Enterprise

AIM Server adds controls for regulated and high-assurance environments: privileged access management and, in self-hosted deployments only, forwarding of audit log entries to Splunk and Microsoft Sentinel. This forwarder is not available in AIM Cloud. A connector for CyberArk is planned.

Privileged access management

Capabilities are grouped into three privilege tiers. Higher tiers require human approval before an agent can act, and approvals are recorded in the audit log.

STANDARD

Routine capabilities. Authorized by policy and trust score without a human gate.

PRIVILEGED

Sensitive capabilities. Require an approval before the action runs.

SUPER_PRIVILEGED

The most sensitive capabilities. Require approval and are held to the strictest policy.

Approval gates: a privileged action pauses until an operator approves it in the dashboard.
Break-glass: an emergency access path for incidents, recorded as an emergency declaration.
Certification campaigns: periodic review of who holds which privileged capabilities.

CyberArk integration (planned)

AIM does not connect to CyberArk today. A connector is planned for self-hosted deployments, so credentials do not have to live in agent code or configuration.

CCP

Planned: Central Credential Provider retrieval, pulling secrets from the vault at use time rather than storing them.

PSM

Not available. Recording AIM sessions through Privileged Session Manager is under evaluation.

SIEM adapters (self-hosted only)

Self-hosted AIM can forward audit log entries to Splunk and Microsoft Sentinel. This forwarder is not available in AIM Cloud. The forwarder also sends failed password sign-ins, Fine-Grained Authorization decisions that do not allow a request, and alerts as they are raised. Decisions that allow a request are not forwarded, and neither is a repeat counted on an alert that is still open.

Splunk (self-hosted only)

Delivery over the HTTP Event Collector (HEC).

Microsoft Sentinel (self-hosted only)

Delivery through the Azure Monitor Logs Ingestion API, with the client credentials of a Microsoft Entra application. The server does not use the older HTTP Data Collector API.

In self-hosted deployments the Splunk and Microsoft Sentinel adapters send events in batches, retry a batch when the collector cannot be reached or answers 408, 429 or a 5xx status, and filter by severity so the volume forwarded matches your SIEM ingestion budget. A batch that is not delivered after up to 3 attempts is logged and not resent. What AIM keeps of the events in that batch depends on their kind:

Audit log entries stay in the AIM audit log.
Alerts stay stored in AIM.
Failed password sign-ins and Fine-Grained Authorization decisions that do not allow a request: AIM stores only some of them, and keeps no record of the others in the batch.