Parser for Wallix PAM (Bastion)

Download the ready-made parser for Wallix PAM (Bastion).

What is Wallix PAM?

Wallix PAM (Privileged Access Management), formerly known primarily as Bastion, is a cybersecurity solution designed to manage, control, and monitor privileged accounts. It works as a “gateway” or proxy through which every administrator or external contractor must pass before gaining access to sensitive infrastructure, such as servers or databases.

Wallix PAM eliminates the need to share passwords for target systems, records all sessions through video recording or keystroke logging, and enables suspicious commands to be blocked in real time, significantly reducing the risk of misuse of administrative privileges.

Why integrate Wallix PAM with Logmanager?

Connecting Wallix with a central log management system such as Logmanager is beneficial mainly for data correlation and long-term retention. While Wallix monitors in detail what happens inside a privileged session, Logmanager places this information into the broader context of the entire network.

Forwarding logs enables:

• Fast incident detection: Easily correlate Bastion activity with events from firewalls or endpoints.
• Audit compliance: Logmanager ensures secure, immutable, and legally required log storage in one central location.
• Efficient search: Instead of browsing individual records in Bastion, you can run complex queries over Wallix data and create clear dashboards for the security team.
• Compliance with legal requirements: Including regulations such as the Czech Cybersecurity Act (ZKB).

Parser and classifier

We have prepared a parser for Wallix PAM technology for download. If you use this solution, you can import the ready-made parser into your Logmanager.

Parser:

Classifier:

Step-by-step guide for importing the Wallix PAM parser into Logmanager

1. Create a new parser and paste the parser code into the XML window.

2. Click the tag at the beginning of the parser and change its name, for example, to wallix_bastion.

3. Click the tag at the section “Session disconnect” and change its name, for example, to disconnect.

4. Enter the parser name and save it.

5. Create a classifier, for example based on the Wallix IP address:

6. Change the IP address 1.2.3.4 to the address of your Wallix PAM and save the classifier under your chosen name.

7. In the pass to parser block, select the saved parser name.

You are now ready to receive logs from Wallix PAM.Download the ready-made parser for Wallix PAM (Bastion).