ExabeamSecOpsPlatform

Exabeam Security Operations Platform offers a centralized and scalable platform for log management.

Analytics & SIEM · Exabeam Security Operations Platform

Details

IDExabeamSecOpsPlatform
ProviderExabeam
CategoryAnalytics & SIEM
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Exabeam Security Operations Platform offers a centralized and scalable platform for log management.
This integration was integrated and tested with version v1.0 of ExabeamSecOpsPlatform.

Configure Exabeam Security Operations Platform in Cortex

Parameter Description Required
Server URL   True
Client ID   True
Client Secret   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch incidents Supported on Cortex XSOAR only. False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) Supported on Cortex XSOAR only. False
Maximum Incidents Per Fetch Supported on Cortex XSOAR only. This value should not exceed 3,000 due to product’s API limitations. False
Fetch query Supported on Cortex XSOAR only. In the key:value. For example: NOT stage:"CLOSED". False
Incident type Supported on Cortex XSOAR only. False
Fetch events Supported on Cortex XSIAM only. False
Maximum Number of Cases Per Fetch Supported on Cortex XSIAM only. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

exabeam-platform-event-search

Get events from Exabeam Security Operations Platform.

Base Command

exabeam-platform-event-search

Input

Argument Name Description Required
start_time The starting date for the search range. Required
end_time The ending date for the search range. Required
query Query, using Lucene syntax, filters log data for precise analysis, without escaping and with values unquoted. e.g., query=”product: Correlation Rule AND rule_severity: High”. Optional
fields Comma-separated list of fields to be returned from the search. Optional
group_by Comma-separated list of fields by which to group the results. Optional
limit The maximal number of results to return. Maximum value is 3000. Optional

Context Output

Path Type Description
ExabeamPlatform.Event.id String The unique identifier associated with the event.
ExabeamPlatform.Event.rawLogIds String The raw log identifiers associated with the event.
ExabeamPlatform.Event.tier String The tier associated with the event.
ExabeamPlatform.Event.parsed String Whether the event has been parsed.
ExabeamPlatform.Event.rawLogs String The raw logs associated with the event.

Command example

!exabeam-platform-event-search end_time="today" start_time="7 days ago" limit=2 query="product: Correlation Rule AND rule_severity: High"

Context Example

{
    "ExabeamPlatform": {
        "Event": [
            {
                "approxLogTime": 1715694190909000,
                "collector_timestamp": 1715694190909000,
                "customFieldsJSON": "{}",
                "id": "fake",
                "ingest_time": 1715694222815000,
                "metadataFieldsJSON": "{\"m_collector_id\":\"aae1627e-8637-4597-9f43-e49a703a6151\",\"m_collector_name\":\"exa-cribl-logs-sm_exa_ws\",\"m_collector_type\":\"cribl-logs\"}",
                "parsed": false,
                "rawLogIds": [
                    "log-fic"
                ],
                "rawLogs": [
                    "ANY rawLog"
                ],
                "raw_log_size": 9,
                "tier": "Tier 4"
            },
            {
                "approxLogTime": 1715694915916000,
                "collector_timestamp": 1715694915916000,
                "customFieldsJSON": "{}",
                "id": "fictive-id",
                "ingest_time": 1715694946775000,
                "metadataFieldsJSON": "{\"m_collector_id\":\"aae1627e-8637-4597-9f43-e49a703a6151\",\"m_collector_name\":\"exa-cribl-logs-sm_exa_ws\",\"m_collector_type\":\"cribl-logs\"}",
                "parsed": false,
                "rawLogIds": [
                    "rawLogId"
                ],
                "rawLogs": [
                    "CONNECT hotmail"
                ],
                "raw_log_size": 59,
                "tier": "Tier 4"
            }
        ]
    }
}

Human Readable Output

Logs

Id Is Parsed Raw Log Ids Raw Logs Tier
fake false log-fic ANY rawLog Tier 4
fictive-id false rawLogId CONNECT hotmail Tier 4

exabeam-platform-table-record-list

Retrieve the records for a specific context table.

Base Command

exabeam-platform-table-record-list

Input

Argument Name Description Required
table_id ID of the table. Obtain this value by running exabeam-platform-context-table-list. Required
limit The number of records to return. Default is 50. Optional

Context Output

There is no context output for this command.

exabeam-platform-table-record-create

Add one or more context records directly to an existing table.

Base Command

exabeam-platform-table-record-create

Input

Argument Name Description Required
table_id ID of the table. Obtain this value by running exabeam-platform-context-table-list. Required
attributes A key-value map of record attributes. Required
operation Options for how data should be uploaded to an existing table. Possible values are: append, replace. Default is append. Optional
interval_in_seconds The interval in seconds between each poll. Default is 30. Optional
timeout The timeout in seconds until polling ends. Default is 600. Optional
tracker_id Specify the tracker ID from an upload request whose progress you want to track. Optional
hide_polling_output Suppresses the output of polling operations to reduce clutter in logs. Optional

Context Output

There is no context output for this command.

exabeam-platform-alert-search

Search for alerts that match one or more search criteria.

Base Command

exabeam-platform-alert-search

Input

Argument Name Description Required
alert_id Unique ID that identifies an alert. Optional
start_time Timestamp to start the search. Default is 7 days ago. Optional
end_time Timestamp to end the search. Default is today. Optional
query Query, using Lucene syntax, filters log data for precise analysis. Optional
fields List of fields to be returned from the search. Optional
order_by Order results by a specified field in ASC or DESC order, such as “riskScore ASC” or “riskScore DESC”. Optional
limit Limit the number of results returned from the search request. Default is 50. Optional
all_results If set to ‘True’, retrieves all available results, ignoring the limit parameter. Possible values are: True, False. Default is False. Optional
include_related_rules If set to ‘True’, filters the context to include the “rules” array related to the cases in the results. Possible values are: True, False. Default is False. Optional

Context Output

Path Type Description
ExabeamPlatform.Alert.alertDescriptionRt String The description of the alert in real-time.
ExabeamPlatform.Alert.alertId String The unique identifier of the alert.
ExabeamPlatform.Alert.alertName String The name or title of the alert.
ExabeamPlatform.Alert.approxLogTime Date The approximate log time of the alert.
ExabeamPlatform.Alert.assignee String The person assigned to the alert.
ExabeamPlatform.Alert.caseCreationTimestamp Number The timestamp when the case was created.
ExabeamPlatform.Alert.caseId String The unique identifier of the case associated with the alert.
ExabeamPlatform.Alert.creationBy String The user who created the alert.
ExabeamPlatform.Alert.creationTimestamp Date The timestamp when the alert was created.
ExabeamPlatform.Alert.destEndpoints Unknown The destination endpoints involved in the alert.
ExabeamPlatform.Alert.destHosts Unknown The destination hosts involved in the alert.
ExabeamPlatform.Alert.destIps Unknown The destination IP addresses involved in the alert.
ExabeamPlatform.Alert.groupedbyKey String The key used for grouping the alert.
ExabeamPlatform.Alert.groupedbyValue String The value used for grouping the alert.
ExabeamPlatform.Alert.groupingRuleId String The ID of the rule used for grouping the alert.
ExabeamPlatform.Alert.hasAttachments Boolean Indicates if the alert has attachments.
ExabeamPlatform.Alert.ingestTimestamp Date The timestamp when the alert was ingested into the system.
ExabeamPlatform.Alert.lastModifiedBy String The user who last modified the alert.
ExabeamPlatform.Alert.lastModifiedTimestamp Date The timestamp when the alert was last modified.
ExabeamPlatform.Alert.mitres.tactic String The MITRE tactic associated with the alert.
ExabeamPlatform.Alert.mitres.tacticKey String The MITRE tactic key associated with the alert.
ExabeamPlatform.Alert.mitres.technique String The MITRE technique associated with the alert.
ExabeamPlatform.Alert.mitres.techniqueKey String The MITRE technique key associated with the alert.
ExabeamPlatform.Alert.priority String The priority level of the alert.
ExabeamPlatform.Alert.products String The products involved in the alert.
ExabeamPlatform.Alert.queue String The queue in which the alert is placed.
ExabeamPlatform.Alert.riskScore Number The risk score associated with the alert.
ExabeamPlatform.Alert.srcEndpoints.ip String The IP addresses of the source endpoints involved in the alert.
ExabeamPlatform.Alert.srcHosts Unknown The source hosts involved in the alert.
ExabeamPlatform.Alert.srcIps String The source IP addresses involved in the alert.
ExabeamPlatform.Alert.stage String The stage of the alert in the investigation process.
ExabeamPlatform.Alert.status String The status of the alert.
ExabeamPlatform.Alert.subscriptionCode String The subscription code associated with the alert.
ExabeamPlatform.Alert.tags Unknown The tags associated with the alert.
ExabeamPlatform.Alert.useCases String The use cases related to the alert.
ExabeamPlatform.Alert.users Unknown The users involved in the alert.
ExabeamPlatform.Alert.vendors String The vendors associated with the alert.

exabeam-platform-context-table-delete

Delete a specific context table, including records and attributes.

Base Command

exabeam-platform-context-table-delete

Input

Argument Name Description Required
table_id Specify the ID of an existing context table. Required
delete_unused_custom_attributes Delete any custom attributes in this table that are not used in another context table. Possible values are: True, False. Default is False. Optional

Context Output

There is no context output for this command.

exabeam-platform-context-table-list

Retrieve metadata for all existing context tables, including source, operational status, and attribute mapping.

Base Command

exabeam-platform-table-record-list

Input

Argument Name Description Required
table_id Specify the ID of an existing context table. Optional
limit Limit the number of results returned from the request. Default is 50. Optional
include_attributes If set to ‘True’, filters the context to include the “attributes” array related to the cases in the results. Possible values are: True, False. Default is False. Optional

Context Output

Path Type Description
ExabeamPlatform.ContextTable.attributeMapping Unknown The attribute mapping of the context table.
ExabeamPlatform.ContextTable.attributes.displayName String The display name of the attribute.
ExabeamPlatform.ContextTable.attributes.id String The unique identifier of the attribute.
ExabeamPlatform.ContextTable.attributes.isKey Boolean Indicates if the attribute is a key attribute.
ExabeamPlatform.ContextTable.attributes.type String The type of the attribute.
ExabeamPlatform.ContextTable.contextType String The type of context the table represents.
ExabeamPlatform.ContextTable.id String The unique identifier of the context table.
ExabeamPlatform.ContextTable.lastUpdated Number The timestamp of the last update to the context table.
ExabeamPlatform.ContextTable.name String The name of the context table.
ExabeamPlatform.ContextTable.source String The source of the context table data.
ExabeamPlatform.ContextTable.status String The status of the context table.
ExabeamPlatform.ContextTable.totalItems Number The total number of items in the context table.

exabeam-platform-case-search

Search for cases that match one or more search criteria. For example, you can search for cases that are associated with a specific caseId and that reference specific rules.

Base Command

exabeam-platform-case-search

Input

Argument Name Description Required
case_id An optional case id parameter to get a specific case. Optional
start_time Timestamp to start the search. Default is 7 days ago. Optional
end_time Timestamp to end the search. Default is today. Optional
query Query, using Lucene syntax, filters log data for precise analysis. Optional
fields List of fields to be returned from the search. Optional
order_by Order results by a specified field in ASC or DESC order, such as “riskScore ASC” or “riskScore DESC”. Optional
limit Limit the number of results returned from the search request. Default is 50. Optional
all_results If set to ‘True’, retrieves all available results, ignoring the limit parameter. Possible values are: True, False. Default is False. Optional
include_related_rules If set to ‘True’, filters the context to include the “rules” array related to the cases in the results. Possible values are: True, False. Default is False. Optional

Context Output

Path Type Description
ExabeamPlatform.Case.alertId String Unique identifier for the alert associated with the case.
ExabeamPlatform.Case.alertName String Name of the alert associated with the case.
ExabeamPlatform.Case.approxLogTime Number Approximate log time of the event that generated the case.
ExabeamPlatform.Case.assignee String User assigned to the case.
ExabeamPlatform.Case.caseCreationTimestamp Number Timestamp when the case was created.
ExabeamPlatform.Case.caseId String Unique identifier for the case.
ExabeamPlatform.Case.destHosts Unknown Destination hosts involved in the case.
ExabeamPlatform.Case.destIps Unknown Destination IP addresses involved in the case.
ExabeamPlatform.Case.groupedbyKey String Key by which the case was grouped.
ExabeamPlatform.Case.groupedbyValue String Value by which the case was grouped.
ExabeamPlatform.Case.hasAttachments Boolean Indicates if the case has attachments.
ExabeamPlatform.Case.ingestTimestamp Unknown Timestamp when the case was ingested.
ExabeamPlatform.Case.lastModifiedTimestamp Unknown Timestamp when the case was last modified.
ExabeamPlatform.Case.mitres Unknown MITRE tactics and techniques associated with the case.
ExabeamPlatform.Case.priority String Priority level of the case.
ExabeamPlatform.Case.products String Products involved in the case.
ExabeamPlatform.Case.queue String Queue to which the case is assigned.
ExabeamPlatform.Case.riskScore Number Risk score of the case.
ExabeamPlatform.Case.rules.approxLogTime Number Approximate log time of the rule that triggered the case.
ExabeamPlatform.Case.rules.ruleId String Unique identifier for the rule.
ExabeamPlatform.Case.rules.ruleName String Name of the rule that triggered the case.
ExabeamPlatform.Case.rules.ruleReason String Reason for the rule triggering the case.
ExabeamPlatform.Case.rules.ruleSeverity String Severity level of the rule.
ExabeamPlatform.Case.rules.ruleSource String Source of the rule.
ExabeamPlatform.Case.rules.ruleType String Type of the rule.
ExabeamPlatform.Case.srcHosts Unknown Source hosts involved in the case.
ExabeamPlatform.Case.srcIps Unknown Source IP addresses involved in the case.
ExabeamPlatform.Case.stage String Current stage of the case.
ExabeamPlatform.Case.subscriptionCode String Subscription code associated with the case.
ExabeamPlatform.Case.tags Unknown Tags associated with the case.
ExabeamPlatform.Case.useCases Unknown Use cases associated with the case.
ExabeamPlatform.Case.users Unknown Users involved in the case.
ExabeamPlatform.Case.vendors String Vendors involved in the case.
ExabeamPlatform.Case.alertCreationTimestamp Date Timestamp when the alert was created.
ExabeamPlatform.Case.alertDescriptionRt String Description of the alert.
ExabeamPlatform.Case.creationBy String User who created the case.
ExabeamPlatform.Case.creationTimestamp Date Timestamp when the case was created.
ExabeamPlatform.Case.destEndpoints Unknown Destination endpoints involved in the case.
ExabeamPlatform.Case.mitres.tacticKey String Key of the MITRE tactic associated with the case.
ExabeamPlatform.Case.mitres.technique String MITRE technique associated with the case.
ExabeamPlatform.Case.mitres.techniqueKey String Key of the MITRE technique associated with the case.

exabeam-platform-get-events

Get cases from Exabeam Security Operations Platform as Cortex XSIAM events. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.

Base Command

exabeam-platform-get-events

Input

Argument Name Description Required
start_time The starting date for the case search range. For example: yyyy-MM-ddThh:mm:ssZ. Default is 1 hour ago. Optional
end_time The ending date for the case search range. For example: yyyy-MM-ddThh:mm:ssZ. Default is now. Optional
limit The maximum number of results to return. Default is 10. Optional
should_push_events If true, the command will push the events to the Cortex XSIAM dataset. Otherwise, it will only display them. Default is false. Optional

Context Output

There is no context output for this command.

Command example

!exabeam-platform-get-events start_time="2025-08-30T00:27:53Z" limit=1 should_push_events=false

Human Readable Output

Events

_time alertId approxLogTime caseCreationTimestamp caseId caseNumber destHost destIp hasAttachments lastModifiedTimestamp mitres name priority product queue riskScore rules srcHost srcIp stage subscriptionCode tags useCases user vendor
2025-08-31T22:49:43Z 8ccd4479-aaaa-bbbb-9a29-aaed1b7e4d69 1756658220000000 1756680583393478 573d2e67-aaaa-bbbb-1122-11998166047e 1449     false 1756724116013483   Hello_world_rule HIGH Correlation Rule Tier 1 Analyst 200 [ ]     NEW 1234       Exabeam

exabeam-get-threat-summary

Retrieve the Copilot Threat Summary for an individual alert.

Base Command

exabeam-get-threat-summary

Input

Argument Name Description Required
alert_id The alertId to fetch a threat summary for. Required

Context Output

Path Type Description
ExabeamPlatform.Alert.Summary string Threat Summary of the Exabeam Alert.

exabeam-update-case-details

Update details for a specific case.

Base Command

exabeam-update-case-details

Input

Argument Name Description Required
case_id ID of the case to be updated. Required
alert_description Alert description in either plaintext or HTML format. Length <=1024. Optional
alert_name Alert name. Length <= 128. Optional
priority Alert priority. Possible values are: CRITICAL, HIGH, MEDIUM, LOW. Optional
stage Case stage. Possible values are: NEW, INVESTIGATION, REMEDIATION, CLOSED. Optional
closed_reason Reason for case closure. Possible values are: Already Mitigated or Resolved, False Positive or Duplicate, Low Risk, Rule Misconfiguration, Policy or Setup Issue, Other. Optional
supporting_reason Supporting reason for case closure. Optional
assignee Assignee for the case. Optional
queue Queue for the case. Optional

Context Output

There is no context output for this command.

exabeam-platform-list-case-notes

Retrieve a list of notes associated with the specified caseId.

Base Command

exabeam-platform-list-case-notes

Input

Argument Name Description Required
case_id Unique ID that identifies a case. Required

Context Output

There is no context output for this command.

exabeam-platform-create-case-note

Add a new note to the specified case.

Base Command

exabeam-platform-create-case-note

Input

Argument Name Description Required
case_id Unique ID that identifies a case. Required
note Note text. Required

Context Output

There is no context output for this command.

<~PLATFORM>

License Requirements

The following configuration parameters require the Cortex XSIAM license:

  • Fetch events

</~PLATFORM>

Configuration parameters

  • url — Server URL (required)
  • credentials — Client ID (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • isFetchEvents — Fetch events
  • incidentFetchInterval — Incidents Fetch Interval
  • eventFetchInterval — Events Fetch Interval
  • max_fetch — Maximum Incidents Per Fetch
  • max_events_fetch — Maximum Number of Cases Per Fetch
  • fetch_query — Fetch query
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • incidentType — Incident type

Commands (12)

  • exabeam-get-threat-summary

    Retrieve the Copilot Threat Summary for an individual alert.

  • exabeam-platform-alert-search

    Search for alerts that match one or more search criteria.

  • exabeam-platform-case-search

    Search for cases that match one or more search criteria. For example, you can search for cases that are associated with a specific case ID and that reference specific rules.

  • exabeam-platform-context-table-delete

    Delete a specific context table, including records and attributes.

  • exabeam-platform-context-table-list

    Retrieve metadata for all existing context tables, including source, operational status, and attribute mapping.

  • exabeam-platform-create-case-note

    Add a new note to the specified case.

  • exabeam-platform-event-search

    Get events from Exabeam Security Operations Platform.

  • exabeam-platform-get-events

    Get cases from Exabeam Security Operations Platform as Cortex XSIAM events. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.

  • exabeam-platform-list-case-notes

    Retrieve a list of notes associated with the specified caseId.

  • exabeam-platform-table-record-create

    Add one or more context records directly to an existing table.

  • exabeam-platform-table-record-list

    Retrieve the records for a specific context table.

  • exabeam-update-case-details

    Update details for a specific case.

Source

ExabeamSecOpsPlatform.py ExabeamSecOpsPlatform_test.py ExabeamSecOpsPlatform.yml ExabeamSecOpsPlatform_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: Exabeam
sectionorder:
- Connect
- Collect
commonfields:
  id: ExabeamSecOpsPlatform
  version: -1
configuration:
- defaultvalue: https://example.com/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Client ID
  name: credentials
  required: true
  section: Connect
  type: 9
  displaypassword: Client Secret
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  hidden:
  - marketplacev2
  - platform
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  advanced: true
  required: false
  section: Collect
  defaultvalue: '1'
  hidden:
  - marketplacev2
  - platform
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  advanced: true
  required: false
  defaultvalue: '1'
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Maximum Incidents Per Fetch
  additionalinfo: This value should not exceed 3,000 due to product's API limitations.
  name: max_fetch  # for fetch-incidents on XSOAR
  defaultvalue: 50
  type: 0
  section: Collect
  hidden:
    - marketplacev2
    - platform
- display: Maximum Number of Cases Per Fetch
  name: max_events_fetch  # for fetch-events on XSIAM and PLATFORM
  defaultvalue: 30000
  type: 0
  section: Collect
  hidden:
    - xsoar
  supportedModules:
  - xsiam
- display: Fetch query
  additionalinfo: 'In the `key:value` format. For example: `NOT stage:"CLOSED"`.'
  name: fetch_query
  type: 0
  section: Collect
  advanced: true
  hidden:
    - marketplacev2
    - platform
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  defaultvalue: 3 days
  type: 0
  section: Collect
  advanced: true
  hidden:
    - marketplacev2
    - platform
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
  hidden:
    - marketplacev2
    - platform
description: Exabeam Security Operations Platform offers a centralized and scalable platform for log management.
display: Exabeam Security Operations Platform
name: ExabeamSecOpsPlatform
script:
  commands:
  - arguments:
    - defaultValue: "7 days ago"
      description: The starting date for the search range.
      name: start_time
    - defaultValue: "today"
      description: The ending date for the search range.
      name: end_time
    - defaultValue: ""
      description: 'Query, using Lucene syntax, filters log data for precise analysis, without escaping and with values unquoted. e.g., query="product: Correlation Rule AND rule_severity: High".'
      name: query
      required: false
    - description: Comma-separated list of fields to be returned from the search.
      name: fields
      required: false
      isArray: true
    - description: Comma-separated list of fields by which to group the results.
      name: group_by
      isArray: true
      required: false
    - description: The maximal number of results to return. Maximum value is 3000.
      name: limit
      required: false
    description: Get events from Exabeam Security Operations Platform.
    name: exabeam-platform-event-search
    outputs:
    - contextPath: ExabeamPlatform.Event.id
      description: The unique identifier associated with the event.
      type: String
    - contextPath: ExabeamPlatform.Event.rawLogIds
      description: The raw log identifiers associated with the event.
      type: String
    - contextPath: ExabeamPlatform.Event.tier
      description: The tier associated with the event.
      type: String
    - contextPath: ExabeamPlatform.Event.parsed
      description: Whether the event has been parsed.
      type: String
    - contextPath: ExabeamPlatform.Event.rawLogs
      description: The raw logs associated with the event.
      type: String
  - name: exabeam-platform-get-events
    description: Get cases from Exabeam Security Operations Platform as Cortex XSIAM events. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.
    arguments:
    - defaultValue: "1 hour ago"
      description: "The starting date for the case search range. For example: yyyy-MM-ddThh:mm:ssZ."
      name: start_time
    - defaultValue: "now"
      description: "The ending date for the case search range. For example: yyyy-MM-ddThh:mm:ssZ."
      name: end_time
    - description: The maximum number of results to return.
      name: limit
      defaultValue: "10"
    - description: If true, the command will push the events to the Cortex XSIAM dataset. Otherwise, it will only display them.
      name: should_push_events
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
  - name: exabeam-platform-case-search
    description: Search for cases that match one or more search criteria. For example, you can search for cases that are associated with a specific case ID and that reference specific rules.
    arguments:
    - name: case_id
      description: An optional case ID parameter to get a specific case.
    - name: start_time
      description: Timestamp to start the search.
      defaultValue: "7 days ago"
    - name: end_time
      description: Timestamp to end the search.
      defaultValue: today
    - name: query
      description: Query, using Lucene syntax, filters log data for precise analysis. For example 'priority:LOW AND NOT stage:NEW'.
      defaultValue: ""
    - name: fields
      description: List of fields to be returned from the search.
      isArray: true
      defaultValue: ""
    - name: order_by
      description: Order results by a specified field. The default ordering is ascending (ASC). To sort in descending order, use "DESC" after the field, for example, "riskScore DESC"."
      isArray: true
    - name: limit
      defaultValue: 50
      description: Limit the number of results returned from the search request.
    - name: all_results
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', retrieves all available results, ignoring the limit parameter.
    - name: include_related_rules
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', filters the context to include the "rules" array related to the cases in the results.
    outputs:
    - contextPath: ExabeamPlatform.Case.alertId
      description: Unique identifier for the alert associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.alertName
      description: Name of the alert associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.approxLogTime
      description: Approximate log time of the event that generated the case.
      type: Number
    - contextPath: ExabeamPlatform.Case.assignee
      description: User assigned to the case.
      type: String
    - contextPath: ExabeamPlatform.Case.caseCreationTimestamp
      description: Timestamp when the case was created.
      type: Number
    - contextPath: ExabeamPlatform.Case.caseId
      description: Unique identifier for the case.
      type: String
    - contextPath: ExabeamPlatform.Case.destHosts
      description: Destination hosts involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.destIps
      description: Destination IP addresses involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.groupedbyKey
      description: Key by which the case was grouped.
      type: String
    - contextPath: ExabeamPlatform.Case.groupedbyValue
      description: Value by which the case was grouped.
      type: String
    - contextPath: ExabeamPlatform.Case.hasAttachments
      description: Indicates if the case has attachments.
      type: Boolean
    - contextPath: ExabeamPlatform.Case.ingestTimestamp
      description: Timestamp when the case was ingested.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.lastModifiedTimestamp
      description: Timestamp when the case was last modified.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.mitres
      description: MITRE tactics and techniques associated with the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.priority
      description: Priority level of the case.
      type: String
    - contextPath: ExabeamPlatform.Case.products
      description: Products involved in the case.
      type: String
    - contextPath: ExabeamPlatform.Case.queue
      description: Queue to which the case is assigned.
      type: String
    - contextPath: ExabeamPlatform.Case.riskScore
      description: Risk score of the case.
      type: Number
    - contextPath: ExabeamPlatform.Case.rules.approxLogTime
      description: Approximate log time of the rule that triggered the case.
      type: Number
    - contextPath: ExabeamPlatform.Case.rules.ruleId
      description: Unique identifier for the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleName
      description: Name of the rule that triggered the case.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleReason
      description: Reason for the rule triggering the case.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleSeverity
      description: Severity level of the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleSource
      description: Source of the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleType
      description: Type of the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.srcHosts
      description: Source hosts involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.srcIps
      description: Source IP addresses involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.stage
      description: Current stage of the case.
      type: String
    - contextPath: ExabeamPlatform.Case.subscriptionCode
      description: Subscription code associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.tags
      description: Tags associated with the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.useCases
      description: Use cases associated with the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.users
      description: Users involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.vendors
      description: Vendors involved in the case.
      type: String
    - contextPath: ExabeamPlatform.Case.alertCreationTimestamp
      description: Timestamp when the alert was created.
      type: Date
    - contextPath: ExabeamPlatform.Case.alertDescriptionRt
      description: Description of the alert.
      type: String
    - contextPath: ExabeamPlatform.Case.creationBy
      description: User who created the case.
      type: String
    - contextPath: ExabeamPlatform.Case.creationTimestamp
      description: Timestamp when the case was created.
      type: Date
    - contextPath: ExabeamPlatform.Case.destEndpoints
      description: Destination endpoints involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.mitres.tacticKey
      description: Key of the MITRE tactic associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.mitres.technique
      description: MITRE technique associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.mitres.techniqueKey
      description: Key of the MITRE technique associated with the case.
      type: String
  - name: exabeam-platform-alert-search
    description: Search for alerts that match one or more search criteria.
    arguments:
    - name: alert_id
      description: Unique ID that identifies an alert.
    - name: start_time
      description: Timestamp to start the search.
      defaultValue: "7 days ago"
    - name: end_time
      description: Timestamp to end the search.
      defaultValue: today
    - name: query
      description: Query, using Lucene syntax, filters log data for precise analysis. For example 'priority:LOW'.
      defaultValue: ""
    - name: fields
      description: List of fields to be returned from the search.
      isArray: true
      defaultValue: ""
    - name: order_by
      description: Order results by a specified field. The default ordering is ascending (ASC). To sort in descending order, use "DESC" after the field, for example, "riskScore DESC"."
      isArray: true
    - name: limit
      defaultValue: 50
      description: Limit the number of results returned from the search request.
    - name: all_results
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', retrieves all available results, ignoring the limit parameter.
    - name: include_related_rules
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', filters the context to include the "rules" array related to the cases in the results.
    outputs:
    - contextPath: ExabeamPlatform.Alert.alertDescriptionRt
      description: The description of the alert in real-time.
      type: String
    - contextPath: ExabeamPlatform.Alert.alertId
      description: The unique identifier of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.alertName
      description: The name or title of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.approxLogTime
      description: The approximate log time of the alert.
      type: Date
    - contextPath: ExabeamPlatform.Alert.assignee
      description: The person assigned to the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.caseCreationTimestamp
      description: The timestamp when the case was created.
      type: Number
    - contextPath: ExabeamPlatform.Alert.caseId
      description: The unique identifier of the case associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.creationBy
      description: The user who created the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.creationTimestamp
      description: The timestamp when the alert was created.
      type: Date
    - contextPath: ExabeamPlatform.Alert.destEndpoints
      description: The destination endpoints involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.destHosts
      description: The destination hosts involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.destIps
      description: The destination IP addresses involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.groupedbyKey
      description: The key used for grouping the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.groupedbyValue
      description: The value used for grouping the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.groupingRuleId
      description: The ID of the rule used for grouping the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.hasAttachments
      description: Indicates if the alert has attachments.
      type: Boolean
    - contextPath: ExabeamPlatform.Alert.ingestTimestamp
      description: The timestamp when the alert was ingested into the system.
      type: Date
    - contextPath: ExabeamPlatform.Alert.lastModifiedBy
      description: The user who last modified the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.lastModifiedTimestamp
      description: The timestamp when the alert was last modified.
      type: Date
    - contextPath: ExabeamPlatform.Alert.mitres.tactic
      description: The MITRE tactic associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.mitres.tacticKey
      description: The MITRE tactic key associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.mitres.technique
      description: The MITRE technique associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.mitres.techniqueKey
      description: The MITRE technique key associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.priority
      description: The priority level of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.products
      description: The products involved in the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.queue
      description: The queue in which the alert is placed.
      type: String
    - contextPath: ExabeamPlatform.Alert.riskScore
      description: The risk score associated with the alert.
      type: Number
    - contextPath: ExabeamPlatform.Alert.srcEndpoints.ip
      description: The IP addresses of the source endpoints involved in the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.srcHosts
      description: The source hosts involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.srcIps
      description: The source IP addresses involved in the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.stage
      description: The stage of the alert in the investigation process.
      type: String
    - contextPath: ExabeamPlatform.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.subscriptionCode
      description: The subscription code associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.tags
      description: The tags associated with the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.useCases
      description: The use cases related to the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.users
      description: The users involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.vendors
      description: The vendors associated with the alert.
      type: String
  - name: exabeam-platform-context-table-list
    description: Retrieve metadata for all existing context tables, including source, operational status, and attribute mapping.
    arguments:
    - name: table_id
      description: Specify the ID of an existing context table.
    - name: limit
      defaultValue: 50
      description: Limit the number of results returned from the request.
    - name: include_attributes
      description: If set to 'True', filters the context to include the "attributes" array related to the cases in the results.
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    outputs:
    - contextPath: ExabeamPlatform.ContextTable.attributeMapping
      description: The attribute mapping of the context table.
      type: Unknown
    - contextPath: ExabeamPlatform.ContextTable.attributes.displayName
      description: The display name of the attribute.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.attributes.id
      description: The unique identifier of the attribute.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.attributes.isKey
      description: 'Indicates if the attribute is a key attribute.'
      type: Boolean
    - contextPath: ExabeamPlatform.ContextTable.attributes.type
      description: The type of the attribute.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.contextType
      description: 'The type of context the table represents.'
      type: String
    - contextPath: ExabeamPlatform.ContextTable.id
      description: The unique identifier of the context table.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.lastUpdated
      description: The timestamp of the last update to the context table.
      type: Number
    - contextPath: ExabeamPlatform.ContextTable.name
      description: The name of the context table.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.source
      description: The source of the context table data.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.status
      description: The status of the context table.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.totalItems
      description: The total number of items in the context table.
      type: Number
  - name: exabeam-platform-context-table-delete
    description: Delete a specific context table, including records and attributes.
    arguments:
    - name: table_id
      description: Specify the ID of an existing context table.
      required: true
    - name: delete_unused_custom_attributes
      description: Delete any custom attributes in this table that are not used in another context table.
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
  - name: exabeam-platform-table-record-list
    description: Retrieve the records for a specific context table.
    arguments:
    - name: table_id
      description: ID of the table. Obtain this value by running `exabeam-platform-context-table-list`.
      required: true
    - name: limit
      defaultValue: 50
      description: The number of records to return.
    - name: page
      description: The page number to retrieve.
    - name: page_size
      description: The number of records per page, maximum value is '3000'. Default value is '50'.
  - name: exabeam-platform-table-record-create
    description: Add one or more context records directly to an existing table.
    arguments:
    - name: table_id
      description: ID of the table. Obtain this value by running `exabeam-platform-context-table-list`.
      required: true
    - name: attributes
      description: A dictionary mapping attribute names to their values, for example:`{"attributeName":["val1", "val2"]}`.
      required: true
      type: keyValue
    - name: operation
      description: Options for how data should be uploaded to an existing table.
      defaultValue: Append
      auto: PREDEFINED
      predefined:
      - Append
      - Replace
    - name: interval_in_seconds
      description: The interval in seconds between each poll.
      defaultValue: 30
    - name: timeout
      description: The timeout in seconds until polling ends.
      defaultValue: 600
    - name: tracker_id
      description: Specify the tracker ID from an upload request whose progress you want to track.
      hidden: true
    - name: hide_polling_output
      hidden: true
      description: Suppresses the output of polling operations to reduce clutter in logs.
    polling: true
  - arguments:
    - description: The alertId to fetch a threat summary for.
      name: alert_id
      required: true
    description: Retrieve the Copilot Threat Summary for an individual alert.
    name: exabeam-get-threat-summary
    outputs:
    - contextPath: ExabeamPlatform.Alert.Summary
      description: Threat Summary of the Exabeam Alert.
      type: string
  - arguments:
    - description: ID of the case to be updated.
      name: case_id
      required: true
    - description: Alert description in either plaintext or HTML format. Length <=1024.
      name: alert_description
    - description: Alert name. Length <= 128.
      name: alert_name
    - auto: PREDEFINED
      description: Alert priority.
      name: priority
      predefined:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      type: unknown
    - auto: PREDEFINED
      description: Case stage.
      name: stage
      predefined:
      - NEW
      - INVESTIGATION
      - REMEDIATION
      - CLOSED
    - auto: PREDEFINED
      description: Reason for case closure.
      name: closed_reason
      predefined:
      - Already Mitigated or Resolved
      - False Positive or Duplicate
      - Low Risk
      - Rule Misconfiguration
      - Policy or Setup Issue
      - Other
    - description: Supporting reason for case closure.
      name: supporting_reason
    - description: Assignee for the case.
      name: assignee
    - description: Queue for the case.
      name: queue
    description: Update details for a specific case.
    name: exabeam-update-case-details
  - arguments:
    - description: Unique ID that identifies a case.
      name: case_id
      required: true
    description: Retrieve a list of notes associated with the specified caseId.
    name: exabeam-platform-list-case-notes
  - arguments:
    - description: Unique ID that identifies a case.
      name: case_id
      required: true
    - description: Note text.
      name: note
      required: true
    description: Add a new note to the specified case.
    name: exabeam-platform-create-case-note
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  # Fetch incidents
  isfetch: true
  isfetch:marketplacev2: false
  isfetch:platform: false
  # Fetch events
  isfetchevents: true
  isfetchevents:xsoar: false
fromversion: 6.10.0
tests:
- ExabeamSecurityOperationsPlatform-test
defaultmapperin: "Exabeam Platform - Incoming Mapper"