ExabeamSecOpsPlatform

Exabeam Security Operations Platform offers a centralized and scalable platform for log management.
This integration was integrated and tested with version v1.0 of ExabeamSecOpsPlatform.

Configure Exabeam Security Operations Platform in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

exabeam-platform-event-search

Get events from Exabeam Security Operations Platform.

Base Command

exabeam-platform-event-search

Input

Context Output

Command example

!exabeam-platform-event-search end_time="today" start_time="7 days ago" limit=2 query="product: Correlation Rule AND rule_severity: High"

Context Example

{
    "ExabeamPlatform": {
        "Event": [
            {
                "approxLogTime": 1715694190909000,
                "collector_timestamp": 1715694190909000,
                "customFieldsJSON": "{}",
                "id": "fake",
                "ingest_time": 1715694222815000,
                "metadataFieldsJSON": "{\"m_collector_id\":\"aae1627e-8637-4597-9f43-e49a703a6151\",\"m_collector_name\":\"exa-cribl-logs-sm_exa_ws\",\"m_collector_type\":\"cribl-logs\"}",
                "parsed": false,
                "rawLogIds": [
                    "log-fic"
                ],
                "rawLogs": [
                    "ANY rawLog"
                ],
                "raw_log_size": 9,
                "tier": "Tier 4"
            },
            {
                "approxLogTime": 1715694915916000,
                "collector_timestamp": 1715694915916000,
                "customFieldsJSON": "{}",
                "id": "fictive-id",
                "ingest_time": 1715694946775000,
                "metadataFieldsJSON": "{\"m_collector_id\":\"aae1627e-8637-4597-9f43-e49a703a6151\",\"m_collector_name\":\"exa-cribl-logs-sm_exa_ws\",\"m_collector_type\":\"cribl-logs\"}",
                "parsed": false,
                "rawLogIds": [
                    "rawLogId"
                ],
                "rawLogs": [
                    "CONNECT hotmail"
                ],
                "raw_log_size": 59,
                "tier": "Tier 4"
            }
        ]
    }
}

Human Readable Output

Logs

Id	Is Parsed	Raw Log Ids	Raw Logs	Tier
fake	false	log-fic	ANY rawLog	Tier 4
fictive-id	false	rawLogId	CONNECT hotmail	Tier 4

exabeam-platform-table-record-list

Retrieve the records for a specific context table.

Base Command

exabeam-platform-table-record-list

Input

Context Output

There is no context output for this command.

exabeam-platform-table-record-create

Add one or more context records directly to an existing table.

Base Command

exabeam-platform-table-record-create

Input

Context Output

There is no context output for this command.

exabeam-platform-alert-search

Search for alerts that match one or more search criteria.

Base Command

exabeam-platform-alert-search

Input

Context Output

exabeam-platform-context-table-delete

Delete a specific context table, including records and attributes.

Base Command

exabeam-platform-context-table-delete

Input

Context Output

There is no context output for this command.

exabeam-platform-context-table-list

Retrieve metadata for all existing context tables, including source, operational status, and attribute mapping.

Base Command

exabeam-platform-table-record-list

Input

Context Output

exabeam-platform-case-search

Search for cases that match one or more search criteria. For example, you can search for cases that are associated with a specific caseId and that reference specific rules.

Base Command

exabeam-platform-case-search

Input

Context Output

exabeam-platform-get-events

Get cases from Exabeam Security Operations Platform as Cortex XSIAM events. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.

Base Command

exabeam-platform-get-events

Input

Context Output

There is no context output for this command.

Command example

!exabeam-platform-get-events start_time="2025-08-30T00:27:53Z" limit=1 should_push_events=false

Human Readable Output

Events

_time	alertId	approxLogTime	caseCreationTimestamp	caseId	caseNumber	destHost	destIp	hasAttachments	lastModifiedTimestamp	mitres	name	priority	product	queue	riskScore	rules	srcHost	srcIp	stage	subscriptionCode	tags	useCases	user	vendor
2025-08-31T22:49:43Z	8ccd4479-aaaa-bbbb-9a29-aaed1b7e4d69	1756658220000000	1756680583393478	573d2e67-aaaa-bbbb-1122-11998166047e	1449			false	1756724116013483		Hello_world_rule	HIGH	Correlation Rule	Tier 1 Analyst	200	[ ]			NEW	1234				Exabeam

exabeam-get-threat-summary

Retrieve the Copilot Threat Summary for an individual alert.

Base Command

exabeam-get-threat-summary

Input

Context Output

exabeam-update-case-details

Update details for a specific case.

Base Command

exabeam-update-case-details

Input

Context Output

There is no context output for this command.

exabeam-platform-list-case-notes

Retrieve a list of notes associated with the specified caseId.

Base Command

exabeam-platform-list-case-notes

Input

Context Output

There is no context output for this command.

exabeam-platform-create-case-note

Add a new note to the specified case.

Base Command

exabeam-platform-create-case-note

Input

Context Output

There is no context output for this command.

<~PLATFORM>

License Requirements

The following configuration parameters require the Cortex XSIAM license:

• Fetch events

</~PLATFORM>