Planned design
Two routes from Privileges to your SIEM.
The project is in development. These describe the intended integration routes.
- A relay you host
- A service to receive SAP Privileges webhook events and forward them to your chosen SIEM destination.
- A hook on each Mac
- A Mac-side integration for teams that want to forward Privileges events without hosting a separate relay.
How the projects fit together
Event forwarding and admin oversight.
- altiward-forwarder
- The planned event-forwarding option for teams that want SAP Privileges grant and revocation records in their SIEM.
- Altiward oversight
- The Altiward agent checks actual admin membership, adds configurable expiry enforcement and console revocation, and records session evidence. SAP Privileges grants access. See how Altiward works.
- altiward-siem
- The planned companion repository for detection rules, hunting queries and saved searches. The intended shared OCSF event format lets SIEM content work with the relevant events from either project. Follow SIEM content on GitHub.
Follow altiward-forwarder on GitHub.
Find the project's development work and future releases in the repository.