Exabeam

The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics, and SOAR.

Analytics & SIEM · Exabeam Advanced Analytics

Details

IDExabeam
ProviderExabeam
CategoryAnalytics & SIEM
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics and SOAR.
This integration was integrated and tested with version 53.5 of Exabeam.

Authentication Methods

There are 2 authentication methods:

  • API Token - API token should be entered in the “API Token” parameter. In order to use the “Fetch Incident” functionality in this integration, the username must be provided also in the “Username” parameter.
  • Basic Authentication - Providing username and password in the corresponding parameters in the configuration. This method also allows fetching incidents.
  • Deprecated:
    API Key entered in the “password” parameter and __token in the username parameter. This method won’t allow fetching incidents.

Generate a Cluster Authentication Token

  1. Navigate to Settings > Admin Operations > Cluster Authentication Token.

  2. At the Cluster Authentication Token menu, click the blue + button.

  3. In the Setup Token menu, fill in the Token Name, Expiry Date, and select the Permission Level(s).

  4. Click ADD TOKEN to apply the configuration.

For additional information, refer to Exabeam Administration Guide.

Configure Exabeam in Cortex

Parameter Description Required
Server URL (e.g https://100.24.16.156:8484)   True
Username   False
Password   False
API Token Cluster Authentication Token False
Exabeam Incident Type Incident type to filter in Exabeam. Possible values are: generic, abnormalAuth, accountManipulation, accountTampering, ueba, bruteForce, compromisedCredentials, cryptomining, dataAccessAbuse, dataExfiltration, dlp, departedEmployee, dataDestruction, evasion, lateralMovement, alertTriage, malware, phishing, privilegeAbuse, physicalSecurity, privilegeEscalation, privilegedActivity, ransomware, workforceProtection. False
Priority Incident priority to filter in Exabeam. Possible values are: low, medium, high, critical. False
Status Incident status to filter in Exabeam. Possible values are: closed, closedFalsePositive, inprogress, new, pending, resolved. False
Fetch incidents   False
Max incidents per fetch   False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
Advanced: Minutes to look back when fetching Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created. Default is 1. False
Incident type   False
Trust any certificate (not secure)   False
Use system proxy settings   False

Fetch

Exabeam Incident

  • Description: Information about incidents collected from the Exabeam system.
  • Details: The incidents include details about events and actions identified in the Exabeam system, intended for monitoring and response.

Exabeam Notable User

  • Description: Information about notable users collected from the Exabeam system.
  • Details: Notable users are identified by the Exabeam system based on suspicious or abnormal behavior, and the information includes details about their actions in the system.
  • Important: Duplicate notable users are never fetched unless the “Reset the ‘last run’ timestamp” button is pressed.

Note

The “Reset the ‘last run’ timestamp” button resets both the regular fetch and the Exabeam Notable User fetch.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

exabeam-get-notable-users

Returns notable users in a period of time.

Base Command

exabeam-get-notable-users

Input

Argument Name Description Required
time_period The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on. Required
limit The maximum number of returned results. Default is 10. Required

Context Output

Path Type Description
Exabeam.User.RiskScore Number The risk score of the notable user.
Exabeam.User.UserFullName String The full name of the user.
Exabeam.User.AverageRiskScore Number The average risk score of the user.
Exabeam.User.FirstSeen Date The date the user was first seen.
Exabeam.User.NotableSessionIds String The ID of the notable session.
Exabeam.User.AccountsNumber Number The number of accounts.
Exabeam.User.LastSeen Date The date the user was last seen.
Exabeam.User.Location String The location of the user.
Exabeam.User.UserName String The name of the user.
Exabeam.User.Labels String The labels of the user.
Exabeam.User.LastActivityType String The last activity type of the user.
Exabeam.User.NotableUser Boolean Whether the user is a notable user.

Command Example

!exabeam-get-notable-users limit=3 time_period="1 year"

Human Readable Output

Exabeam Notable Users

UserName UserFullName Title Department Labels NotableSessionIds EmployeeType FirstSeen LastSeen LastActivity Location
username fullname Network Engineer IT privileged_user session_id employee 2018-08-01T11:50:16 2018-09-09T16:36:13 Account is active Atlanta
username fullname Human Resources Coordinator HR   session_id employee 2018-07-03T14:26:26 2018-09-30T16:27:01 Account is active Chicago
username fullname Sales Representative Sales privileged_user session_id employee 2018-08-10T15:55:25 2018-09-30T16:27:01 Account is active Atlanta

exabeam-get-watchlists

Returns all watchlist IDs and titles.

Base Command

exabeam-get-watchlists

Input

There are no input arguments for this command.

Context Output

Path Type Description
Exabeam.Watchlist.Category String The watchlist category.
Exabeam.Watchlist.Title String The watchlist title.
Exabeam.Watchlist.WatchlistID String The watchlist ID.

Command Example

!exabeam-get-watchlists

Human Readable Output

Exabeam Watchlists

WatchlistID Title Category
5c869ab0315c745d905a26d9 Executive Users UserLabels
5c869ab0315c745d905a26da Service Accounts UserLabels
5dbaba2dd4e62a0009dd7ae4 user watchlist Users
5d8751723b72ea000830066a VP Operations PeerGroups

exabeam-get-peer-groups

Returns all peer groups.

Base Command

exabeam-get-peer-groups

Input

There are no input arguments for this command.

Context Output

Path Type Description
Exabeam.PeerGroup.Name String The name of the peer group.

Command Example

!exabeam-get-peer-groups

Human Readable Output

Exabeam Peer Groups

Name
Marketing
usa
101
Program Manager
Channel Administrator
Chief Marketing Officer
Chief Strategy Officer

exabeam-get-user-info

Returns user information data for the username.

Base Command

exabeam-get-user-info

Input

Argument Name Description Required
username The username of the user to fetch. Required

Context Output

Path Type Description
Exabeam.User.RiskScore Number The risk score of the user.
Exabeam.User.AverageRiskScore Number The average risk score.
Exabeam.User.PeerGroupFieldName String The field name of the peer group.
Exabeam.User.FirstSeen Date The date when the user was first seen.
Exabeam.User.PeerGroupDisplayName String The display name of the Peer group.
Exabeam.User.LastSeen Date The date the user was last seen.
Exabeam.User.PeerGroupFieldValue String The field value of the peer group.
Exabeam.User.Label String The labels of the user.
Exabeam.User.Username String The name of the user.
Exabeam.User.PeerGroupType String The type of the peer group.
Exabeam.User.LastSessionID String The last session ID of the user.
Exabeam.User.LastActivityType String The last activity type of the user.
Exabeam.User.AccountNames String The account name of the user.

Command Example

!exabeam-get-user-info username={username}

Human Readable Output

User {username} information

Username RiskScore AverageRiskScore LastSessionID FirstSeen LastSeen LastActivityType AccountNames PeerGroupFieldName PeerGroupFieldValue PeerGroupDisplayName PeerGroupType
{username} 163 102.53 {session_id} 2018-08-01T11:50:16 2018-09-09T16:36:13 Account is active {account_name} Peer Groups root root Group

exabeam-get-user-labels

Returns all labels of the user.

Base Command

exabeam-get-user-labels

Input

There are no input arguments for this command.

Context Output

Path Type Description
Exabeam.UserLabel.Label String The label of the user.

Command Example

!exabeam-get-user-labels

Human Readable Output

Exabeam User Labels

Label
privileged_user
service_account

exabeam-get-user-sessions

Returns sessions for the given username and time range.

Base Command

exabeam-get-user-sessions

Input

Argument Name Description Required
username The username for which to fetch data. Required
start_time The Start time of the time range. For example, 2018-08-01T11:50:16 or “30 days ago”. Optional
end_time The end time of the time range. For example, 2018-08-01T11:50:16 or “1 week ago”. Optional

Context Output

Path Type Description
Exabeam.User.Session.EndTime Date The end time of the session.
Exabeam.User.Session.InitialRiskScore Number The initial risk score of the session.
Exabeam.User.Session.Label String The label of the session.
Exabeam.User.Session.LoginHost String The login host.
Exabeam.User.Session.RiskScore Number The risk score of the session.
Exabeam.User.Session.SessionID String The ID of the session.
Exabeam.User.Session.StartTime Date The start time of the session.
Exabeam.User.Username String The username of the session.

Command Example

!exabeam-get-user-sessions username={username} start_time=2018-08-01T11:50:16

Human Readable Output

User {username} sessions information

SessionID RiskScore InitialRiskScore StartTime EndTime LoginHost Label
session_id 0 0 2018-08-01T14:05:46 2018-08-01T20:00:17 login_host  
session_id 0 0 2018-08-01T23:17:00 2018-08-02T02:37:51 login_host vpn-in

exabeam-delete-watchlist

Deletes a watchlist.

Base Command

exabeam-delete-watchlist

Input

Argument Name Description Required
watchlist_id The watchlist ID. Required

Context Output

There is no context output for this command.

Command Example

!exabeam-delete-watchlist watchlist_id=5de50f82088c6a000865408d

Human Readable Output

The watchlist 5de50f82088c6a000865408d was deleted successfully.

exabeam-get-asset-data

Returns asset data.

Base Command

exabeam-get-asset-data

Input

Argument Name Description Required
asset_name The name of the asset. Required

Context Output

Path Type Description
Exabeam.Asset.HostName String The host name of the asset.
Exabeam.Asset.IPAddress String The IP address of the asset.
Exabeam.Asset.AssetType String Thr type of the asset.
Exabeam.Asset.FirstSeen Date The date the asset was first seen.
Exabeam.Asset.LastSeen String The date the asset was last seen.

Command Example

!exabeam-get-asset-data asset_name={host_name}

Human Readable Output

Exabeam Asset Data

AssetType FirstSeen HostName IPAddress LastSeen
Windows 2018-07-03T14:21:00 host_name ip_address 2018-09-30T16:23:17

exabeam-get-session-info-by-id

Returns session info data for the given ID.

Base Command

exabeam-get-session-info-by-id

Input

Argument Name Description Required
session_id ID of the session to fetch data for. Required

Context Output

Path Type Description
Exabeam.SessionInfo.sessionId String ID of the session.
Exabeam.SessionInfo.username String Username of the session.
Exabeam.SessionInfo.startTime Date Start time of the session.
Exabeam.SessionInfo.endTime Date End time of the session.
Exabeam.SessionInfo.initialRiskScore Number Initial risk score of the session.
Exabeam.SessionInfo.riskScore Number Risk score of the session.
Exabeam.SessionInfo.numOfReasons Number Number of rules in the session.
Exabeam.SessionInfo.loginHost String The host from which the user was logged in.
Exabeam.SessionInfo.label String Label of the session.
Exabeam.SessionInfo.accounts String Accounts in the session.
Exabeam.SessionInfo.numOfAccounts Number Number of accounts in the session.
Exabeam.SessionInfo.numOfZones Number Number of zones in the session.
Exabeam.SessionInfo.numOfAssets Number Number of assets in the session.
Exabeam.SessionInfo.numOfEvents Number Number of events in the session.
Exabeam.SessionInfo.numOfSecurityEvents Number Number of alerts in the session.
Exabeam.SessionInfo.zones Unknown Zones information of the session.

Command Example

!exabeam-get-session-info-by-id session_id=test-20200630233800

Human Readable Output

Session test-20200630233800 Information

Accounts End Time Initial Risk Score Login Host Num Of Accounts Num Of Assets Num Of Events Num Of Reasons Num Of Security Events Num Of Zones Risk Score Session Id Start Time Username Zones
test 2020-07-01T04:38:00 0 test 1 4 2 6 0 2 21 test-20200630233800 2020-06-30T23:38:00 test los angeles office,
chicago office

exabeam-list-top-domains

List top domains of a sequence.

Base Command

exabeam-list-top-domains

Input

Argument Name Description Required
sequence_id ID of the sequence. Required
sequence_type Type of the sequence. Required

Context Output

Path Type Description
Exabeam.DataFeed.topDomains Unknown Top domains information.
Exabeam.DataFeed.sequenceId String ID of the sequence.
Exabeam.DataFeed.sequenceType String Type of the sequence.

Command Example

!exabeam-list-top-domains sequence_id=test-20200630233800 sequence_type=session

Human Readable Output

Sequence test-20200630233800 Top Domains

No entries.

exabeam-list-triggered-rules

Gets all the triggered rules of a sequence.

Base Command

exabeam-list-triggered-rules

Input

Argument Name Description Required
sequence_id ID of the sequence to fetch data for. Required
sequence_type Type of the sequence to fetch data for. Required

Context Output

Path Type Description
Exabeam.TriggeredRule._Id String UUID of the rule.
Exabeam.TriggeredRule.ruleId String ID of the rule.
Exabeam.TriggeredRule.ruleType String Type of the rule.
Exabeam.TriggeredRule.eventId String Event ID of the rule.
Exabeam.TriggeredRule.sessionId String Session ID of the rule.
Exabeam.TriggeredRule.lockoutId String Lockout ID of the rule.
Exabeam.TriggeredRule.sequenceId String Sequence ID of the rule.
Exabeam.TriggeredRule.username String Username of the rule.
Exabeam.TriggeredRule.eType String Event type of the rule.
Exabeam.TriggeredRule.triggeringTime Date Time when the rule was triggered.
Exabeam.TriggeredRule.riskScore Number Risk score of the rule.
Exabeam.TriggeredRule.anchorScore Number Anchor score of the rule.
Exabeam.TriggeredRule.anomalyFactor Number Anomaly factor of the rule.
Exabeam.TriggeredRule.ruleData Unknown Data insight of the rule.
Exabeam.TriggeredRule.createdTime Date Time when the rule was created.
Exabeam.TriggeredRule.scoreData Unknown Score data of the rule.
Exabeam.TriggeredRule.multiPeerGroupData Unknown Multi-peer group data of the triggered rule.

Command Example

!exabeam-list-triggered-rules sequence_id=test-20200630233800 sequence_type=session

Human Readable Output

Sequence test-20200630233800 Triggered Rules

_Id anchorScore anomalyFactor createdTime eType eventId riskScore ruleData ruleId ruleType scoreData sessionId triggeringTime username
60072e97131b380006eb2208 15.0 1.0 2021-01-19T19:10:15.330000 local-logon 2311678@m 15.0 featureValue: tks_en_dd7_kt
scopeValue: test
modelName: LL-UH		 LL-UH-F session histScoreData: {“weight”: 1.0, “rawScore”: 1.0585832492943268} test-20200630233800 2020-06-30T23:38:00 test
60072e97131b380006eb220b 15.0 0.28 2021-01-19T19:10:15.330000 local-logon 2311678@m 4.27 featureValue: tks_en_dd7_kt
scopeValue: it administrator
modelName: LL-GH		 LL-GH-F session histScoreData: {“weight”: 1.0, “rawScore”: 0.6133293162851026} test-20200630233800 2020-06-30T23:38:00 test
60072e97131b380006eb220d 7.0 0.27 2021-01-19T19:10:15.330000 local-logon 2311678@m 1.9 featureValue: tks_en_dd7_kt
scopeValue: salesforce
modelName: LL-GH		 LL-GH-A session histScoreData: {“weight”: 1.0, “rawScore”: 3.5486919149585874} test-20200630233800 2020-06-30T23:38:00 test

exabeam-get-asset-info

Returns asset information for given asset ID (hostname or IP address).

Base Command

exabeam-get-asset-info

Input

Argument Name Description Required
asset_id ID of the asset to fetch info for. Required
max_users_number The maximal number of users. Default is 50. Optional

Context Output

Path Type Description
Exabeam.AssetInfo.assetId String ID of the asset.
Exabeam.AssetInfo.hostName String Host of the asset.
Exabeam.AssetInfo.ipAddress String IP address of the asset.
Exabeam.AssetInfo.assetType String Type of the asset.
Exabeam.AssetInfo.firstSeen Date Time when the asset was first seen.
Exabeam.AssetInfo.lastSeen Date Time when the asset was last seen.
Exabeam.AssetInfo.riskScore Number Risk score of the asset.
Exabeam.AssetInfo.riskState String Risk state of the asset.
Exabeam.AssetInfo.zone String Zone of the asset.
Exabeam.AssetInfo.assetGroup String Group of the asset.
Exabeam.AssetInfo.latestSequenceId String ID of the latest seqence of the asset.

Command Example

!exabeam-get-asset-info asset_id=test_asset

Human Readable Output

Asset test_asset Information

Asset Id Asset Type First Seen Host Name Ip Address Last Seen Latest Sequence Id Risk Score Zone
test_asset Windows 2020-06-01T14:41:00 test_asset 8.8.8.8 2020-07-02T19:58:00 asset@test_asset-20200630 0.0 new york office

exabeam-list-asset-timeline-next-events

Gets next events for a given asset.

Base Command

exabeam-list-asset-timeline-next-events

Input

Argument Name Description Required
asset_id ID of the asset. Required
event_time The event time, e.g. “2 years ago” or “2019-02-27”. Required
number_of_events Preferred number of events. Default is 50. Optional
anomaly_only Whether to return only anomaly events. Possible values are: true, false. Default is false. Optional
event_types A comma-separated list of event types. Optional
event_types_operator Whether or not to include the specified event types. Possible values are: include, exclude. Default is exclude. Optional
sequence_types A comma-separated list of sequence types. Required
event_categories A comma-separated list of event categories. Optional

Context Output

Path Type Description
Exabeam.AssetEvent.event_id String Event ID of the asset.
Exabeam.AssetEvent.event_type String Type of the event.
Exabeam.AssetEvent.event_category String Category of the event.
Exabeam.AssetEvent.time Date Time when the event occurred.
Exabeam.AssetEvent.rawlog_time Date Raw log time of the event.
Exabeam.AssetEvent.session_id String Session ID of the event.
Exabeam.AssetEvent.session_order String Session order of the event.
Exabeam.AssetEvent.src_host String Source host of the event.
Exabeam.AssetEvent.src_ip String Source IP of the event.
Exabeam.AssetEvent.src_zone String Source zone of the event.
Exabeam.AssetEvent.dest_host String Destination host of the event.
Exabeam.AssetEvent.dest_ip String Destination IP of the event.
Exabeam.AssetEvent.dest_zone String Destination of the event.
Exabeam.AssetEvent.user String User of the event.
Exabeam.AssetEvent.host String Host of the event.
Exabeam.AssetEvent.domain String Domain of the event.
Exabeam.AssetEvent.account String Account of the event.
Exabeam.AssetEvent.hash String Hash of the event.
Exabeam.AssetEvent.entity_asset_id String Entity asset ID of the event.
Exabeam.AssetEvent.source String Source of the event.

Command Example

!exabeam-list-asset-timeline-next-events asset_id=test_asset event_time="2 years ago" sequence_types=session

Human Readable Output

Asset test_asset Next Events

1 local-logon event(s) between 2020-06-01 15:29:00 and 2020-06-01 15:29:00

Account AuthPackage AuthProcess DestHost DestIp Domain EntityAssetId EventCategory EventCode EventId EventType Getvalue(‘ZoneInfo’, Dest) Hash Host IsSessionFirst LogonTypeText NonmachineUser RawlogTime SessionId SessionOrder Source SrcHost SrcIp SrcZone Time User UserSid
test_account1 ntlm Kerberos tks_en_360_kt 8.8.8.8 kt_cloud asset@test_asset-20200601 user-events,
asset-events		 4624 279@m local-logon zone55 1421552590 dc_486 true 2 - Interactive blozano 2020-06-01T15:29:00 blozano-20200601152900 1 Windows test_asset 8.8.8.8 los angeles office 2020-06-01T15:29:00 blozano test_drive\blozano

2 remote-access event(s) between 2020-06-01 16:00:00 and 2020-06-01 16:03:00

Account AssetFeature AuthPackage AuthProcess DestHost DestIp Domain EntityAssetId EventCategory EventCode EventId EventType Getvalue(‘ZoneInfo’, Dest) Hash Host LogonTypeText NtlmHost RawlogTime SessionId SessionOrder Source SrcHost SrcHostWindows SrcIp SrcZone Time User UserSid ZoneFeature
test_account1 test_asset:test_asset2 ntlm Negotiate test_asset2 8.8.8.8 dev_kt asset@test_asset-20200601 user-events,
asset-events		 4624 562@m remote-access chicago office 1895168631 dc_887 3 - Network test_asset 2020-06-01T16:00:00 test_account1-20200601160000 2 Windows test_asset test_asset 8.8.8.8 zone55 2020-06-01T16:00:00 test_account1 test_drive\test_account1 zone55:chicago office
test_account2 test_asset:test_asset3 ntlm Kerberos test_asset3 8.8.8.8 dev_kt asset@test_asset-20200601 user-events,
asset-events		 4624 873@m remote-access zone55 1665078914 dc_879 3 - Network test_asset 2020-06-01T16:02:00 test_account2-20200601140600 3 Windows test_asset test_asset 8.8.8.8 los angeles office 2020-06-01T16:02:00 test_account2 test_drive\test_account2 zone55:los angeles office

exabeam-list-security-alerts-by-asset

Gets security alerts for a given asset.

Base Command

exabeam-list-security-alerts-by-asset

Input

Argument Name Description Required
asset_id ID of the asset to fetch info for. Required
sort_by The key to sort results by. Possible values are: date, riskScore. Default is date. Optional
sort_order The results order (ascending or descending). Possible values are: asc, desc. Default is desc. Optional
limit Maximal number of results. Default is 50. Optional

Context Output

Path Type Description
Exabeam.AssetSecurityAlert.process String Process of the security alert.
Exabeam.AssetSecurityAlert.process_name String Process name of the security alert.
Exabeam.AssetSecurityAlert.alert_name String Name of the security alert.
Exabeam.AssetSecurityAlert.alert_type String Type of the security alert.
Exabeam.AssetSecurityAlert.alert_severity String Severity of the security alert.
Exabeam.AssetSecurityAlert.malware_url String Malware URL of the security alert.
Exabeam.AssetSecurityAlert.event_id String Event ID of the asset.
Exabeam.AssetSecurityAlert.event_type String Type of the event.
Exabeam.AssetSecurityAlert.time Date Time when the event occurred.
Exabeam.AssetSecurityAlert.rawlog_time Date Raw log time of the security alert.
Exabeam.AssetSecurityAlert.session_id String Session ID of the security alert.
Exabeam.AssetSecurityAlert.session_order String Session order of the security alert.
Exabeam.AssetSecurityAlert.src_host String Source host of the security alert.
Exabeam.AssetSecurityAlert.src_ip String Source IP of the security alert.
Exabeam.AssetSecurityAlert.src_port String Source port of the security alert.
Exabeam.AssetSecurityAlert.dest_host String Destination host of the security alert.
Exabeam.AssetSecurityAlert.dest_ip String Destination IP of the security alert.
Exabeam.AssetSecurityAlert.dest_port String Destination port of the security alert.
Exabeam.AssetSecurityAlert.user String User of the security alert.
Exabeam.AssetSecurityAlert.host String Host of the security alert.
Exabeam.AssetSecurityAlert.domain String Domain of the security alert.
Exabeam.AssetSecurityAlert.account String Account of the security alert.
Exabeam.AssetSecurityAlert.hash String Hash of the security alert.
Exabeam.AssetSecurityAlert.MD5 String MD5 of the security alert.
Exabeam.AssetSecurityAlert.entity_asset_id String Entity asset ID of the security alert.
Exabeam.AssetSecurityAlert.source String Source of the security alert.
Exabeam.AssetSecurityAlert.vendor String Vendor of the security alert.
Exabeam.AssetSecurityAlert.sensor_id Boolean Sensor ID of the alert.
Exabeam.AssetSecurityAlert.local_asset String Local asset of the security alert.
Exabeam.AssetSecurityAlert.additional_info String Additional information about the security alert.

Command Example

!exabeam-list-security-alerts-by-asset asset_id=lt-test_asset-888

Human Readable Output

Asset lt-test_asset-888 Security Alerts

Account Additional _ Info Alert _ Id Alert _ Name Alert _ Severity Alert _ Type Dest _ Host Dest _ Ip Dest _ Port Entity Asset Id Event _ Id Event _ Type Hash Host Local _ Asset Malware _ Url Md 5 Process Process _ Name Rawlog _ Time Sensor _ Id Session _ Id Session _ Order Source Src Dest Alert Src _ Host Src _ Ip Src _ Port Time User Vendor
test_account default_taxes: 1956 test1 4 Export-ReportView-Contact tks_en_eff_kt 8.8.8.8 1117 asset@lt-test_asset-888-20200613,
asset@tks_en_eff_kt-20200613,
asset@10.37.0.17-20200613,
asset@192.168.16.137-20200613		 968178@m security-alert 781895093 dc_936 lt-test_asset-888 test.com e62ef0ed95b79d4c6327d410cb8100348c test.exe test.exe 2020-06-13T17:25:00 0xun6f test_asset-20200613154800 22 Palo Alto Networks WildFire Backdoor-FFBM:lt-test_asset-888:tks_en_eff_kt lt-test_asset-888 8.8.8.8 1204 2020-06-13T17:25:00 test_asset Palo Alto Networks WildFire
test_account * Pull Request: [] 3770 test2 LOW Export-Report tks_en_0b3_kt 8.8.8.8 105 asset@lt-test_asset-888-20200613,
asset@tks_en_0b3_kt-20200613,
asset@10.37.0.17-20200613,
asset@10.136.0.55-20200613		 954176@m security-alert 1734360022 dc_936 lt-test_asset-888 http://test.com/ 1c30fae6dadda43962e2444445d3f87f70 test.exe test.exe 2020-06-13T16:16:00 0x6m5w test_asset-20200613154800 6 Palo Alto Networks WildFire Exploit/CVE-2015-1539:lt-test_asset-888:tks_en_0b3_kt lt-test_asset-888 8.8.8.8 1204 2020-06-13T16:16:00 test_asset Palo Alto Networks WildFire

exabeam-search-rules

Searches for rules by a keyword.

Base Command

exabeam-search-rules

Input

Argument Name Description Required
keyword The search keyword. Required
filter The search filter. Optional
limit Maximal number of rules to retrieve. Default is 50. Optional
page Results page number. Default is 0. Optional

Context Output

Path Type Description
Exabeam.Rule.categoryId String Category ID of the rule.
Exabeam.Rule.categoryDisplayName String Category display name of the rule.
Exabeam.Rule.ruleId String ID of the rule.
Exabeam.Rule.ruleDef.ruleName String Name of the rule.
Exabeam.Rule.ruleDef.ruleDescription String Description of the rule.
Exabeam.Rule.ruleDef.reasonTemplate String Reason template of the rule.
Exabeam.Rule.ruleDef.aggregateReasonTemplate String Aggregate reason template of the rule.
Exabeam.Rule.ruleDef.ruleType String Type of the rule.
Exabeam.Rule.ruleDef.classifyIf String Classification definition of the rule.
Exabeam.Rule.ruleDef.ruleEventTypes String Event types of the rule.
Exabeam.Rule.ruleDef.disabled Boolean Whether or not the rule is disabled.
Exabeam.Rule.ruleDef.modelName String Model name of the rule.
Exabeam.Rule.ruleDef.factFeatureName String Fact feature name of the rule.
Exabeam.Rule.ruleDef.hasDynamicScore Boolean Whether or not the rule has a dynamic score.
Exabeam.Rule.ruleDef.score Number Score of the rule.
Exabeam.Rule.ruleDef.percentileThreshold String Percentile threshold of the rule.
Exabeam.Rule.ruleDef.ruleExpression String The rule expression.
Exabeam.Rule.ruleDef.dependencyExpression String The rule dependency expression.
Exabeam.Rule.ruleDef.ruleCategory String The category of the rule.
Exabeam.Rule.disabled Boolean Whether or not the rule is disabled.
Exabeam.Rule.effective Boolean True if the rule is effective, false otherwise.
Exabeam.Rule.state String State of the rule (DefaultExabeam, ModifiedExabeam or CustomerCreated).
Exabeam.Rule.canSimpleEdit Boolean Whether or not it is possible to use the simple editor on this rule.

Command Example

!exabeam-search-rules limit=1 keyword=account

Human Readable Output

Rule Search Results

Can Simple Edit Category Display Name Category Id Disabled Effective Rule Def Rule Id State
false Account Creation and Management Account Creation and Management false true ruleId: AM-GOU-A
ruleName: Abnormal account OU addition to this group
ruleDescription: OU means Organizational Unit - a container within a Microsoft Active Directory domain which can hold users, groups, and computers. Account management events are notable because they can provide a path for an attacker to move laterally through a system.
reasonTemplate: Abnormal account OU {default|event.account_ou} addition to group {default|event.group_name}
aggregateReasonTemplate: Abnormal account OU addition to this group: {default|featureValue|histogram}
ruleType: session
classifyIf: (count(account_ou, ‘member-added’) = 1)
ruleEventTypes: member-added
disabled: false
modelName: AM-GOU
factFeatureName: account_ou
hasDynamicScore: false
score: 7.0
percentileThreshold: 0.1
ruleExpression: ((confidence_factor >= 0.8) && ((num_observations > 0) && (num_observations < percentile_threshold_count)))
dependencyExpression: NA
ruleCategory: Account Creation and Management
ruleLabels:		 AM-GOU-A ModifiedExabeam

exabeam-get-rule-string

Gets a rule’s information as a string.

Base Command

exabeam-get-rule-string

Input

Argument Name Description Required
rule_id The ID of the rule. Required

Context Output

Path Type Description
Exabeam.Rule.ruleId String The ID of the rule.
Exabeam.Rule.ruleString String The rule string.

Command Example

!exabeam-get-rule-string rule_id=AM-GOU-A

Human Readable Output

Rule AM-GOU-A String

Rule Id Rule String
AM-GOU-A AM-GOU-A {
RuleName = “Abnormal account OU addition to this group”
RuleDescription = “OU means Organizational Unit - a container within a Microsoft Active Directory domain which can hold users, groups, and computers. Account management events are notable because they can provide a path for an attacker to move laterally through a system.”
ReasonTemplate = “Abnormal account OU {default|event.account_ou} addition to group {default|event.group_name}”
AggregateReasonTemplate = “Abnormal account OU addition to this group: {default|featureValue|histogram}”
RuleType = “session”
RuleCategory = “Account Creation and Management”
ClassifyIf = “count(account_ou,’member-added’)=1”
RuleEventTypes = [“member-added”]
Disabled = “FALSE”
Model = “AM-GOU”
FactFeatureName = “account_ou”
Score = “7”
HistShapeScoring {
Enabled = true
}
PercentileThreshold = “0.1”
RuleExpression = “confidence_factor>=0.8 && num_observations>0 && num_observations <percentile_threshold_count”
DependencyExpression = “NA”
RuleLabels {
mitre = [“T1078”]
}
}

exabeam-fetch-rules

Gets all rules.

Base Command

exabeam-fetch-rules

Input

Argument Name Description Required
filter_by The type of the rules to retrieve. Possible values are: all, custom, default. Default is all. Optional
page Which page of results to return. Default is 0. Optional
limit Maximal number of results. Default is 50. Optional

Context Output

Path Type Description
Exabeam.Rule.categoryId String Category ID of the rule.
Exabeam.Rule.categoryDisplayName String Category display name of the rule.
Exabeam.Rule.ruleId String ID of the rule.
Exabeam.Rule.ruleDef.ruleName String Name of the rule.
Exabeam.Rule.ruleDef.ruleDescription String Description of the rule.
Exabeam.Rule.ruleDef.reasonTemplate String Reason template of the rule.
Exabeam.Rule.ruleDef.aggregateReasonTemplate String Aggregate reason template of the rule.
Exabeam.Rule.ruleDef.ruleType String Type of the rule.
Exabeam.Rule.ruleDef.classifyIf String Classification expression definition of the rule.
Exabeam.Rule.ruleDef.ruleEventTypes String Event types of the rule.
Exabeam.Rule.ruleDef.disabled Boolean Whether or not the rule is disabled.
Exabeam.Rule.ruleDef.modelName String Model name that the rule references.
Exabeam.Rule.ruleDef.factFeatureName String The name of a feature used for fact based rules.
Exabeam.Rule.ruleDef.hasDynamicScore Boolean Whether or not the rule has a dynamic score.
Exabeam.Rule.ruleDef.score Number Score of the rule.
Exabeam.Rule.ruleDef.percentileThreshold String Indicates which observations are considered anomalous based on the histogram.
Exabeam.Rule.ruleDef.ruleExpression String A boolean expression that the rule engine uses to determine if a particular rule will trigger.
Exabeam.Rule.ruleDef.dependencyExpression String The rule dependency expression.
Exabeam.Rule.ruleDef.ruleCategory String The category of the rule.
Exabeam.Rule.disabled Boolean Whether or not the rule is disabled.
Exabeam.Rule.effective Boolean True if the rule is effective, false otherwise.
Exabeam.Rule.state String State of the rule (DefaultExabeam, ModifiedExabeam or CustomerCreated).
Exabeam.Rule.canSimpleEdit Boolean Whether or not it is possible to use the simple editor on this rule.

Command Example

!exabeam-fetch-rules limit=1

Human Readable Output

Rule Search Results

Can Simple Edit Category Display Name Category Id Disabled Effective Rule Def Rule Id State
false Account Creation and Management Account Creation and Management false true ruleId: AM-GOU-A
ruleName: Abnormal account OU addition to this group
ruleDescription: OU means Organizational Unit - a container within a Microsoft Active Directory domain which can hold users, groups, and computers. Account management events are notable because they can provide a path for an attacker to move laterally through a system.
reasonTemplate: Abnormal account OU {default|event.account_ou} addition to group {default|event.group_name}
aggregateReasonTemplate: Abnormal account OU addition to this group: {default|featureValue|histogram}
ruleType: session
classifyIf: (count(account_ou, ‘member-added’) = 1)
ruleEventTypes: member-added
disabled: false
modelName: AM-GOU
factFeatureName: account_ou
hasDynamicScore: false
score: 7.0
percentileThreshold: 0.1
ruleExpression: ((confidence_factor >= 0.8) && ((num_observations > 0) && (num_observations < percentile_threshold_count)))
dependencyExpression: NA
ruleCategory: Account Creation and Management
ruleLabels:		 AM-GOU-A ModifiedExabeam

exabeam-get-rules-model-definition

Gets a rule model definition by name.

Base Command

exabeam-get-rules-model-definition

Input

Argument Name Description Required
model_name The name of the model. Required

Context Output

Path Type Description
Exabeam.Model.alpha String Alpha value of the model.
Exabeam.Model.name String Name of the model.
Exabeam.Model.feature String Feature of the model.
Exabeam.Model.cutOff String Cut off value of the model.
Exabeam.Model.histogramEventTypes String Histogram event types of the model.
Exabeam.Model.featureName String Feature name of the model.
Exabeam.Model.description String Description of the model.
Exabeam.Model.trainIf String Train if expression definition of the model.
Exabeam.Model.featureType String Feature type of the model.
Exabeam.Model.modelTemplate String The model template.
Exabeam.Model.convergenceFilter String Convergence filter of the model.
Exabeam.Model.iconName String Icon name of the model.
Exabeam.Model.modelType String Type of the model.
Exabeam.Model.binWidth String The bin width.
Exabeam.Model.maxNumberOfBins String The maximal number of bins.
Exabeam.Model.scopeType String The scope type of the model.
Exabeam.Model.agingWindow String Aging window of the model.
Exabeam.Model.category String The model category.
Exabeam.Model.disabled String TRUE if the model is disabled, FALSE otherwise.
Exabeam.Model.scopeValue String The scope value of the model.

Command Example

!exabeam-get-rules-model-definition model_name=AM-AG

Human Readable Output

Model AM-AG Definition

Aging Window Alpha Category Convergence Filter Cut Off Description Disabled Feature Feature Name Feature Type Histogram Event Types Max Number Of Bins Model Template Model Type Name Scope Type Scope Value Train If
32 0.8 Other confidence_factor>=0.8 5 Models which security groups users are being added to in the organization FALSE group_name group_name group_name member-added 1000000 Account management, groups which users are being added to CATEGORICAL AM-AG ORG org TRUE

exabeam-watchlist-add-items

Add watchlist items by their names or from a CSV file.

Base Command

exabeam-watchlist-add-items

Input

Argument Name Description Required
watchlist_id The watchlist ID. Required
items A comma-separated list of the items to add. Optional
csv_entry_id The entry ID of the CSV file. Optional
watch_until_days Number of days until asset is automatically removed from the watchlist. Default is 50. Optional
category The item category. Possible values are: Anomalies, Assets, Events, Sessions, Users. Required

Context Output

There is no context output for this command.

Command Example

!exabeam-watchlist-add-items category=Assets watchlist_id=60249dfb130b3800075b8e36 items=asset1,asset2

Human Readable Output

Successfully added 2 items to watchlist 60249dfb130b3800075b8e36.

exabeam-watchlist-asset-search

Gets the assets of a specified watchlist according to a keyword.

Base Command

exabeam-watchlist-asset-search

Input

Argument Name Description Required
keyword A keyword to search. Required
watchlist_id The watchlist ID. Required
limit Maximum number of results to retrieve. Default is 30. Optional
is_exclusive Whether or not the item is exclusive on watchlist. Possible values are: true, false. Default is false. Optional
search_by_ip Whether or not to search the item by its IP. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
Exabeam.AssetInfo.hostName String Host of the asset.
Exabeam.AssetInfo.ipAddress String IP address of the asset.
Exabeam.AssetInfo.assetType String Type of the asset.
Exabeam.AssetInfo.firstSeen Date Time when the asset was first seen.
Exabeam.AssetInfo.lastSeen Date Time when the asset was last seen.
Exabeam.AssetInfo.riskScore Number Risk score of the asset.
Exabeam.AssetInfo.riskState String Risk state of the asset.
Exabeam.AssetInfo.zone String Zone of the asset.

Command Example

!exabeam-watchlist-asset-search watchlist_id=60249dfb130b3800075b8e36 keyword=s

Human Readable Output

Watchlist 60249dfb130b3800075b8e36 Assets Search Results

Asset Type First Seen Host Name Ip Address Last Seen Risk Score Risk State Zone
Windows 2020-06-01T15:01:00 asset1 8.8.8.8 2020-07-03T23:16:00 0.0 compromised atlanta office
Windows 2020-06-01T14:17:00 asset2   2020-07-03T23:45:00 140.0 compromised  

exabeam-watchlist-remove-items

Removes items from a watchlist.

Base Command

exabeam-watchlist-remove-items

Input

Argument Name Description Required
watchlist_id The watchlist ID. Required
items A comma-separated list of the items to remove. Required
category The category of the items to remove. Possible values are: Anomalies, Assets, Events, Sessions, Users. Required

Context Output

There is no context output for this command.

Command Example

!exabeam-watchlist-remove-items category=Assets watchlist_id=60249dfb130b3800075b8e36 items=asset1,asset2

Human Readable Output

Successfully removed 2 items from watchlist 60249dfb130b3800075b8e36.

exabeam-list-context-table-records

Returns a list of a context table records.

Base Command

exabeam-list-context-table-records

Input

Argument Name Description Required
context_table_name The name of the context table. Required
limit Maximum number of results to return. Default is 50. Optional
offset The offset number to begin (starts from 1). Default is 1. Optional

Context Output

Path Type Description
Exabeam.ContextTable.Name String Name of the context table.
Exabeam.ContextTable.Record.key String The key of the record.
Exabeam.ContextTable.Record.id String The ID of the record.
Exabeam.ContextTable.Record.sourceType String The source type of the record.
Exabeam.ContextTable.Record.position Number The position of the record.
Exabeam.ContextTable.Record.value String Value of the record.

Command Example

!exabeam-list-context-table-records context_table_name=test_table

Human Readable Output

Context Table test_table Records

Id Position Source Type Key Value
0-0 0 Manual ktest2 v3
0-1 1 Manual ktest3  
0-2 2 Manual ktest4 v4
0-3 3 Manual k1 v1,
v2,
v3

exabeam-add-context-table-records

Add records to the context table.

Base Command

exabeam-add-context-table-records

Input

Argument Name Description Required
context_table_name The name of the context table. Required
records A comma-separated list of records to add, for example: k1,k2. If context_table_type argument is set to key_value, every record should be in “key:values” format, where “values” is a semi-colon separated list of values. For example: k1:v1;v2,k2:v3,k3:,k4:v4. Required
session_id The ID of update session. If not specified, a new session is created. Optional
context_table_type The context table type. Possible values are: key_only, key_value. Required

Context Output

Path Type Description
Exabeam.ContextTableUpdate.contextTableName String The context table name.
Exabeam.ContextTableUpdate.sessionId Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.changeType Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.changeId Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.record.key Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.record.value Unknown The raw data of the context table update.

Command Example

!exabeam-add-context-table-records context_table_name=test_table context_table_type=key_value records=testk1:v1,testv2:,testv3:v31;v32

Human Readable Output

Context Table test_do_not_remove Update Details

createdSize: 3, updatedSize: 0, removedSize: 0, duplicates: []

Change Id Change Type Context Table Name Record Session Id
45dc28dc-28be-426c-9293-d7f477f85408 created test_table key: testk1
value: v1		 f0283c9c-7317-457b-b9de-43888960b4cb
1c96f414-dc0e-4106-a972-05dbbb77dd63 created test_table key: testv2
value:		 f0283c9c-7317-457b-b9de-43888960b4cb
0a2ca93c-e5da-442c-adcd-5c7af2df9b13 created test_table key: testv3
value: v31,
v32		 f0283c9c-7317-457b-b9de-43888960b4cb

exabeam-update-context-table-records

Updates records of a context table.

Base Command

exabeam-update-context-table-records

Input

Argument Name Description Required
context_table_name The name of the context table. Required
session_id The ID of update session. If not specified, a new session is created. Optional
records A comma-separated list of records to update. If context_table_type argument is set to key_only, each record should be in the following format: id:key. Otherwise it’s a key_value type and then the format of a record is id:key:values, where the values are separated by semi-colons. Required
context_table_type Type of the context table. Possible values are: key_only, key_value. Required

Context Output

Path Type Description
Exabeam.ContextTableUpdate.contextTableName String The context table name.
Exabeam.ContextTableUpdate.sessionId Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.changeType Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.changeId Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.record.key Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.record.value Unknown The raw data of the context table update.

Command Example

!exabeam-update-context-table-records context_table_name=test_key_only context_table_type=key_only records=0-0:test,0-1:test1

Human Readable Output

Context Table test_key_only Update Details

createdSize: 0, updatedSize: 2, removedSize: 0, duplicates: []

Change Id Change Type Context Table Name Record Session Id
9be31efc-0aac-4c56-98e1-dedec68f32dd updated test_key_only key: test
id: 0-0		 fdf0fd02-bf87-4c03-ad09-cc53e4c8aaee
744b59ee-0f53-4e1f-8bfc-fcdcc9a8c568 updated test_key_only key: test1
id: 0-1		 fdf0fd02-bf87-4c03-ad09-cc53e4c8aaee

exabeam-get-context-table-in-csv

Export a context table to CSV.

Base Command

exabeam-get-context-table-in-csv

Input

Argument Name Description Required
context_table_name Name of the context table. Required

Context Output

There is no context output for this command.

Command Example

!exabeam-get-context-table-in-csv context_table_name=test_table

exabeam-add-context-table-records-from-csv

Add context table records from CSV file in a specific modification session.

Base Command

exabeam-add-context-table-records-from-csv

Input

Argument Name Description Required
context_table_name Name of the context table. Required
session_id The ID of context table session. If not specified, a new session is created. Optional
has_header Indicates whether the file has a header. Possible values are: true, false. Required
file_entry_id The entry ID of the CSV file from which records will be added. Required
append_or_replace Whether to replace or append the records from the CSV file. Possible values are: append, replace. Default is append. Optional

Context Output

There is no context output for this command.

Command Example

!exabeam-add-context-table-records-from-csv context_table_name=test_table file_entry_id=2034d0d-86ad-04bc3dfa1272 has_header=true append_or_replace=append

Human Readable Output

Context Table test_table Update Details

createdSize: 2, updatedSize: 0, removedSize: 0, duplicates: []

Change Id Change Type Context Table Name Record Session Id
4a376a74-7f02-49cc-ac37-d73f37ba7809 created test_table key: k33
value: 1		 15b2499c-8506-48ed-9431-7dce94de33a2
37733fb6-e947-4b07-b240-9c5602317d55 created test_table key: k44
value: 2,3		 15b2499c-8506-48ed-9431-7dce94de33a2

exabeam-delete-context-table-records

Delete records from a context table.

Base Command

exabeam-delete-context-table-records

Input

Argument Name Description Required
context_table_name Name of the context table. Required
records A comma-separated list of the records’ keys to delete. Required
session_id The ID of update session. If not specified, a new session is created. Optional

Context Output

Path Type Description
Exabeam.ContextTableUpdate.contextTableName String The context table name.
Exabeam.ContextTableUpdate.sessionId Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.changeType Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.changeId Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.record.key Unknown The raw data of the context table update.
Exabeam.ContextTableUpdate.record.value Unknown The raw data of the context table update.

Command Example

!exabeam-delete-context-table-records context_table_name=test_table context_table_type=key_value records=testk11,testv2

Human Readable Output

Context Table test_table Update Details

createdSize: 0, updatedSize: 0, removedSize: 2, duplicates: []

Change Id Change Type Context Table Name Record Session Id
e4469b52-ac45-4c97-91af-16c31b8fbb49 removed test_table key:
id: testk11		 64e660b7-5f70-40df-adf7-3e8a4bf25462
5137afa2-36d4-4818-93ec-f3fd0e244c38 removed test_table key:
id: testv2		 64e660b7-5f70-40df-adf7-3e8a4bf25462

Base Command

exabeam-get-notable-assets

Input

Argument Name Description Required
limit The maximum number of returned results. Required
time_period The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on. Required

Context Output

Path Type Description
Exabeam.NotableAsset.HostName String The notable asset host name.
Exabeam.NotableAsset.IPAddress String The notable asset IP address.
Exabeam.NotableAsset.AssetType String The notable asset type.
Exabeam.NotableAsset.FirstSeen Date Time when the asset was first seen.
Exabeam.NotableAsset.LastSeen Date Time when the asset was last seen.
Exabeam.NotableAsset.highestRiskScore Number The highest risk score of the asset.
Exabeam.NotableAsset.id String The notable asset ID.
Exabeam.NotableAsset.entityName String The entity name of the asset.
Exabeam.NotableAsset.entityValue String The entity value of the asset.
Exabeam.NotableAsset.day Date The notable asset date.
Exabeam.NotableAsset.triggeredRuleCountOpt Number The number that asset triggered rule count opt.
Exabeam.NotableAsset.riskScoreOpt Number Risk score opt of the asset.
Exabeam.NotableAsset.incidentIds Unknown The incident IDs of the notable asset.
Exabeam.NotableAsset.commentId String The comment ID of the notable asset.
Exabeam.NotableAsset.commentType String The comment type of the notable asset.
Exabeam.NotableAsset.commentObjectId String The comment object ID of the notable asset.
Exabeam.NotableAsset.text String The notable asset text.
Exabeam.NotableAsset.exaUser String The notable asset exaUser.
Exabeam.NotableAsset.exaUserFullname String The notable asset exaUser fullname.
Exabeam.NotableAsset.createTime Date Time when the asset was created.
Exabeam.NotableAsset.updateTime Date Time when the asset was updated.
Exabeam.NotableAsset.edited Boolean Whether or not the notable asset is edited.
Exabeam.NotableAsset.zone String The number that asset triggered rule count opt.

Command Example

!exabeam-get-notable-assets limit=1 time_period="1 day"

exabeam-get-notable-session-details

Returns notable session details.

Base Command

exabeam-get-notable-session-details

Input

Argument Name Description Required
asset_id ID of the asset to fetch info for. Required
sort_by The key to sort results by. Possible values are: date, riskScore. Default is date. Optional
sort_order The order of the results (ascending or descending). Possible values are: asc, desc. Default is desc. Optional
limit Maximum number of results. Default is 50. Optional

Context Output

Path Type Description
Exabeam.NotableSession.users.UserName String The notable session user name.
Exabeam.NotableSession.users.RiskScore number The notable session risk score.
Exabeam.NotableSession.users.AverageRiskScore number The average risk score of the notable session.
Exabeam.NotableSession.users.FirstSeen Date Time when the notable session was first seen.
Exabeam.NotableSession.users.LastSeen Date Time when the notable session was last seen.
Exabeam.NotableSession.users.lastActivityType String The last activity type of the user.
Exabeam.NotableSession.users.Labels Unknown The labels of the user.
Exabeam.NotableSession.users.LastSessionID String The last session ID of the user.
Exabeam.NotableSession.users.EmployeeType String The employee type of the user.
Exabeam.NotableSession.users.Department String The department of the user.
Exabeam.NotableSession.users.Title String The role of the user.
Exabeam.NotableSession.users.Location String The location of the user.
Exabeam.NotableSession.users.Email String The email of the user.
Exabeam.NotableSession.sessions.SessionID String The Session ID.
Exabeam.NotableSession.sessions.InitialRiskScore Number Initial risk score of the session.
Exabeam.NotableSession.sessions.LoginHost String The host from which the user was logged in.
Exabeam.NotableSession.sessions.Accounts String Accounts in the session.
Exabeam.NotableSession.executiveUserFlags Unknown Whether the user is a executive user.

Command Example

!exabeam-get-notable-session-details asset_id=asset_id sort_by=date sort_order=asc limit=1

exabeam-get-notable-sequence-details

Returns sequence details for the given asset ID and time range.

Base Command

exabeam-get-notable-sequence-details

Input

Argument Name Description Required
asset_id The asset ID for which to fetch data. Required
start_time The Start time of the time range. For example, 2018-08-01T11:50:16. Optional
end_time The end time of the time range. For example, 2018-08-01T11:50:16. Optional
limit Maximum number of rules to retrieve. Default is 50. Optional
page Results page number. Default is 0. Optional

Context Output

Path Type Description
Exabeam.Sequence.sequenceId String The ID of the sequence.
Exabeam.Sequence.isWhitelisted Boolean Whether or not the sequence is on allow list.
Exabeam.Sequence.areAllTriggeredRulesWhiteListed Boolean Whether or not the sequence are all triggered rules allow listed.
Exabeam.Sequence.hasBeenPartiallyWhiteListed Boolean Whether or not the sequence has been partially allow listed.
Exabeam.Sequence.riskScore Number The sequence risk score.
Exabeam.Sequence.startTime Date Start time of the sequence.
Exabeam.Sequence.endTime Date End time of the sequence.
Exabeam.Sequence.numOfReasons Number Number of reasons in the sequence.
Exabeam.Sequence.numOfEvents Number Number of events in the sequence.
Exabeam.Sequence.numOfUsers Number Number of users in the sequence.
Exabeam.Sequence.numOfSecurityEvents Number Number of security events in the sequence.
Exabeam.Sequence.numOfZones Number Number of zones in the sequence.
Exabeam.Sequence.numOfAssets Number Number of assets in the sequence.
Exabeam.Sequence.assetId String The asset ID of the sequence.

Command Example

!exabeam-get-notable-sequence-details asset_id=asset_id start_time="30 days"

exabeam-get-sequence-eventtypes

Returns sequence event types for the given asset sequence ID and time range.

Base Command

exabeam-get-sequence-eventtypes

Input

Argument Name Description Required
asset_sequence_id The asset sequence ID. Required
search_str String to search for inside display name. Optional
limit Maximum number of rules to retrieve. Default is 50. Optional
page Results page number. Default is 0. Optional

Context Output

Path Type Description
Exabeam.SequenceEventTypes.eventType String The sequence event type.
Exabeam.SequenceEventTypes.displayName String The sequence display name.
Exabeam.SequenceEventTypes.count Number The number of the sequences.
Exabeam.SequenceEventTypes.sequenceId String The sequence ID.

Command Example

!exabeam-get-sequence-eventtypes asset_sequence_id=asset_sequence_id search_str="search_str"

exabeam-list-incident

Returns incidents from Exabeam.

Base Command

exabeam-list-incident

Input

Argument Name Description Required
incident_id The incident ID. Optional
query Query string which is a combination of incident type, priority and status. Optional
incident_type Incident type to filter in Exabeam. Optional
priority Incident priority to filter in Exabeam. Optional
status Incident status to filter in Exabeam. Optional
limit Maximum number of rules to retrieve. Default is 50. Optional
page_size Number of total results in each page. Default is 25. Optional
page_number Specific page to query. Optional
username When the instance is configure by an API key, it must be used with the username argument. Optional

Context Output

Path Type Description
Exabeam.incidents.incidentId String The ID of the incident.
Exabeam.incidents.name String The name of the incident.
Exabeam.incidents.fields.startedDate Date The starting date of the incident.
Exabeam.incidents.fields.closedDate Date The ending date of the incident.
Exabeam.incidents.fields.createdAt Date The creation date of the incident.
Exabeam.incidents.fields.owner String The incident owner.
Exabeam.incidents.fields.status String The incident status.
Exabeam.incidents.fields.incidentType String The incident type.
Exabeam.incidents.fields.source String The incident source.
Exabeam.incidents.fields.priority String The incident priority.
Exabeam.incidents.fields.queue String The incident queue.
Exabeam.incidents.fields.description String The incident description.

Command Example

!exabeam-list-incident priority=high

Troubleshooting

If you are experiencing error 400 with the message “Internal Error: attempt to access uninitialized field” when trying to fetch incidents or search for a specific incident, we recommend using the user email in the username configuration with the prefix [saml].
For example, for the email user@example.com, use [saml]user@example.com.

Configuration parameters

  • url — Server URL (e.g https://100.24.16.156:8484) (required)
  • credentials — Username
  • api_token — Username
  • incident_type — Exabeam Incident Type
  • priority — Priority
  • status — Status
  • isFetch — Fetch incidents
  • max_fetch — Max incidents per fetch
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • look_back — Advanced: Minutes to look back when fetching
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • fetch_type — Fetch Type
  • max_fetch_users — Max Users Per Fetch
  • notable_users_fetch_interval — Notable Users Fetch Interval
  • notable_users_first_fetch — Notable Users First Fetch Timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • minimum_risk_score_to_fetch_users — Minimum Risk Score To Fetch Users

Commands (38)

  • exabeam-add-context-table-records

    Add records to the context table.

  • exabeam-add-context-table-records-from-csv

    Add context table records from CSV file in a specific modification session.

  • exabeam-delete-context-table-records

    Delete records from a context table.

  • exabeam-delete-watchlist

    Deletes a watchlist.

  • exabeam-fetch-rules

    Gets all rules.

  • exabeam-get-asset-data

    Returns asset data.

  • exabeam-get-asset-info

    Returns asset information for given asset ID (hostname or IP address).

  • exabeam-get-context-table-in-csv

    Export a context table to CSV.

  • exabeam-get-notable-assets

    Returns notable assets.

  • exabeam-get-notable-sequence-details

    Returns sequence details for the given asset ID and time range.

  • exabeam-get-notable-session-details

    Returns notable session details.

  • exabeam-get-notable-users

    Returns notable users in a period of time.

  • exabeam-get-peer-groups

    Returns all peer groups.

  • exabeam-get-rule-string

    Gets a rule's information as a string.

  • exabeam-get-rules-model-definition

    Gets a rule model definition by name.

  • exabeam-get-sequence-eventtypes

    Returns sequence event types for the given asset sequence ID and time range.

  • exabeam-get-session-info-by-id

    Returns session info data for the given ID.

  • exabeam-get-user-info

    Returns user information data for the username.

  • exabeam-get-user-labels

    Returns all labels of the user.

  • exabeam-get-user-sessions

    Returns sessions for the given username and time range.

  • exabeam-get-watchlists

    Returns all watchlist IDs and titles.

  • exabeam-list-asset-timeline-next-events

    Gets next events for a given asset.

  • exabeam-list-context-table-records

    Returns a list of a context table records.

  • exabeam-list-incident

    Returns incidents from Exabeam.

  • exabeam-list-security-alerts-by-asset

    Gets security alerts for a given asset.

  • exabeam-list-top-domains

    List top domains of a sequence.

  • exabeam-list-triggered-rules

    Gets all the triggered rules of a sequence.

  • exabeam-search-rules

    Searches for rules by a keyword.

  • exabeam-update-context-table-records

    Updates records of a context table.

  • exabeam-watchlist-add-items

    Add watchlist items by their names or from a CSV file.

  • exabeam-watchlist-asset-search

    Gets the assets of a specified watchlist according to a keyword.

  • exabeam-watchlist-remove-items

    Removes items from a watchlist.

  • get-notable-users Deprecated

    Returns notable users in a period of time.

  • get-peer-groups Deprecated

    Returns all peer groups.

  • get-user-info Deprecated

    Returns user information data for the username.

  • get-user-labels Deprecated

    Returns all labels of the user.

  • get-user-sessions Deprecated

    Returns sessions for the given username and time range.

  • get-watchlists Deprecated

    Returns all watchlist IDs and titles.

Source

Exabeam.py Exabeam_test.py Exabeam.yml Exabeam_description.md
Download History Raw 
category: Analytics & SIEM
provider: Exabeam
sectionorder:
- Connect
- Collect
commonfields:
  id: Exabeam
  version: -1
configuration:
- display: Server URL (e.g https://100.24.16.156:8484)
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  type: 9
  required: false
  section: Connect
- additionalinfo: Cluster Authentication Token
  display: Username
  displaypassword: API Token
  name: api_token
  type: 9
  hiddenusername: true
  required: false
  section: Connect
- defaultvalue: "generic,abnormalAuth,accountManipulation,accountTampering,ueba,bruteForce,compromisedCredentials, cryptomining,dataAccessAbuse,dataExfiltration,dlp,departedEmployee,dataDestruction,evasion,lateralMovement,alertTriage, malware,phishing,privilegeAbuse,physicalSecurity,privilegeEscalation,privilegedActivity,ransomware,workforceProtection"
  display: Exabeam Incident Type
  name: incident_type
  options:
  - generic
  - abnormalAuth
  - accountManipulation
  - accountTampering
  - ueba
  - bruteForce
  - compromisedCredentials
  - cryptomining
  - dataAccessAbuse
  - dataExfiltration
  - dlp
  - departedEmployee
  - dataDestruction
  - evasion
  - lateralMovement
  - alertTriage
  - malware
  - phishing
  - privilegeAbuse
  - physicalSecurity
  - privilegeEscalation
  - privilegedActivity
  - ransomware
  - workforceProtection
  type: 16
  required: false
  section: Collect
  advanced: true
- defaultvalue: low,medium,high,critical
  display: Priority
  name: priority
  options:
  - low
  - medium
  - high
  - critical
  type: 16
  required: false
  section: Collect
  advanced: true
- defaultvalue: closed,closedFalsePositive,inprogress,new,pending,resolved
  display: Status
  section: Connect
  name: status
  options:
  - closed
  - closedFalsePositive
  - inprogress
  - new
  - pending
  - resolved
  type: 16
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  advanced: true
- defaultvalue: '50'
  display: Max incidents per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- display: 'Advanced: Minutes to look back when fetching'
  name: look_back
  type: 0
  section: Connect
  required: false
  defaultvalue: 1
  additionalinfo: Use this parameter to determine how long backward to look in the search for incidents that were created before the last run time and did not match the query when they were created.
- display: Incident type
  name: incidentType
  section: Connect
  type: 13
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Fetch Type
  defaultvalue: Exabeam Incident
  name: fetch_type
  type: 16
  options:
  - Exabeam Incident
  - Exabeam Notable User
  section: Collect
- display: Max Users Per Fetch
  name: max_fetch_users
  additionalinfo: Applies only when the Fetch Type is set to Exabeam Notable User.
  type: 0
  section: Collect
  defaultvalue: 50
- display: Notable Users Fetch Interval
  name: notable_users_fetch_interval
  additionalinfo: The interval, in whole hours, between consecutive fetch operations.
  defaultvalue: "60"
  type: 19
  section: Collect
  advanced: true
- defaultvalue: 3 months
  display: Notable Users First Fetch Timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: notable_users_first_fetch
  type: 0
  section: Collect
  advanced: true
- display: Minimum Risk Score To Fetch Users
  name: minimum_risk_score_to_fetch_users
  type: 0
  section: Collect
  advanced: true
  defaultvalue: 90
description: The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics, and SOAR.
display: Exabeam Advanced Analytics
name: Exabeam
script:
  commands:
  - arguments:
    - description: The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on.
      isArray: true
      name: time_period
      required: true
    - defaultValue: '10'
      description: The maximum number of returned results.
      name: limit
      required: true
    deprecated: true
    description: Returns notable users in a period of time.
    name: get-notable-users
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the notable user.
      type: Number
    - contextPath: Exabeam.User.UserFullName
      description: The full name of the user.
      type: String
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score of the user.
      type: Number
    - contextPath: Exabeam.User.FirstSeen
      description: The date the user was first seen.
      type: Date
    - contextPath: Exabeam.User.NotableSessionIds
      description: The ID of the notable session.
      type: String
    - contextPath: Exabeam.User.AccountsNumber
      description: The number of accounts.
      type: Number
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.Location
      description: The location of the user.
      type: String
    - contextPath: Exabeam.User.UserName
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.Labels
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.NotableUser
      description: Whether the user is a notable user.
      type: Boolean
  - arguments:
    - description: The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on.
      isArray: true
      name: time_period
      required: true
    - defaultValue: '10'
      description: The maximum number of returned results.
      name: limit
      required: true
    description: Returns notable users in a period of time.
    name: exabeam-get-notable-users
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the notable user.
      type: Number
    - contextPath: Exabeam.User.UserFullName
      description: The full name of the user.
      type: String
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score of the user.
      type: Number
    - contextPath: Exabeam.User.FirstSeen
      description: The date the user was first seen.
      type: Date
    - contextPath: Exabeam.User.NotableSessionIds
      description: The ID of the notable session.
      type: String
    - contextPath: Exabeam.User.AccountsNumber
      description: The number of accounts.
      type: Number
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.Location
      description: The location of the user.
      type: String
    - contextPath: Exabeam.User.UserName
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.Labels
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.NotableUser
      description: Whether the user is a notable user.
      type: Boolean
  - deprecated: true
    description: Returns all watchlist IDs and titles.
    name: get-watchlists
    outputs:
    - contextPath: Exabeam.Watchlist.Category
      description: The watchlist category.
      type: String
    - contextPath: Exabeam.Watchlist.Title
      description: The watchlist title.
      type: String
    - contextPath: Exabeam.Watchlist.WatchlistID
      description: The watchlist ID.
      type: String
  - description: Returns all watchlist IDs and titles.
    name: exabeam-get-watchlists
    outputs:
    - contextPath: Exabeam.Watchlist.Category
      description: The watchlist category.
      type: String
    - contextPath: Exabeam.Watchlist.Title
      description: The watchlist title.
      type: String
    - contextPath: Exabeam.Watchlist.WatchlistID
      description: The watchlist ID.
      type: String
  - deprecated: true
    description: Returns all peer groups.
    name: get-peer-groups
    outputs:
    - contextPath: Exabeam.PeerGroup.Name
      description: The name of the peer group.
      type: String
  - description: Returns all peer groups.
    name: exabeam-get-peer-groups
    outputs:
    - contextPath: Exabeam.PeerGroup.Name
      description: The name of the peer group.
      type: String
  - arguments:
    - description: The username of the user to fetch.
      name: username
      required: true
    deprecated: true
    description: Returns user information data for the username.
    name: get-user-info
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the user.
      type: Number
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score.
      type: Number
    - contextPath: Exabeam.User.PeerGroupFieldName
      description: The field name of the peer group.
      type: String
    - contextPath: Exabeam.User.FirstSeen
      description: The date when the user was first seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupDisplayName
      description: The display name of the Peer group.
      type: String
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupFieldValue
      description: The field value of the peer group.
      type: String
    - contextPath: Exabeam.User.Label
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.Username
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.PeerGroupType
      description: The type of the peer group.
      type: String
    - contextPath: Exabeam.User.LastSessionID
      description: The last session ID of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.AccountNames
      description: The account name of the user.
      type: String
  - arguments:
    - description: The username of the user to fetch.
      name: username
      required: true
    description: Returns user information data for the username.
    name: exabeam-get-user-info
    outputs:
    - contextPath: Exabeam.User.RiskScore
      description: The risk score of the user.
      type: Number
    - contextPath: Exabeam.User.AverageRiskScore
      description: The average risk score.
      type: Number
    - contextPath: Exabeam.User.PeerGroupFieldName
      description: The field name of the peer group.
      type: String
    - contextPath: Exabeam.User.FirstSeen
      description: The date when the user was first seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupDisplayName
      description: The display name of the Peer group.
      type: String
    - contextPath: Exabeam.User.LastSeen
      description: The date the user was last seen.
      type: Date
    - contextPath: Exabeam.User.PeerGroupFieldValue
      description: The field value of the peer group.
      type: String
    - contextPath: Exabeam.User.Label
      description: The labels of the user.
      type: String
    - contextPath: Exabeam.User.Username
      description: The name of the user.
      type: String
    - contextPath: Exabeam.User.PeerGroupType
      description: The type of the peer group.
      type: String
    - contextPath: Exabeam.User.LastSessionID
      description: The last session ID of the user.
      type: String
    - contextPath: Exabeam.User.LastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.User.AccountNames
      description: The account name of the user.
      type: String
  - deprecated: true
    description: Returns all labels of the user.
    name: get-user-labels
    outputs:
    - contextPath: Exabeam.UserLabel.Label
      description: The label of the user.
      type: String
  - description: Returns all labels of the user.
    name: exabeam-get-user-labels
    outputs:
    - contextPath: Exabeam.UserLabel.Label
      description: The label of the user.
      type: String
  - arguments:
    - description: The username for which to fetch data.
      name: username
      required: true
    - description: The Start time of the time range. For example, 2018-08-01T11:50:16).
      name: start_time
    - description: The end time of the time range. For example, 2018-08-01T11:50:16.
      name: end_time
    deprecated: true
    description: Returns sessions for the given username and time range.
    name: get-user-sessions
    outputs:
    - contextPath: Exabeam.User.Session.EndTime
      description: The end time of the session.
      type: Date
    - contextPath: Exabeam.User.Session.InitialRiskScore
      description: The initial risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.Label
      description: The label of the session.
      type: String
    - contextPath: Exabeam.User.Session.LoginHost
      description: The login host.
      type: String
    - contextPath: Exabeam.User.Session.RiskScore
      description: The risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.SessionID
      description: The ID of the session.
      type: String
    - contextPath: Exabeam.User.Session.StartTime
      description: The start time of the session.
      type: Date
    - contextPath: Exabeam.User.Username
      description: The username of the session.
      type: String
  - arguments:
    - description: The username for which to fetch data.
      name: username
      required: true
    - description: The start time of the time range. For example, 2018-08-01T11:50:16 or "30 days ago".
      name: start_time
    - description: The end time of the time range. For example, 2018-08-01T11:50:16 or "1 week ago".
      name: end_time
    description: Returns sessions for the given username and time range.
    name: exabeam-get-user-sessions
    outputs:
    - contextPath: Exabeam.User.Session.EndTime
      description: The end time of the session.
      type: Date
    - contextPath: Exabeam.User.Session.InitialRiskScore
      description: The initial risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.Label
      description: The label of the session.
      type: String
    - contextPath: Exabeam.User.Session.LoginHost
      description: The login host.
      type: String
    - contextPath: Exabeam.User.Session.RiskScore
      description: The risk score of the session.
      type: Number
    - contextPath: Exabeam.User.Session.SessionID
      description: The ID of the session.
      type: String
    - contextPath: Exabeam.User.Session.StartTime
      description: The start time of the session.
      type: Date
    - contextPath: Exabeam.User.Username
      description: The username of the session.
      type: String
  - arguments:
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    description: Deletes a watchlist.
    name: exabeam-delete-watchlist
  - arguments:
    - description: The name of the asset.
      name: asset_name
      required: true
    description: Returns asset data.
    name: exabeam-get-asset-data
    outputs:
    - contextPath: Exabeam.Asset.HostName
      description: The host name of the asset.
      type: String
    - contextPath: Exabeam.Asset.IPAddress
      description: The IP address of the asset.
      type: String
    - contextPath: Exabeam.Asset.AssetType
      description: Thr type of the asset.
      type: String
    - contextPath: Exabeam.Asset.FirstSeen
      description: The date the asset was first seen.
      type: Date
    - contextPath: Exabeam.Asset.LastSeen
      description: The date the asset was last seen.
      type: String
  - arguments:
    - description: ID of the session to fetch data for.
      name: session_id
      required: true
    description: Returns session info data for the given ID.
    name: exabeam-get-session-info-by-id
    outputs:
    - contextPath: Exabeam.SessionInfo.sessionId
      description: ID of the session.
      type: String
    - contextPath: Exabeam.SessionInfo.username
      description: Username of the session.
      type: String
    - contextPath: Exabeam.SessionInfo.startTime
      description: Start time of the session.
      type: Date
    - contextPath: Exabeam.SessionInfo.endTime
      description: End time of the session.
      type: Date
    - contextPath: Exabeam.SessionInfo.initialRiskScore
      description: Initial risk score of the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.riskScore
      description: Risk score of the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfReasons
      description: Number of rules in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.loginHost
      description: The host from which the user was logged in.
      type: String
    - contextPath: Exabeam.SessionInfo.label
      description: Label of the session.
      type: String
    - contextPath: Exabeam.SessionInfo.accounts
      description: Accounts in the session.
      type: String
    - contextPath: Exabeam.SessionInfo.numOfAccounts
      description: Number of accounts in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfZones
      description: Number of zones in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfAssets
      description: Number of assets in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfEvents
      description: Number of events in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.numOfSecurityEvents
      description: Number of alerts in the session.
      type: Number
    - contextPath: Exabeam.SessionInfo.zones
      description: Zones information of the session.
      type: Unknown
  - arguments:
    - description: ID of the sequence.
      name: sequence_id
      required: true
    - description: Type of the sequence.
      name: sequence_type
      required: true
    description: List top domains of a sequence.
    name: exabeam-list-top-domains
    outputs:
    - contextPath: Exabeam.DataFeed.topDomains
      description: Top domains information.
      type: Unknown
    - contextPath: Exabeam.DataFeed.sequenceId
      description: ID of the sequence.
      type: String
    - contextPath: Exabeam.DataFeed.sequenceType
      description: Type of the sequence.
      type: String
  - arguments:
    - description: ID of the sequence to fetch data for.
      name: sequence_id
      required: true
    - description: Type of the sequence to fetch data for.
      name: sequence_type
      required: true
    description: Gets all the triggered rules of a sequence.
    name: exabeam-list-triggered-rules
    outputs:
    - contextPath: Exabeam.TriggeredRule._Id
      description: UUID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.ruleId
      description: ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.ruleType
      description: Type of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.eventId
      description: Event ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.sessionId
      description: Session ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.lockoutId
      description: Lockout ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.sequenceId
      description: Sequence ID of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.username
      description: Username of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.eType
      description: Event type of the rule.
      type: String
    - contextPath: Exabeam.TriggeredRule.triggeringTime
      description: Time when the rule was triggered.
      type: Date
    - contextPath: Exabeam.TriggeredRule.riskScore
      description: Risk score of the rule.
      type: Number
    - contextPath: Exabeam.TriggeredRule.anchorScore
      description: Anchor score of the rule.
      type: Number
    - contextPath: Exabeam.TriggeredRule.anomalyFactor
      description: Anomaly factor of the rule.
      type: Number
    - contextPath: Exabeam.TriggeredRule.ruleData
      description: Data insight of the rule.
      type: Unknown
    - contextPath: Exabeam.TriggeredRule.createdTime
      description: Time when the rule was created.
      type: Date
    - contextPath: Exabeam.TriggeredRule.scoreData
      description: Score data of the rule.
      type: Unknown
    - contextPath: Exabeam.TriggeredRule.multiPeerGroupData
      description: Multi-peer group data of the triggered rule.
      type: Unknown
  - arguments:
    - description: ID of the asset to fetch info for.
      name: asset_id
      required: true
    - defaultValue: '50'
      description: The maximal number of users.
      name: max_users_number
    description: Returns asset information for given asset ID (hostname or IP address).
    name: exabeam-get-asset-info
    outputs:
    - contextPath: Exabeam.AssetInfo.assetId
      description: ID of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.hostName
      description: Host of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.ipAddress
      description: IP address of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.assetType
      description: Type of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.firstSeen
      description: Time when the asset was first seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.lastSeen
      description: Time when the asset was last seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.riskScore
      description: Risk score of the asset.
      type: Number
    - contextPath: Exabeam.AssetInfo.riskState
      description: Risk state of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.zone
      description: Zone of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.assetGroup
      description: Group of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.latestSequenceId
      description: ID of the latest seqence of the asset.
      type: String
  - arguments:
    - description: ID of the asset.
      name: asset_id
      required: true
    - description: The event time, e.g. "2 years ago" or "2019-02-27".
      name: event_time
      required: true
    - defaultValue: '50'
      description: Preffered number of events.
      name: number_of_events
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to return only anomaly events.
      name: anomaly_only
      predefined:
      - 'true'
      - 'false'
    - description: A comma-separated list of event types.
      name: event_types
    - auto: PREDEFINED
      defaultValue: exclude
      description: Whether or not to include the specified event types.
      name: event_types_operator
      predefined:
      - include
      - exclude
    - description: A comma-separated list of sequence types.
      name: sequence_types
      required: true
    - description: A comma-separated list of event categories.
      name: event_categories
    description: Gets next events for a given asset.
    name: exabeam-list-asset-timeline-next-events
    outputs:
    - contextPath: Exabeam.AssetEvent.event_id
      description: Event ID of the asset.
      type: String
    - contextPath: Exabeam.AssetEvent.event_type
      description: Type of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.event_category
      description: Category of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.time
      description: Time when the event occurred.
      type: Date
    - contextPath: Exabeam.AssetEvent.rawlog_time
      description: Raw log time of the event.
      type: Date
    - contextPath: Exabeam.AssetEvent.session_id
      description: Session ID of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.session_order
      description: Session order of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.src_host
      description: Source host of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.src_ip
      description: Source IP of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.src_zone
      description: Source zone of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.dest_host
      description: Destination host of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.dest_ip
      description: Destination IP of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.dest_zone
      description: Destination of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.user
      description: User of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.host
      description: Host of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.domain
      description: Domain of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.account
      description: Account of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.hash
      description: Hash of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.entity_asset_id
      description: Entity asset ID of the event.
      type: String
    - contextPath: Exabeam.AssetEvent.source
      description: Source of the event.
      type: String
  - arguments:
    - description: ID of the asset to fetch info for.
      name: asset_id
      required: true
    - auto: PREDEFINED
      defaultValue: date
      description: The key to sort results by.
      name: sort_by
      predefined:
      - date
      - riskScore
    - auto: PREDEFINED
      defaultValue: desc
      description: The results order (ascending or descending).
      name: sort_order
      predefined:
      - asc
      - desc
    - defaultValue: '50'
      description: Maximal number of results.
      name: limit
    description: Gets security alerts for a given asset.
    name: exabeam-list-security-alerts-by-asset
    outputs:
    - contextPath: Exabeam.AssetSecurityAlert.process
      description: Process of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.process_name
      description: Process name of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.alert_name
      description: Name of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.alert_type
      description: Type of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.alert_severity
      description: Severity of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.malware_url
      description: Malware URL of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.event_id
      description: Event ID of the asset.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.event_type
      description: Type of the event.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.time
      description: Time when the event occurred.
      type: Date
    - contextPath: Exabeam.AssetSecurityAlert.rawlog_time
      description: Raw log time of the security alert.
      type: Date
    - contextPath: Exabeam.AssetSecurityAlert.session_id
      description: Session ID of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.session_order
      description: Session order of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.src_host
      description: Source host of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.src_ip
      description: Source IP of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.src_port
      description: Source port of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.dest_host
      description: Destination host of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.dest_ip
      description: Destination IP of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.dest_port
      description: Destination port of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.user
      description: User of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.host
      description: Host of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.domain
      description: Domain of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.account
      description: Account of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.hash
      description: Hash of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.MD5
      description: MD5 of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.entity_asset_id
      description: Entity asset ID of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.source
      description: Source of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.vendor
      description: Vendor of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.sensor_id
      description: Sensor ID of the alert.
      type: Boolean
    - contextPath: Exabeam.AssetSecurityAlert.local_asset
      description: Local asset of the security alert.
      type: String
    - contextPath: Exabeam.AssetSecurityAlert.additional_info
      description: Additional information about the security alert.
      type: String
  - arguments:
    - description: The search keyword.
      name: keyword
      required: true
    - description: The search filter.
      name: filter
    - defaultValue: '50'
      description: Maximal number of rules to retrieve.
      name: limit
    - defaultValue: '0'
      description: Results page number.
      name: page
    description: Searches for rules by a keyword.
    name: exabeam-search-rules
    outputs:
    - contextPath: Exabeam.Rule.categoryId
      description: Category ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.categoryDisplayName
      description: Category display name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleId
      description: ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleName
      description: Name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleDescription
      description: Description of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.reasonTemplate
      description: Reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.aggregateReasonTemplate
      description: Aggregate reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleType
      description: Type of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.classifyIf
      description: Classification definition of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleEventTypes
      description: Event types of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.modelName
      description: Model name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.factFeatureName
      description: Fact feature name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.hasDynamicScore
      description: Whether or not the rule has a dynamic score.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.score
      description: Score of the rule.
      type: Number
    - contextPath: Exabeam.Rule.ruleDef.percentileThreshold
      description: Percentile threshold of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleExpression
      description: The rule expression.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.dependencyExpression
      description: The rule dependency expression.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleCategory
      description: The category of the rule.
      type: String
    - contextPath: Exabeam.Rule.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.effective
      description: True if the rule is effective, false otherwise.
      type: Boolean
    - contextPath: Exabeam.Rule.state
      description: State of the rule (DefaultExabeam, ModifiedExabeam or CustomerCreated).
      type: String
    - contextPath: Exabeam.Rule.canSimpleEdit
      description: Whether or not it is possible to use the simple editor on this rule.
      type: Boolean
  - arguments:
    - description: The ID of the rule.
      name: rule_id
      required: true
    description: Gets a rule's information as a string.
    name: exabeam-get-rule-string
    outputs:
    - contextPath: Exabeam.Rule.ruleId
      description: The ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleString
      description: The rule string.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: all
      description: The type of the rules to retrieve.
      name: filter_by
      predefined:
      - all
      - custom
      - default
    - defaultValue: '0'
      description: Which page of results to return.
      name: page
    - defaultValue: '50'
      description: Maximal number of results.
      name: limit
    description: Gets all rules.
    name: exabeam-fetch-rules
    outputs:
    - contextPath: Exabeam.Rule.categoryId
      description: Category ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.categoryDisplayName
      description: Category display name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleId
      description: ID of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleName
      description: Name of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleDescription
      description: Description of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.reasonTemplate
      description: Reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.aggregateReasonTemplate
      description: Aggregate reason template of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleType
      description: Type of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.classifyIf
      description: Classification expression definition of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleEventTypes
      description: Event types of the rule.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.modelName
      description: Model name that the rule references.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.factFeatureName
      description: The name of a feature used for fact based rules.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.hasDynamicScore
      description: Whether or not the rule has a dynamic score.
      type: Boolean
    - contextPath: Exabeam.Rule.ruleDef.score
      description: Score of the rule.
      type: Number
    - contextPath: Exabeam.Rule.ruleDef.percentileThreshold
      description: Indicates which observations are considered anomalous based on the histogram.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleExpression
      description: A boolean expression that the rule engine uses to determine if a particular rule will trigger.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.dependencyExpression
      description: The rule dependency expression.
      type: String
    - contextPath: Exabeam.Rule.ruleDef.ruleCategory
      description: The category of the rule.
      type: String
    - contextPath: Exabeam.Rule.disabled
      description: Whether or not the rule is disabled.
      type: Boolean
    - contextPath: Exabeam.Rule.effective
      description: True if the rule is effective, false otherwise.
      type: Boolean
    - contextPath: Exabeam.Rule.state
      description: State of the rule (DefaultExabeam, ModifiedExabeam or CustomerCreated).
      type: String
    - contextPath: Exabeam.Rule.canSimpleEdit
      description: Whether or not it is possible to use the simple editor on this rule.
      type: Boolean
  - arguments:
    - description: The name of the model.
      name: model_name
      required: true
    description: Gets a rule model definition by name.
    name: exabeam-get-rules-model-definition
    outputs:
    - contextPath: Exabeam.Model.alpha
      description: Alpha value of the model.
      type: String
    - contextPath: Exabeam.Model.name
      description: Name of the model.
      type: String
    - contextPath: Exabeam.Model.feature
      description: Feature of the model.
      type: String
    - contextPath: Exabeam.Model.cutOff
      description: Cut off value of the model.
      type: String
    - contextPath: Exabeam.Model.histogramEventTypes
      description: Histogram event types of the model.
      type: String
    - contextPath: Exabeam.Model.featureName
      description: Feature name of the model.
      type: String
    - contextPath: Exabeam.Model.description
      description: Description of the model.
      type: String
    - contextPath: Exabeam.Model.trainIf
      description: Train if expression definition of the model.
      type: String
    - contextPath: Exabeam.Model.featureType
      description: Feature type of the model.
      type: String
    - contextPath: Exabeam.Model.modelTemplate
      description: The model template.
      type: String
    - contextPath: Exabeam.Model.convergenceFilter
      description: Convergence filter of the model.
      type: String
    - contextPath: Exabeam.Model.iconName
      description: Icon name of the model.
      type: String
    - contextPath: Exabeam.Model.modelType
      description: Type of the model.
      type: String
    - contextPath: Exabeam.Model.binWidth
      description: The bin width.
      type: String
    - contextPath: Exabeam.Model.maxNumberOfBins
      description: The maximal number of bins.
      type: String
    - contextPath: Exabeam.Model.scopeType
      description: The scope type of the model.
      type: String
    - contextPath: Exabeam.Model.agingWindow
      description: Aging window of the model.
      type: String
    - contextPath: Exabeam.Model.category
      description: The model category.
      type: String
    - contextPath: Exabeam.Model.disabled
      description: TRUE if the model is disabled, FALSE otherwise.
      type: String
    - contextPath: Exabeam.Model.scopeValue
      description: The scope value of the model.
      type: String
  - arguments:
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    - description: A comma-separated list of the items to add.
      name: items
    - description: The entry ID of the CSV file.
      name: csv_entry_id
    - defaultValue: '50'
      description: Number of days until asset is automatically removed from the watchlist.
      name: watch_until_days
    - auto: PREDEFINED
      description: The item category.
      name: category
      predefined:
      - Anomalies
      - Assets
      - Events
      - Sessions
      - Users
      required: true
    description: Add watchlist items by their names or from a CSV file.
    name: exabeam-watchlist-add-items
  - arguments:
    - description: A keyword to search.
      name: keyword
      required: true
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    - defaultValue: '30'
      description: Maximum nmber of results to retrieve.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether or not the item is exclusive on watchlist.
      name: is_exclusive
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether or not to search the item by its IP.
      name: search_by_ip
      predefined:
      - 'true'
      - 'false'
    description: Gets the assets of a specified watchlist according to a keyword.
    name: exabeam-watchlist-asset-search
    outputs:
    - contextPath: Exabeam.AssetInfo.hostName
      description: Host of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.ipAddress
      description: IP address of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.assetType
      description: Type of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.firstSeen
      description: Time when the asset was first seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.lastSeen
      description: Time when the asset was last seen.
      type: Date
    - contextPath: Exabeam.AssetInfo.riskScore
      description: Risk score of the asset.
      type: Number
    - contextPath: Exabeam.AssetInfo.riskState
      description: Risk state of the asset.
      type: String
    - contextPath: Exabeam.AssetInfo.zone
      description: Zone of the asset.
      type: String
  - arguments:
    - description: The watchlist ID.
      name: watchlist_id
      required: true
    - description: A comma-separated list of the items to remove.
      isArray: true
      name: items
      required: true
    - auto: PREDEFINED
      description: The category of the items to remove.
      name: category
      predefined:
      - Anomalies
      - Assets
      - Events
      - Sessions
      - Users
      required: true
    description: Removes items from a watchlist.
    name: exabeam-watchlist-remove-items
  - arguments:
    - description: The name of the context table.
      name: context_table_name
      required: true
    - defaultValue: '50'
      description: Maximum number of results to return.
      name: limit
    - defaultValue: '1'
      description: The offset number to begin (starts from 1).
      name: offset
    description: Returns a list of a context table records.
    name: exabeam-list-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTable.Name
      description: Name of the context table.
      type: String
    - contextPath: Exabeam.ContextTable.Record.key
      description: The key of the record.
      type: String
    - contextPath: Exabeam.ContextTable.Record.id
      description: The ID of the record.
      type: String
    - contextPath: Exabeam.ContextTable.Record.sourceType
      description: The source type of the record.
      type: String
    - contextPath: Exabeam.ContextTable.Record.position
      description: The position of the record.
      type: Number
    - contextPath: Exabeam.ContextTable.Record.value
      description: Value of the record.
      type: String
  - arguments:
    - description: The name of the context table.
      name: context_table_name
      required: true
    - description: 'A comma-separated list of records to add, for example: k1,k2. If context_table_type argument is set to key_value, every record should be in "key:values" format, where "values" is a semi-colon separated list of values. For example: k1:v1;v2,k2:v3,k3:,k4:v4.'
      name: records
      required: true
    - description: The ID of update session. If not specified, a new session is created.
      name: session_id
    - auto: PREDEFINED
      description: The context table type.
      name: context_table_type
      predefined:
      - key_only
      - key_value
      required: true
    description: Add records to the context table.
    name: exabeam-add-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTableUpdate.contextTableName
      description: The context table name.
      type: String
    - contextPath: Exabeam.ContextTableUpdate.sessionId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeType
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.key
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.value
      description: The raw data of the context table update.
      type: Unknown
  - arguments:
    - description: The name of the context table.
      name: context_table_name
      required: true
    - description: The ID of update session. If not specified, a new session is created.
      name: session_id
    - description: 'A comma-separated list of records to update. If context_table_type argument is set to key_only, each record should be in the following format: id:key. Otherwise it''s a key_value type and then the format of a record is id:key:values, where the values are separated by semi-colons.'
      name: records
      required: true
    - auto: PREDEFINED
      description: Type of the context table.
      name: context_table_type
      predefined:
      - key_only
      - key_value
      required: true
    description: Updates records of a context table.
    name: exabeam-update-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTableUpdate.contextTableName
      description: The context table name.
      type: String
    - contextPath: Exabeam.ContextTableUpdate.sessionId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeType
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.key
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.value
      description: The raw data of the context table update.
      type: Unknown
  - arguments:
    - description: Name of the context table.
      name: context_table_name
      required: true
    description: Export a context table to CSV.
    name: exabeam-get-context-table-in-csv
  - arguments:
    - description: Name of the context table.
      name: context_table_name
      required: true
    - description: The ID of the context table session. If not specified, a new session is created.
      name: session_id
    - auto: PREDEFINED
      description: Indicates whether the file has a header.
      name: has_header
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The entry ID of the CSV file from which records will be added.
      name: file_entry_id
      required: true
    - auto: PREDEFINED
      defaultValue: append
      description: Whether to replace or append the records from the CSV file.
      name: append_or_replace
      predefined:
      - append
      - replace
    description: Add context table records from CSV file in a specific modification session.
    name: exabeam-add-context-table-records-from-csv
  - arguments:
    - description: Name of the context table.
      name: context_table_name
      required: true
    - description: A comma-separated list of the records' keys to delete.
      name: records
      required: true
    - description: The ID of update session. If not specified, a new session is created.
      name: session_id
    description: Delete records from a context table.
    name: exabeam-delete-context-table-records
    outputs:
    - contextPath: Exabeam.ContextTableUpdate.contextTableName
      description: The context table name.
      type: String
    - contextPath: Exabeam.ContextTableUpdate.sessionId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeType
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.changeId
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.key
      description: The raw data of the context table update.
      type: Unknown
    - contextPath: Exabeam.ContextTableUpdate.record.value
      description: The raw data of the context table update.
      type: Unknown
  - arguments:
    - description: The maximum number of returned results.
      name: limit
      required: true
    - description: The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on.
      isArray: true
      name: time_period
      required: true
    description: Returns notable assets.
    name: exabeam-get-notable-assets
    outputs:
    - contextPath: Exabeam.NotableAsset.HostName
      description: The notable asset host name.
      type: String
    - contextPath: Exabeam.NotableAsset.IPAddress
      description: The notable asset IP address.
      type: String
    - contextPath: Exabeam.NotableAsset.AssetType
      description: The notable asset type.
      type: String
    - contextPath: Exabeam.NotableAsset.FirstSeen
      description: Time when the asset was first seen.
      type: Date
    - contextPath: Exabeam.NotableAsset.LastSeen
      description: Time when the asset was last seen.
      type: Date
    - contextPath: Exabeam.NotableAsset.highestRiskScore
      description: The highest risk score of the asset.
      type: Number
    - contextPath: Exabeam.NotableAsset.id
      description: The notable asset ID.
      type: String
    - contextPath: Exabeam.NotableAsset.entityName
      description: The entity name of the asset.
      type: String
    - contextPath: Exabeam.NotableAsset.entityValue
      description: The entity value of the asset.
      type: String
    - contextPath: Exabeam.NotableAsset.day
      description: The notable asset date.
      type: Date
    - contextPath: Exabeam.NotableAsset.triggeredRuleCountOpt
      description: The number that asset triggered rule count opt.
      type: Number
    - contextPath: Exabeam.NotableAsset.riskScoreOpt
      description: Risk score opt of the asset.
      type: Number
    - contextPath: Exabeam.NotableAsset.incidentIds
      description: The incident IDs of the notable asset.
      type: Unknown
    - contextPath: Exabeam.NotableAsset.commentId
      description: The comment ID of the notable asset.
      type: String
    - contextPath: Exabeam.NotableAsset.commentType
      description: The comment type of the notable asset.
      type: String
    - contextPath: Exabeam.NotableAsset.commentObjectId
      description: The comment object ID of the notable asset.
      type: String
    - contextPath: Exabeam.NotableAsset.text
      description: The notable asset text.
      type: String
    - contextPath: Exabeam.NotableAsset.exaUser
      description: The notable asset exaUser.
      type: String
    - contextPath: Exabeam.NotableAsset.exaUserFullname
      description: The notable asset exaUser fullname.
      type: String
    - contextPath: Exabeam.NotableAsset.createTime
      description: Time when the asset was created.
      type: Date
    - contextPath: Exabeam.NotableAsset.updateTime
      description: Time when the asset was updated.
      type: Date
    - contextPath: Exabeam.NotableAsset.edited
      description: Whether or not the notable asset is edited.
      type: Boolean
    - contextPath: Exabeam.NotableAsset.zone
      description: The number that asset triggered rule count opt.
      type: String
  - arguments:
    - description: ID of the asset to fetch info for.
      name: asset_id
      required: true
    - auto: PREDEFINED
      defaultValue: date
      description: The key to sort results by.
      name: sort_by
      predefined:
      - date
      - riskScore
    - auto: PREDEFINED
      defaultValue: desc
      description: The order of the results (ascending or descending).
      name: sort_order
      predefined:
      - asc
      - desc
    - defaultValue: '50'
      description: Maximum number of results.
      name: limit
    description: Returns notable session details.
    name: exabeam-get-notable-session-details
    outputs:
    - contextPath: Exabeam.NotableSession.users.UserName
      description: The notable session user name.
      type: String
    - contextPath: Exabeam.NotableSession.users.RiskScore
      description: The notable session risk score.
      type: number
    - contextPath: Exabeam.NotableSession.users.AverageRiskScore
      description: The average risk score of the notable session.
      type: number
    - contextPath: Exabeam.NotableSession.users.FirstSeen
      description: Time when the notable session was first seen.
      type: Date
    - contextPath: Exabeam.NotableSession.users.LastSeen
      description: Time when the notable session was last seen.
      type: Date
    - contextPath: Exabeam.NotableSession.users.lastActivityType
      description: The last activity type of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Labels
      description: The labels of the user.
      type: Unknown
    - contextPath: Exabeam.NotableSession.users.LastSessionID
      description: The last session ID of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.EmployeeType
      description: The employee type of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Department
      description: The department of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Title
      description: The role of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Location
      description: The location of the user.
      type: String
    - contextPath: Exabeam.NotableSession.users.Email
      description: The email of the user.
      type: String
    - contextPath: Exabeam.NotableSession.sessions.SessionID
      description: The Session ID.
      type: String
    - contextPath: Exabeam.NotableSession.sessions.InitialRiskScore
      description: Initial risk score of the session.
      type: Number
    - contextPath: Exabeam.NotableSession.sessions.LoginHost
      description: The host from which the user was logged in.
      type: String
    - contextPath: Exabeam.NotableSession.sessions.Accounts
      description: Accounts in the session.
      type: String
    - contextPath: Exabeam.NotableSession.executiveUserFlags
      description: Whether the user is a executive user.
      type: Unknown
  - arguments:
    - description: The asset ID for which to fetch data.
      name: asset_id
      required: true
    - description: The Start time of the time range. For example, 2018-08-01T11:50:16.
      name: start_time
    - description: The end time of the time range. For example, 2018-08-01T11:50:16.
      name: end_time
    - defaultValue: '50'
      description: Maximum number of rules to retrieve.
      name: limit
    - defaultValue: '0'
      description: Results page number.
      name: page
    description: Returns sequence details for the given asset ID and time range.
    name: exabeam-get-notable-sequence-details
    outputs:
    - contextPath: Exabeam.Sequence.sequenceId
      description: The ID of the sequence.
      type: String
    - contextPath: Exabeam.Sequence.isWhitelisted
      description: Whether or not the sequence is on allow list.
      type: Boolean
    - contextPath: Exabeam.Sequence.areAllTriggeredRulesWhiteListed
      description: Whether or not the sequence are all triggered rules allow listed.
      type: Boolean
    - contextPath: Exabeam.Sequence.hasBeenPartiallyWhiteListed
      description: Whether or not the sequence has been partially allow listed.
      type: Boolean
    - contextPath: Exabeam.Sequence.riskScore
      description: The sequence risk score.
      type: Number
    - contextPath: Exabeam.Sequence.startTime
      description: Start time of the sequence.
      type: Date
    - contextPath: Exabeam.Sequence.endTime
      description: End time of the sequence.
      type: Date
    - contextPath: Exabeam.Sequence.numOfReasons
      description: Number of reasons in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfEvents
      description: Number of events in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfUsers
      description: Number of users in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfSecurityEvents
      description: Number of security events in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfZones
      description: Number of zones in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.numOfAssets
      description: Number of assets in the sequence.
      type: Number
    - contextPath: Exabeam.Sequence.assetId
      description: The asset ID of the sequence.
      type: String
  - arguments:
    - description: The asset sequence ID.
      name: asset_sequence_id
      required: true
    - description: String to search for inside display name.
      name: search_str
    - defaultValue: '50'
      description: Maximum number of rules to retrieve.
      name: limit
    - defaultValue: '0'
      description: Results page number.
      name: page
    description: Returns sequence event types for the given asset sequence ID and time range.
    name: exabeam-get-sequence-eventtypes
    outputs:
    - contextPath: Exabeam.SequenceEventTypes.eventType
      description: The sequence event type.
      type: String
    - contextPath: Exabeam.SequenceEventTypes.displayName
      description: The sequence display name.
      type: String
    - contextPath: Exabeam.SequenceEventTypes.count
      description: The number of the sequences.
      type: Number
    - contextPath: Exabeam.SequenceEventTypes.sequenceId
      description: The sequence ID.
      type: String
  - arguments:
    - description: The incident ID.
      isArray: true
      name: incident_id
    - description: |
        The query string that will be used to filter incidents in Exabeam
        For example:
        - simple query: incidentType:generic,
        - OR query: "status:new OR status:closedFalsePositive",
        - AND query:  "status:new AND priority:high".
      name: query
    - auto: PREDEFINED
      description: Incident type to filter in Exabeam.
      predefined:
      - "generic"
      - "abnormalAuth"
      - "accountManipulation"
      - "accountTampering"
      - "ueba"
      - "bruteForce"
      - "compromisedCredentials"
      - "cryptomining"
      - "dataAccessAbuse"
      - "dataExfiltration"
      - "dlp"
      - "departedEmployee"
      - "dataDestruction"
      - "evasion"
      - "lateralMovement"
      - "alertTriage"
      - "malware"
      - "phishing"
      - "privilegeAbuse"
      - "physicalSecurity"
      - "privilegeEscalation"
      - "privilegedActivity"
      - "ransomware"
      - "workforceProtection"
      name: incident_type
    - auto: PREDEFINED
      description: Incident priority to filter in Exabeam.
      predefined:
      - "low"
      - "medium"
      - "high"
      - "critical"
      name: priority
    - auto: PREDEFINED
      description: Incident status to filter in Exabeam.
      predefined:
      - "closed"
      - "closedFalsePositive"
      - "inprogress"
      - "new"
      - "pending"
      - "resolved"
      name: status
    - description: Number of total results to query. Default is 50.
      name: limit
    - description: Specific page to query.
      name: page_number
    - description: Number of total results in each page. Default is 25.
      name: page_size
    - description: When the instance is configure by an API key, it must be used with the username argument.
      name: username
    description: Returns incidents from Exabeam.
    name: exabeam-list-incident
    outputs:
    - contextPath: Exabeam.incidents.incidentId
      description: The incident ID.
      type: String
    - contextPath: Exabeam.incidents.name
      description: The incident name.
      type: String
    - contextPath: Exabeam.incidents.fields.startedDate
      description: The starting date of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.closedDate
      description: The closing date of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.createdAt
      description: The creation date of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.owner
      description: The incident owner.
      type: String
    - contextPath: Exabeam.incidents.fields.status
      description: The incident status.
      type: String
    - contextPath: Exabeam.incidents.fields.incidentType
      description: The incident type.
      type: String
    - contextPath: Exabeam.incidents.fields.source
      description: The incident source.
      type: String
    - contextPath: Exabeam.incidents.fields.priority
      description: The incident priority.
      type: String
    - contextPath: Exabeam.incidents.fields.queue
      description: The queue of the incident.
      type: String
    - contextPath: Exabeam.incidents.fields.description
      description: The incident description.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Exabeam - Test
fromversion: 5.0.0
defaultclassifier: "Exabeam Classifier"
defaultmapperin: "Exabeam mapping"