Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
HashiCorp Vault - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="hashicorp-vault-jupiterone-integration-benefits">HashiCorp Vault + JupiterOne Integration Benefits</h2> <ul><li>Visualize HashiCorp Vault users and secret engines in the JupiterOne graph.</li> <li>Map HashiCorp Vault users to employees in your JupiterOne account.</li> <li>Monitor changes to HashiCorp Vault users using JupiterOne alerts.</li> </ul><h2 data-id="how-it-works">How it Works</h2> <ul><li><p>JupiterOne periodically fetches users and secret engines from HashiCorp Vault<br> to update the graph.</p></li> <li><p>Write JupiterOne queries to review and monitor updates to the graph, or<br> leverage existing queries.</p></li> <li><p>Configure alerts to take action when JupiterOne graph changes, or leverage<br> existing alerts.</p></li> </ul><h2 data-id="requirements">Requirements</h2> <ul><li><p>This HashiCorp integration uses tokens for authentication. You must have the<br> proper policies to for the engines you want to ingest.</p></li> <li><p>JupiterOne requires userpass credentials. You need permission to create a user<br> in HashiCorp Vault.</p></li> <li><p>You must have permission in JupiterOne to install new integrations.</p></li> </ul><h2 data-id="support">Support</h2> <p>If you need help with this integration, please contact<br><a rel="nofollow" href="https://support.jupiterone.io">JupiterOne Support</a>.</p> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <h2 data-id="provider-account-setup">Provider account setup</h2> <p>This integration can be used for both standalone (on-premise) Hashicorp Vault<br> and Hashicorp Vault Cloud offerings.</p> <h3 data-id="in-hashicorp-vault">In HashiCorp Vault</h3> <ol><li>Provide the token to be used for the integration. If you're using Vault<br> Enterprise, take note of the provided API<br><a rel="nofollow" href="https://www.vaultproject.io/docs/enterprise/namespaces">namespace</a>. The<br> namespace is optional ENV field and is necessary for using Cloud offering.</li> <li>Add the <a rel="nofollow" href="https://www.vaultproject.io/docs/concepts/policies">policies</a><br> appropriate for the secret engines you're using.</li> </ol><h2 data-id="on-policies">On Policies</h2> <h3 data-id="about-token-account">About token/account</h3> <p>The integration will attempt to fetch token details to build the root<br> entity/node. To allow for this to happen, the following role is needed:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">path "auth/token/lookup-self" { capabilities = ["read"] } </pre> <h3 data-id="about-secret-engines">About secret engines</h3> <p>In order for integration to be able to iterate through KV1, KV2 and Cubbyhole<br> engines, the <code class="code codeInline" spellcheck="false" tabindex="0">list</code> capability is necessary for the paths you wish to enable.</p> <p>For example, if you've got KV1 enabled on path <code class="code codeInline" spellcheck="false" tabindex="0">my_kv1_path</code>, the following<br> policy rule should be defined for the token you'll use:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">path "my_kv1_path/*" { capabilities = ["list"] } </pre> <h3 data-id="about-users">About users</h3> <p>The integration can fetch all the users that exist in <code class="code codeInline" spellcheck="false" tabindex="0">userpass</code> authentication<br> method. If you'd like this, you need to make sure that <code class="code codeInline" spellcheck="false" tabindex="0">userpass</code> method of your<br> choosing (if you've got multiple) is defined in the policy assigned to the<br> token.</p> <p>For example, if you've got <code class="code codeInline" spellcheck="false" tabindex="0">userpass</code> defined on path <code class="code codeInline" spellcheck="false" tabindex="0">my-userpass-1/</code> and<br> another <code class="code codeInline" spellcheck="false" tabindex="0">userpass</code> method defined on path <code class="code codeInline" spellcheck="false" tabindex="0">my-userpass-2/</code> and you'd like<br> integration to fetch all of their users, the following 2 rules would be<br> necessary:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0"># allows integration to detect this auth method path "my-userpass-1/*" { capabilities = ["list"] } # allows integration to detect this auth method path "my-userpass-2/*" { capabilities = ["list"] } # allows integration to access and read its users path "auth/my-userpass-1/*" { capabilities = ["read", "list"] } # allows integration to access and read its users path "auth/my-userpass-2/*" { capabilities = ["read", "list"] } </pre> <h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>HashiCorp Vault</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this HashiCorp<br> Vault account in JupiterOne. Ingested entities will have this value stored in<br><code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the relevant environment variables for use by JupiterOne.</p></li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol><h1 data-id="how-to-uninstall">How to Uninstall</h1> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>HashiCorp Vault</strong> integration tile and click it.</li> <li>Identify and click the <strong>integration to delete</strong>.</li> <li>Click the <strong>trash can</strong> icon.</li> <li>Click the <strong>Remove</strong> button to delete the integration.</li> </ol><p><br></p> <h2 data-id="data-model">Data Model</h2> <h3 data-id="entities">Entities</h3> <p>The following entities are created:</p> <table><thead><tr><th>Resources</th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Entity <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> </tr></thead><tbody><tr><td>Account</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_account</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Account</code></td> </tr><tr><td>Authentication Backend</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_auth_backend</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td>Secret</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_secret</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Secret</code></td> </tr><tr><td>Secret Engine</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_engine</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">Service</code></td> </tr><tr><td>User</td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_user</code></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">User</code></td> </tr></tbody></table><h3 data-id="relationships">Relationships</h3> <p>The following relationships are created:</p> <table><thead><tr><th>Source Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> <th>Relationship <code class="code codeInline" spellcheck="false" tabindex="0">_class</code></th> <th>Target Entity <code class="code codeInline" spellcheck="false" tabindex="0">_type</code></th> </tr></thead><tbody><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_auth_backend</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_engine</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_account</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_auth_backend</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_user</code></td> </tr><tr><td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_engine</code></td> <td><strong>HAS</strong></td> <td><code class="code codeInline" spellcheck="false" tabindex="0">hashicorp_vault_secret</code></td> </tr></tbody></table><p><br></p> </article> </main>
.png)