An enterprise can have a system infrastructure with a wide range of operating systems, such as UNIX, Linux, and Windows. There can be several privileged accounts in these systems that have remained unused for a long time. The untracked privileged accounts might be a risk to the enterprise. Discovering these privileged accounts and putting them to best use or minimizing them is necessary.
You can discover privileged accounts by using any one of the following approaches:
Privileged Account Sniffer: This is a standalone tool that enables PAM to identify the privileged accounts.
Discover and Onboard (recommended): This feature is available from PAM 4.5 and simplifies the process of detecting and identifying the list of accounts associated to a resource (Target) based on the defined rule. This feature is placed under Credential Vault.
The following table describes the difference between the above approaches:
|
Capability |
Privileged Account Sniffer |
Discover and Onboard |
|---|---|---|
|
Install Type |
Standalone |
Inbuilt module/service |
|
Integrated with PAM Service |
No |
Yes |
|
Persist discovered Accounts data |
No |
Yes |
|
Persistent Discovery configurations |
No |
Yes |
|
Support - Domain Accounts |
Yes |
No |
|
Support - Linux Host |
Yes |
Yes |
|
Support - Windows Host |
Yes |
Yes |
|
Import Targets from CSV |
No |
Yes |
|
Import Targets from Vault |
Yes If the configuration is saved earlier. |
Yes |
|
Export Discovered data to CSV |
Yes |
No |
|
UI Summary for Discovered Accounts |
Yes |
Yes |
|
Securely store Accounts used for discovery |
Yes Encrypted in the xml file. |
Yes |
|
Custom Discovery Rule |
No |
Yes |
|
Historical Audits of Discovery Actions |
No |
Yes |
|
Management of discovered Accounts (Disable / Enable / Change Password / Delete) |
No |
Yes |
|
Detailed error and status messages for each operation |
No Records brief description of error in the CSV file. |
Yes |
|
Resume discovery process if it fails before completion |
No |
Yes |
|
Intermediate states of operations (For example, Initiated, In progress, and Complete) |
No |
Yes |