Following the integration guide Collect BeyondTrust Endpoint Privilege Management (EPM) logs | Google Security Operations | Google Cloud Documentation
The python script is quite outdated and attempts to use an API endpoint (/v2/AuditEvents) that no longer exists on the BeyondTrust swagger docs. The OAuth scope & endpoint have also changed since the guide was written.
I believe the replacement API is /v2/ActivityAudits, but the response would change the JSON structure slightly, which then could cause parsing issues.
Has anyone had any luck with onboarding this source to SecOps? Fairly new to SecOps, but is there a way to submit a ticket and have someone create an updated guide/script/parser?
