to the BeyondTrust admin URL: https://<your-beyondtrust-domain>/login
Sign in with an administrator account.
Admin privileges are required to create or edit API accounts.

Identify the Base URL

In the browser address bar, copy the BeyondTrust domain.
Remove /login from the URL.
Use the remaining value as the Base URL.
Example:
Login URL: https://company.beyondtrustcloud.com/login
Base URL: https://company.beyondtrustcloud.com
Use this Base URL while configuring the BeyondTrust integration in AirMDR.

Open API Configuration

From the left navigation menu, select Management.
Open the API Configuration tab.
Confirm that API access is enabled.
For Remote Support or Privileged Remote Access deployments, ensure the required API options are enabled based on the AirMDR use case.

If API access is disabled, AirMDR cannot authenticate or retrieve data from BeyondTrust.

Create a New API Account

In API Configuration, click Add or Create New API Account.
Enter a clear account name. For Example: AirMDR Integration API Account.
Enable the API account.
Select the required API permissions.
Avoid selecting full access unless it is explicitly required and approved.
Click Save.

Copy the OAuth Client ID

Open the newly created API account.
Locate the OAuth Client ID field.
Copy the value.
Store it securely for AirMDR configuration.
Example:
OAuth Client ID:
<generated-client-id>

Generate the OAuth Client Secret

In the same API account screen, click Generate New Client Secret.
Copy the generated secret immediately.
Store the secret in an approved password vault or secret manager.
Click Save.

The OAuth Client Secret may be visible only once. If it is lost, generate a new client secret and update the AirMDR integration.

Integration Credential Requirements

Use the following values in the AirMDR integration configuration screen:

AirMDR Field	BeyondTrust Value	Description
Base URL	BeyondTrust Instance URL	The root URL of your BeyondTrust tenant or appliance. Example: `https://company.beyondtrustcloud.com`
OAuth Client ID	OAuth Client ID	The unique identifier generated for the BeyondTrust API account.
OAuth Client Secret	OAuth Client Secret	The secret generated for the BeyondTrust API account and used for OAuth authentication.

Where to Obtain These Credentials

Credential	Location in BeyondTrust
Base URL	Browser address bar after logging in to BeyondTrust (remove `/login` if present).
OAuth Client ID	Management → API Configuration → API Account → OAuth Client ID
OAuth Client Secret	Management → API Configuration → API Account → Generate New Client Secret

The OAuth Client Secret may only be displayed once when generated. Store it securely in a password vault or secret management solution before proceeding with the AirMDR configuration.

Validate Connectivity

Use the following command to verify connectivity and token authentication:

Sample cURL Request

curl -X POST "https://company.beyondtrustcloud.com/oauth2/token" \
-H "Authorization: Basic <Base64_ClientID_ClientSecret>" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials"

Sample Response

“access_token”: “eyJhbGciOiJIUzI1NiIs…”,“token_type”: “Bearer”,“expires_in”: 3600

Configure BeyondTrust in AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
Use the search option, enter the keyword “Beyond Trust”, select the Connections tab, and click + Create button.
Enter an unique name to the Instance (e.g., your org name-BeyondTrust) to easily identify the user connection by AirMDR.
Enter the application credentials like Instance URL and Token in the Authentication Details field params, and click Save.

Skills provided by this Integration

Skill ID	Purpose
List BeyondTrust Jump Items	List Beyond Trust jump item events, optionally filtered by time window, jump group, jump item, or actor.
Get BeyondTrust Endpoint License Usage	Fetch the endpoint license usage report (ZIP metadata) from Beyond Trust.
List BeyondTrust Syslog	List the BeyondTrust syslog ZIP (last 30 days of /login admin changes).
Get BeyondTrust Access Session Recording	Fetch the recording metadata for a BeyondTrust access session identified by Isid.
Get BeyondTrust Access Session Summary	Summary report of BeyondTrust access sessions over a time window using the AccessSessionSummary report.
List Beyond Trust Vault Account Activity	List BeyondTrust vault account activity over a time window using the VaultAccountActivity report.
List BeyondTrust Access Sessions	List BeyondTrust access sessions within a time window using the AccessSessionListing report.
Get BeyondTrust Command Shell Recording	Fetch a command shell recording for a specific command shell instance within a BeyondTrust access session.
Get BeyondTrust Access Session	Fetch Beyond Trust access session(s) by Isid, or all sessions within a time window.
List BeyondTrust Teams	List BeyondTrust team activity, optionally filtered by time window or a specific team id.

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → BeyondTrust Integration page.
Select the Skills tab and click on the required listed skills.

Additional Information

Architecture Overview Diagram

🧰 Error Handling

Issue	Possible Cause	Resolution
Invalid Base URL	Incorrect URL format	Remove `/login` and use root URL
Invalid Client ID	Incorrect value copied	Verify API account configuration
Invalid Client Secret	Secret regenerated or expired	Generate a new secret
Authentication Failure	OAuth misconfiguration	Validate credentials
Permission Denied	Missing API permissions	Review API account roles
Connection Timeout	Firewall or network issue	Verify HTTPS access

🔄 Monitoring & Logs

AirMDR Logs

Review: Integrations → BeyondTrust → Logs

BeyondTrust Logs

Review: Management → Audit Logs or Reports → API Activityor

Sample Successful Log

INFO: BeyondTrust authentication successful.

Sample Authentication Failure

ERROR: OAuth authentication failed.

Sample Permission Failure

WARN: API account lacks required permissions.

Recommended Log Levels

Level	Purpose
INFO	Normal operations
WARN	Permission or configuration issues
ERROR	Authentication and connectivity failures

🛑 Security & Access Best Practices

Use a dedicated API account for AirMDR.
Apply least-privilege permissions.
Rotate OAuth credentials regularly.
Store credentials in an approved secret manager.
Restrict access to integration administrators.
Monitor API usage and audit logs.
Immediately revoke compromised credentials.
Review permissions quarterly.

Security Recommendation: Never share OAuth Client Secrets through email, chat applications, or unsecured documentation. Use an approved enterprise secret management solution.

👉 Support & Maintenance

📧 Contact AirMDR Support through your designated support channel for:
- API account issues
- Tenant configuration problems
- Authentication errors
🔁 Rotate credentials regularly.
- Rotate OAuth Client Secrets.
- Review API account permissions.
- Disable unused API accounts.
- Revalidate connectivity after BeyondTrust upgrades.
- Monitor integration logs for failures.
🔄 Reconnect in AirMDR when secrets are changed.

🛑 Data Flow & Security

Data Exchanged

Depending on permissions granted, AirMDR may retrieve:

Privileged session information
User access activity
Audit logs
Endpoint metadata
Security investigation context

Encryption

Category	Method
Data in Transit	TLS 1.2+ / HTTPS
Authentication	OAuth 2.0
Credential Storage	Secure encrypted storage

Ports and Endpoints

Item	Value
Protocol	HTTPS
Port	443
OAuth Endpoint	`/oauth2/token`
API Endpoint	Product-specific REST APIs

​Purpose

​Supported Versions

​Authentication

​Role-Based Access Considerations

​BeyondTrust Integration Setup Steps

​Integration Credential Requirements

​Where to Obtain These Credentials

​Validate Connectivity

​Configure BeyondTrust in AirMDR Integrations Dashboard

​Skills provided by this Integration

​Additional Information

​Architecture Overview Diagram

​AirMDR Logs

​BeyondTrust Logs

​Sample Successful Log

​Sample Authentication Failure

​Sample Permission Failure

​Recommended Log Levels

​Data Exchanged

​Encryption

​Ports and Endpoints

Purpose

Supported Versions

Authentication

Role-Based Access Considerations

BeyondTrust Integration Setup Steps

Integration Credential Requirements

Where to Obtain These Credentials

Validate Connectivity

Configure BeyondTrust in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

Architecture Overview Diagram

AirMDR Logs

BeyondTrust Logs

Sample Successful Log

Sample Authentication Failure

Sample Permission Failure

Recommended Log Levels

Data Exchanged

Encryption

Ports and Endpoints