Exabeam

The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics, and SOAR.

Analytics & SIEM · Exabeam Advanced Analytics

Configuration parameters

  • url — Server URL (e.g https://100.24.16.156:8484) (required)
  • credentials — Username
  • api_token — Username
  • incident_type — Exabeam Incident Type
  • priority — Priority
  • status — Status
  • isFetch — Fetch incidents
  • max_fetch — Max incidents per fetch
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • look_back — Advanced: Minutes to look back when fetching
  • incidentType — Incident type
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_type — Fetch Type
  • max_fetch_users — Max Users Per Fetch
  • notable_users_fetch_interval — Notable Users Fetch Interval
  • notable_users_first_fetch — Notable Users First Fetch Timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • minimum_risk_score_to_fetch_users — Minimum Risk Score To Fetch Users

Commands (38)

  • exabeam-add-context-table-records

    Add records to the context table.

  • exabeam-add-context-table-records-from-csv

    Add context table records from CSV file in a specific modification session.

  • exabeam-delete-context-table-records

    Delete records from a context table.

  • exabeam-delete-watchlist

    Deletes a watchlist.

  • exabeam-fetch-rules

    Gets all rules.

  • exabeam-get-asset-data

    Returns asset data.

  • exabeam-get-asset-info

    Returns asset information for given asset ID (hostname or IP address).

  • exabeam-get-context-table-in-csv

    Export a context table to CSV.

  • exabeam-get-notable-assets

    Returns notable assets.

  • exabeam-get-notable-sequence-details

    Returns sequence details for the given asset ID and time range.

  • exabeam-get-notable-session-details

    Returns notable session details.

  • exabeam-get-notable-users

    Returns notable users in a period of time.

  • exabeam-get-peer-groups

    Returns all peer groups.

  • exabeam-get-rule-string

    Gets a rule's information as a string.

  • exabeam-get-rules-model-definition

    Gets a rule model definition by name.

  • exabeam-get-sequence-eventtypes

    Returns sequence event types for the given asset sequence ID and time range.

  • exabeam-get-session-info-by-id

    Returns session info data for the given ID.

  • exabeam-get-user-info

    Returns user information data for the username.

  • exabeam-get-user-labels

    Returns all labels of the user.

  • exabeam-get-user-sessions

    Returns sessions for the given username and time range.

  • exabeam-get-watchlists

    Returns all watchlist IDs and titles.

  • exabeam-list-asset-timeline-next-events

    Gets next events for a given asset.

  • exabeam-list-context-table-records

    Returns a list of a context table records.

  • exabeam-list-incident

    Returns incidents from Exabeam.

  • exabeam-list-security-alerts-by-asset

    Gets security alerts for a given asset.

  • exabeam-list-top-domains

    List top domains of a sequence.

  • exabeam-list-triggered-rules

    Gets all the triggered rules of a sequence.

  • exabeam-search-rules

    Searches for rules by a keyword.

  • exabeam-update-context-table-records

    Updates records of a context table.

  • exabeam-watchlist-add-items

    Add watchlist items by their names or from a CSV file.

  • exabeam-watchlist-asset-search

    Gets the assets of a specified watchlist according to a keyword.

  • exabeam-watchlist-remove-items

    Removes items from a watchlist.

  • get-notable-users Deprecated

    Returns notable users in a period of time.

  • get-peer-groups Deprecated

    Returns all peer groups.

  • get-user-info Deprecated

    Returns user information data for the username.

  • get-user-labels Deprecated

    Returns all labels of the user.

  • get-user-sessions Deprecated

    Returns sessions for the given username and time range.

  • get-watchlists Deprecated

    Returns all watchlist IDs and titles.