BeyondInsight Deep-Dive: U-Series Appliances, Discovery & — the Smart Rules Engine

① What BeyondInsight actually is — the platform under Password Safe

Sneha joined ICICI Bank's PAM team on a Monday. Her first ticket: onboard 1,400 Linux servers into Password Safe by month-end. She opened a spreadsheet. Her senior closed it. Nobody hand-onboards 1,400 servers — BeyondInsight discovers them, sorts them and onboards them while you sleep. This lesson is about that machine.

Think of a housing society: Password Safe is the locker room, but the society management office keeps the member registry, hires the staff, runs the visitor register and decides who may enter which wing. BeyondInsight is that office. In one web console its left menu gives you Assets (everything you own), Discovery (how you found it), Smart Rules (auto-sorting), Managed Systems and Managed Accounts (what Password Safe controls), Password Safe and Secrets Safe (the vault modules), Analytics & Reporting, and Configuration. Interviewers love the one-liner: BeyondInsight is the platform; Password Safe is a module running on it — one console, two layers.

Deployment is a day-one interview question, so learn all three shapes. (1) U-Series appliance — a hardened physical or virtual box that ships with BeyondInsight/Password Safe pre-installed. For high availability you pair two: internal database replication copies data, and a heartbeat from the primary tells the secondary when to take over. (2) Software install — your own Windows Server plus SQL Server 2016 SP2 or higher; version 25.2 (the current line) supports Windows Server 2025 and direct upgrades from 23.2+. (3) Password Safe Cloud — BeyondTrust hosts the console at yoursite.ps.beyondtrustcloud.com, and you install Resource Brokers inside your network to do the local work.

The broker model is the part students get wrong. Each broker installs nine services (including the Discovery Scanner, Password Services and Session Monitoring) and groups into resource zones. Everything is outbound TCP 443 to your cloud site — your firewall team opens zero inbound ports. Sizing reality: 4 cores, 16 GB RAM minimum (32 recommended) and a 64 GB disk for session caching — undersize that disk and session recording dies first. Limits: the built-in Default zone cannot be edited, you can add up to 50 more zones, 200 brokers total, and BeyondTrust recommends 2+ brokers per zone so one reboot does not stop rotations.

Going deeper for multi-team estates: workgroups bind worker nodes to specific managed systems and accounts, so a node only processes its own group's work. In multi-tenant setups each organization needs at least one worker node, and a worker node belongs to exactly one organization — a favourite trick question in BeyondTrust University discussions.

The three deployment shapes (plus the worker that makes cloud possible)

Tap each card — front is the name, back is the one fact interviews check.

curl -s -c cookies.txt -X POST \
  "https://bi.icici-lab.local/BeyondTrust/api/public/v3/Auth/SignAppIn" \
  -H "Authorization: PS-Auth key=c479a66f93a3...d2c9484d; runas=icici-lab\sneha.k; pwd=[S0meP@ss];"

curl -s -b cookies.txt \
  "https://bi.icici-lab.local/BeyondTrust/api/public/v3/Configuration/Version"

HTTP/1.1 200 OK          <- SignAppIn: session established, state kept between calls
HTTP/1.1 200 OK          <- Configuration/Version
{"Version":"25.2.0"}

② Discovery — you cannot protect what you cannot see

Every PAM rollout fails the same way: the vault is perfect, but half the estate never entered it. That is why the docs force a setup order — and why discovery comes before any onboarding. The Discovery Scanner is the engine for every scan; in Password Safe Cloud it ships as one of the nine services inside each Resource Broker. Picture a census enumerator going door-to-door: list every house (asset) and every resident (account) before the government issues ration cards (onboarding).

You aim a scan with an Address Group (say 10.20.0.0/22 for the Bengaluru DC), attach a schedule (nightly, weekly), and choose how deep to look. An uncredentialed scan only knocks: which hosts answer, which ports are open. A credentialed (detailed) scan walks in with authority: on Windows it mounts the IPC$ share, pushes a temporary discovery agent service, and makes WMI and remote-registry calls. What comes back is the gold: assets, local accounts, services, software, scheduled tasks and open ports — the raw material Smart Rules will turn into managed accounts.

Scan credentials deserve respect: they typically need local admin on Windows targets (that is what IPC$ + WMI + remote registry require) and they are stored AES-256 encrypted in BeyondInsight, set under Configuration → Discovery Management → Credentials. Treat them like the census officer's authority letter — with the wrong letter, doors stay shut, and worse: repeated wrong knocks lock accounts and light up the SOC. One more field-tested tip: since version 24.3 the Software collection checkbox ships unchecked, because software inventory often slowed or failed scans on big estates. Leave it off unless you genuinely need it.

# Before blaming the Discovery Scanner, test its two prerequisites yourself:
net use \\10.20.30.41\IPC$ /user:ICICI-LAB\svc-discovery *

Get-CimInstance -ClassName Win32_OperatingSystem -ComputerName 10.20.30.41 `
  -Credential (Get-Credential ICICI-LAB\svc-discovery) | Select Caption,Version

The command completed successfully.

Caption                                   Version
-------                                   -------
Microsoft Windows Server 2022 Standard    10.0.20348

③ Smart Groups & Smart Rules — the automation engine

Mumbai's dabbawalas route two lakh tiffins a day with painted codes: read the label, put the box in the right wagon, repeat at every station. A Smart Rule is that sorting code for your estate: IF the discovered thing matches my criteria, THEN group it, onboard it, configure it — and re-check forever. The output is a Smart Group, the unit you will later attach permissions and roles to. With a Password Safe license there are exactly four rule types: Asset, Managed Account, Managed System and Policy User.

Anatomy first, because every interview asks it. Selection Criteria (IF): for managed-account rules these include Directory Query, Microsoft Entra ID Query, Directory Attribute Match and Dedicated Account; asset rules match OS, name, IP range and more. Processing (WHEN): a rule runs when it is created or saved, on timer expiry, when asset changes are detected, or when you press Process on the grid — throttled by the Reprocessing Limit field in Details. Actions (THEN): the exact strings matter — Show managed account as Smart Group, Manage Account Settings, Link domain accounts to Managed Systems, Map Dedicated Accounts to a user group. That middle action is the auto-onboarder: it is how 1,400 servers' service accounts get rotation policies without a single manual edit.

Three platform behaviours to memorise before you build anything: (1) the rule wins — "the settings in a Smart Rule override the settings configured on the managed system", so an account onboarded by a rule must be edited in the rule; (2) built-ins are locked — built-in Smart Rules show a lock icon and cannot be deleted, and any rule referenced by another rule cannot be deleted or deactivated; (3) Quick Groups are frozen — handy for ad-hoc grouping, but their filters and actions cannot be modified later.

curl -s -b cookies.txt \
  "https://bi.icici-lab.local/BeyondTrust/api/public/v3/ManagedAccounts?systemName=BLR-APP-07"

[{"PlatformID":4,"SystemId":112,"SystemName":"BLR-APP-07",
  "AccountName":"svc-backup","DomainName":null,
  "DefaultReleaseDuration":120,"MaximumReleaseDuration":525600,
  "ChangeTime":"23:30","AutoManagementFlag":true}]

④ Users, groups & roles — least privilege for the PAM team itself

Here is the uncomfortable truth your CISO already knows: the PAM console is the juiciest target in the building, because whoever controls it controls every password in it. So the same least-privilege discipline you enforce on others applies to your own team first. BeyondInsight grants nothing to individual users — permissions flow through groups, created under Configuration → Role Based Access → User Management. A group can be a BeyondInsight local group, or synced from Active Directory, LDAP or Microsoft Entra ID — so your existing IAM joiner/leaver process keeps working: HR removes Karthik from the AD group, and his vault access dies with it.

Rights come in two layers, and mixing them up fails interviews. Layer 1 — feature permissions: what a group may do in the console itself (full control, read-only or no access to areas like Smart Rules, Assets, Analytics & Reporting). Layer 2 — Password Safe roles, granted per Smart Group: Requestor (may ask for credentials/sessions), Approver (may grant), Requestor/Approver (both), and ISA (instant retrieval, no approval step at all). Think of a hotel's master-key register: housekeeping may request floor keys (Requestor), the duty manager signs the register (Approver), and the general manager's skeleton key (ISA) opens everything with no signature — which is exactly why you issue it to almost nobody.

Now close the loop with evidence. Analytics & Reporting (left menu) is where the platform pays rent: start with three views — coverage (discovered accounts vs managed accounts — the gap is your risk backlog), rotation health (failed password changes trending up means a functional-account or rights problem), and activity (who requested, who approved, who used ISA). Schedule the coverage and activity reports to email your team weekly; when the auditor arrives, the answer to "prove it" is a subscription, not a scramble. Everything you learned today — discovery feeding Smart Rules feeding role-scoped Smart Groups — becomes measurable on these dashboards.