Check out this script I wrote to auto-tag accounts by platform after discovery.

While conducting a post-discovery analysis of our CyberArk environment, I identified a recurring issue: discovered accounts often lack the necessary `Platform` property for automated onboarding. This creates a manual, error-prone classification bottleneck. The cardinality of unique account types is high, and manual tagging doesn't scale.

To solve this, I wrote a PowerShell script that leverages the CyberArk PAS REST API to analyze account properties post-discovery. It uses a ruleset based on keywords in the `Address`, `Username`, and `Safe` fields to automatically assign the correct `PlatformID`. The script is designed to be run as a scheduled task after regular discovery scans.

Here is the core logic for platform identification. The rules are defined in a hash table for maintainability.

```powershell
$platformRules = @(
@{
PlatformID = "WindowsServer"
Conditions = @(
{ $_.address -match '^[A-Za-z0-9-]+$' -and $_.userName -match '^[A-Za-z\]+administrator$' }
{ $_.address -match '.domain.corp$' -and $_.safe -match 'Windows_Servers' }
)
},
@{
PlatformID = "CiscoIOS"
Conditions = @(
{ $_.address -match '^d{1,3}.d{1,3}.d{1,3}.d{1,3}$' -and $_.userName -eq 'enable' }
{ $_.address -match '^swt-.*$' }
)
},
@{
PlatformID = "OracleSQL"
Conditions = @(
{ $_.userName -match '^SYS.(ASM|DBA)$' -or $_.safe -match 'Oracle_Prod' }
)
}
)

foreach ($account in $discoveredAccounts) {
$assignedPlatform = $null
foreach ($rule in $platformRules) {
foreach ($condition in $rule.Conditions) {
if (& $condition $account) {
$assignedPlatform = $rule.PlatformID
break
}
}
if ($assignedPlatform) { break }
}

if ($assignedPlatform) {
# API call to update the account's PlatformID
Update-CPMAccountPlatform -AccountId $account.id -PlatformId $assignedPlatform
}
}
```

The script logs all classification decisions and failures for auditability, which is crucial for refining the ruleset. This approach has reduced our manual platform assignment workload by approximately 85%. The key is to start with broad, safe rules and iteratively refine them based on the log output, similar to tuning a high-cardinality metric query. Incorrect classification can break CPM rotation, so a phased rollout on non-critical safes is mandatory.