Integrating Arctic Wolf

Arctic Wolf is a cybersecurity company that provides managed detection and response services. Arctic Wolf Managed Detection and Response (MDR) delivers 24×7 monitoring to help organizations detect, respond to, and recover from cyber attacks. Cloud Detection and Response (CDR) is the set of MDR capabilities that detect attacks against cloud solutions by ingesting events from third-party products such as the Delinea Platform.

This integration connects Arctic Wolf CDR with the Delinea Platform to forward audit events via webhooks to an Arctic Wolf cloud sensor account. By implementing this integration, administrators can bring privileged access activity into the scope of Arctic Wolf 24×7 monitoring, so that secret access, authentication, and other privileged events are correlated with the rest of the organization’s security telemetry instead of being reviewed in isolation.

Prerequisites

The integration of Arctic Wolf with the Delinea Platform requires the following:

  • An Arctic Wolf account with access to the Arctic Wolf Unified Portal and permission to add cloud sensor accounts. From this account you obtain:

    • The webhook URL

    • The client credential (webhook token)

  • Delinea Platform permissions to manage webhooks. Built-in roles such as Platform Admin include the Manage Webhooks permission. For more information, see Roles and Permissions.

Configuration

To enable the integration between Arctic Wolf and the Delinea Platform, complete the following steps:

Step 1: Generate the Arctic Wolf Webhook Token and URL

  1. Sign in to the Arctic Wolf Unified Portal.

  2. In the navigation menu, click Data Collection > Cloud Sensors.

  3. Click Add Account +.

  4. On the Add Account page, click Delinea Platform & Secret Server.

  5. In the Name field, enter a unique and descriptive name for the account.

  6. Click Generate Token.

  7. Copy the client credential and the webhook URL, and then save them in a safe, encrypted location.

If you lose the webhook token, you must generate a new one. For more information, see Generate a new webhook token in the Arctic Wolf documentation.

Step 2: Create a Webhook in the Delinea Platform

  1. In the Delinea Platform, search for or navigate to Settings > General settings > Webhooks. The Webhooks page opens.

  2. Select Create Webhook.

  3. On the Create Webhook page, complete the following fields:

    Field Value / example
    Name Arctic Wolf
    Endpoint URL The webhook URL generated in Step 1
    Description

    Forwards audit events to Arctic Wolf for security monitoring
    Webhook State

    Enabled (keep the checkbox selected)

  4. Leave the Triggers section blank to include all events by default.

For more information about managing webhooks on the Delinea Platform, see Managing Webhooks.

Step 3: Configure Custom Headers

Unlike integrations that embed the token in the endpoint URL, Arctic Wolf requires the client credential to be passed as an authorization header.

  1. In the Custom Headers section, add the following header:

    Field Value / example
    Authorization Bearer <CLIENT_CREDENTIAL> (for example, Bearer 123456ab7cd8e9f)

    The client credential is the webhook token generated in Step 1.

  2. Select Save to create the webhook with your specified configuration.

After you save the webhook, validate the integration to ensure that logs are being delivered correctly.

Validation in the Delinea Platform

  • From the Webhooks page, hover over the webhook that you created, then select Test Webhook. A message confirms a successful test.

  • Select View Webhook Logs and review the log table to monitor the delivery status, for example Success or Failure.

  • Review specific payloads and error messages to troubleshoot any failures.

Validation in Arctic Wolf

  • Confirm that the Delinea Platform & Secret Server account appears under Data Collection > Cloud Sensors in the Arctic Wolf Unified Portal.

  • For questions about log ingestion status or security monitoring coverage on the Arctic Wolf side, contact your Arctic Wolf team.

Verification

Follow these steps to confirm that the Delinea Platform logs are reaching Arctic Wolf:

  1. Trigger an event in the Delinea Platform, for example by viewing a secret.

  2. Confirm that the event is delivered successfully on the Webhooks > Logs tab.