category: Analytics & SIEM
provider: Exabeam
sectionorder:
- Connect
- Collect
commonfields:
  id: ExabeamSecOpsPlatform
  version: -1
configuration:
- defaultvalue: https://example.com/
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Client ID
  name: credentials
  required: true
  section: Connect
  type: 9
  displaypassword: Client Secret
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  hidden:
  - marketplacev2
  - platform
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  advanced: true
  required: false
  section: Collect
  defaultvalue: '1'
  hidden:
  - marketplacev2
  - platform
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  advanced: true
  required: false
  defaultvalue: '1'
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Maximum Incidents Per Fetch
  additionalinfo: This value should not exceed 3,000 due to product's API limitations.
  name: max_fetch  # for fetch-incidents on XSOAR
  defaultvalue: 50
  type: 0
  section: Collect
  hidden:
    - marketplacev2
    - platform
- display: Maximum Number of Cases Per Fetch
  name: max_events_fetch  # for fetch-events on XSIAM and PLATFORM
  defaultvalue: 30000
  type: 0
  section: Collect
  hidden:
    - xsoar
  supportedModules:
  - xsiam
- display: Fetch query
  additionalinfo: 'In the `key:value` format. For example: `NOT stage:"CLOSED"`.'
  name: fetch_query
  type: 0
  section: Collect
  advanced: true
  hidden:
    - marketplacev2
    - platform
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  defaultvalue: 3 days
  type: 0
  section: Collect
  advanced: true
  hidden:
    - marketplacev2
    - platform
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
  hidden:
    - marketplacev2
    - platform
description: Exabeam Security Operations Platform offers a centralized and scalable platform for log management.
display: Exabeam Security Operations Platform
name: ExabeamSecOpsPlatform
script:
  commands:
  - arguments:
    - defaultValue: "7 days ago"
      description: The starting date for the search range.
      name: start_time
    - defaultValue: "today"
      description: The ending date for the search range.
      name: end_time
    - defaultValue: ""
      description: 'Query, using Lucene syntax, filters log data for precise analysis, without escaping and with values unquoted. e.g., query="product: Correlation Rule AND rule_severity: High".'
      name: query
      required: false
    - description: Comma-separated list of fields to be returned from the search.
      name: fields
      required: false
      isArray: true
    - description: Comma-separated list of fields by which to group the results.
      name: group_by
      isArray: true
      required: false
    - description: The maximal number of results to return. Maximum value is 3000.
      name: limit
      required: false
    description: Get events from Exabeam Security Operations Platform.
    name: exabeam-platform-event-search
    outputs:
    - contextPath: ExabeamPlatform.Event.id
      description: The unique identifier associated with the event.
      type: String
    - contextPath: ExabeamPlatform.Event.rawLogIds
      description: The raw log identifiers associated with the event.
      type: String
    - contextPath: ExabeamPlatform.Event.tier
      description: The tier associated with the event.
      type: String
    - contextPath: ExabeamPlatform.Event.parsed
      description: Whether the event has been parsed.
      type: String
    - contextPath: ExabeamPlatform.Event.rawLogs
      description: The raw logs associated with the event.
      type: String
  - name: exabeam-platform-get-events
    description: Get cases from Exabeam Security Operations Platform as Cortex XSIAM events. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.
    arguments:
    - defaultValue: "1 hour ago"
      description: "The starting date for the case search range. For example: yyyy-MM-ddThh:mm:ssZ."
      name: start_time
    - defaultValue: "now"
      description: "The ending date for the case search range. For example: yyyy-MM-ddThh:mm:ssZ."
      name: end_time
    - description: The maximum number of results to return.
      name: limit
      defaultValue: "10"
    - description: If true, the command will push the events to the Cortex XSIAM dataset. Otherwise, it will only display them.
      name: should_push_events
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
  - name: exabeam-platform-case-search
    description: Search for cases that match one or more search criteria. For example, you can search for cases that are associated with a specific case ID and that reference specific rules.
    arguments:
    - name: case_id
      description: An optional case ID parameter to get a specific case.
    - name: start_time
      description: Timestamp to start the search.
      defaultValue: "7 days ago"
    - name: end_time
      description: Timestamp to end the search.
      defaultValue: today
    - name: query
      description: Query, using Lucene syntax, filters log data for precise analysis. For example 'priority:LOW AND NOT stage:NEW'.
      defaultValue: ""
    - name: fields
      description: List of fields to be returned from the search.
      isArray: true
      defaultValue: ""
    - name: order_by
      description: Order results by a specified field. The default ordering is ascending (ASC). To sort in descending order, use "DESC" after the field, for example, "riskScore DESC"."
      isArray: true
    - name: limit
      defaultValue: 50
      description: Limit the number of results returned from the search request.
    - name: all_results
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', retrieves all available results, ignoring the limit parameter.
    - name: include_related_rules
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', filters the context to include the "rules" array related to the cases in the results.
    outputs:
    - contextPath: ExabeamPlatform.Case.alertId
      description: Unique identifier for the alert associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.alertName
      description: Name of the alert associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.approxLogTime
      description: Approximate log time of the event that generated the case.
      type: Number
    - contextPath: ExabeamPlatform.Case.assignee
      description: User assigned to the case.
      type: String
    - contextPath: ExabeamPlatform.Case.caseCreationTimestamp
      description: Timestamp when the case was created.
      type: Number
    - contextPath: ExabeamPlatform.Case.caseId
      description: Unique identifier for the case.
      type: String
    - contextPath: ExabeamPlatform.Case.destHosts
      description: Destination hosts involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.destIps
      description: Destination IP addresses involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.groupedbyKey
      description: Key by which the case was grouped.
      type: String
    - contextPath: ExabeamPlatform.Case.groupedbyValue
      description: Value by which the case was grouped.
      type: String
    - contextPath: ExabeamPlatform.Case.hasAttachments
      description: Indicates if the case has attachments.
      type: Boolean
    - contextPath: ExabeamPlatform.Case.ingestTimestamp
      description: Timestamp when the case was ingested.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.lastModifiedTimestamp
      description: Timestamp when the case was last modified.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.mitres
      description: MITRE tactics and techniques associated with the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.priority
      description: Priority level of the case.
      type: String
    - contextPath: ExabeamPlatform.Case.products
      description: Products involved in the case.
      type: String
    - contextPath: ExabeamPlatform.Case.queue
      description: Queue to which the case is assigned.
      type: String
    - contextPath: ExabeamPlatform.Case.riskScore
      description: Risk score of the case.
      type: Number
    - contextPath: ExabeamPlatform.Case.rules.approxLogTime
      description: Approximate log time of the rule that triggered the case.
      type: Number
    - contextPath: ExabeamPlatform.Case.rules.ruleId
      description: Unique identifier for the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleName
      description: Name of the rule that triggered the case.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleReason
      description: Reason for the rule triggering the case.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleSeverity
      description: Severity level of the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleSource
      description: Source of the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.rules.ruleType
      description: Type of the rule.
      type: String
    - contextPath: ExabeamPlatform.Case.srcHosts
      description: Source hosts involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.srcIps
      description: Source IP addresses involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.stage
      description: Current stage of the case.
      type: String
    - contextPath: ExabeamPlatform.Case.subscriptionCode
      description: Subscription code associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.tags
      description: Tags associated with the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.useCases
      description: Use cases associated with the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.users
      description: Users involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.vendors
      description: Vendors involved in the case.
      type: String
    - contextPath: ExabeamPlatform.Case.alertCreationTimestamp
      description: Timestamp when the alert was created.
      type: Date
    - contextPath: ExabeamPlatform.Case.alertDescriptionRt
      description: Description of the alert.
      type: String
    - contextPath: ExabeamPlatform.Case.creationBy
      description: User who created the case.
      type: String
    - contextPath: ExabeamPlatform.Case.creationTimestamp
      description: Timestamp when the case was created.
      type: Date
    - contextPath: ExabeamPlatform.Case.destEndpoints
      description: Destination endpoints involved in the case.
      type: Unknown
    - contextPath: ExabeamPlatform.Case.mitres.tacticKey
      description: Key of the MITRE tactic associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.mitres.technique
      description: MITRE technique associated with the case.
      type: String
    - contextPath: ExabeamPlatform.Case.mitres.techniqueKey
      description: Key of the MITRE technique associated with the case.
      type: String
  - name: exabeam-platform-alert-search
    description: Search for alerts that match one or more search criteria.
    arguments:
    - name: alert_id
      description: Unique ID that identifies an alert.
    - name: start_time
      description: Timestamp to start the search.
      defaultValue: "7 days ago"
    - name: end_time
      description: Timestamp to end the search.
      defaultValue: today
    - name: query
      description: Query, using Lucene syntax, filters log data for precise analysis. For example 'priority:LOW'.
      defaultValue: ""
    - name: fields
      description: List of fields to be returned from the search.
      isArray: true
      defaultValue: ""
    - name: order_by
      description: Order results by a specified field. The default ordering is ascending (ASC). To sort in descending order, use "DESC" after the field, for example, "riskScore DESC"."
      isArray: true
    - name: limit
      defaultValue: 50
      description: Limit the number of results returned from the search request.
    - name: all_results
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', retrieves all available results, ignoring the limit parameter.
    - name: include_related_rules
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      description: If set to 'True', filters the context to include the "rules" array related to the cases in the results.
    outputs:
    - contextPath: ExabeamPlatform.Alert.alertDescriptionRt
      description: The description of the alert in real-time.
      type: String
    - contextPath: ExabeamPlatform.Alert.alertId
      description: The unique identifier of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.alertName
      description: The name or title of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.approxLogTime
      description: The approximate log time of the alert.
      type: Date
    - contextPath: ExabeamPlatform.Alert.assignee
      description: The person assigned to the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.caseCreationTimestamp
      description: The timestamp when the case was created.
      type: Number
    - contextPath: ExabeamPlatform.Alert.caseId
      description: The unique identifier of the case associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.creationBy
      description: The user who created the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.creationTimestamp
      description: The timestamp when the alert was created.
      type: Date
    - contextPath: ExabeamPlatform.Alert.destEndpoints
      description: The destination endpoints involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.destHosts
      description: The destination hosts involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.destIps
      description: The destination IP addresses involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.groupedbyKey
      description: The key used for grouping the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.groupedbyValue
      description: The value used for grouping the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.groupingRuleId
      description: The ID of the rule used for grouping the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.hasAttachments
      description: Indicates if the alert has attachments.
      type: Boolean
    - contextPath: ExabeamPlatform.Alert.ingestTimestamp
      description: The timestamp when the alert was ingested into the system.
      type: Date
    - contextPath: ExabeamPlatform.Alert.lastModifiedBy
      description: The user who last modified the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.lastModifiedTimestamp
      description: The timestamp when the alert was last modified.
      type: Date
    - contextPath: ExabeamPlatform.Alert.mitres.tactic
      description: The MITRE tactic associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.mitres.tacticKey
      description: The MITRE tactic key associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.mitres.technique
      description: The MITRE technique associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.mitres.techniqueKey
      description: The MITRE technique key associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.priority
      description: The priority level of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.products
      description: The products involved in the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.queue
      description: The queue in which the alert is placed.
      type: String
    - contextPath: ExabeamPlatform.Alert.riskScore
      description: The risk score associated with the alert.
      type: Number
    - contextPath: ExabeamPlatform.Alert.srcEndpoints.ip
      description: The IP addresses of the source endpoints involved in the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.srcHosts
      description: The source hosts involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.srcIps
      description: The source IP addresses involved in the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.stage
      description: The stage of the alert in the investigation process.
      type: String
    - contextPath: ExabeamPlatform.Alert.status
      description: The status of the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.subscriptionCode
      description: The subscription code associated with the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.tags
      description: The tags associated with the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.useCases
      description: The use cases related to the alert.
      type: String
    - contextPath: ExabeamPlatform.Alert.users
      description: The users involved in the alert.
      type: Unknown
    - contextPath: ExabeamPlatform.Alert.vendors
      description: The vendors associated with the alert.
      type: String
  - name: exabeam-platform-context-table-list
    description: Retrieve metadata for all existing context tables, including source, operational status, and attribute mapping.
    arguments:
    - name: table_id
      description: Specify the ID of an existing context table.
    - name: limit
      defaultValue: 50
      description: Limit the number of results returned from the request.
    - name: include_attributes
      description: If set to 'True', filters the context to include the "attributes" array related to the cases in the results.
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
    outputs:
    - contextPath: ExabeamPlatform.ContextTable.attributeMapping
      description: The attribute mapping of the context table.
      type: Unknown
    - contextPath: ExabeamPlatform.ContextTable.attributes.displayName
      description: The display name of the attribute.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.attributes.id
      description: The unique identifier of the attribute.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.attributes.isKey
      description: 'Indicates if the attribute is a key attribute.'
      type: Boolean
    - contextPath: ExabeamPlatform.ContextTable.attributes.type
      description: The type of the attribute.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.contextType
      description: 'The type of context the table represents.'
      type: String
    - contextPath: ExabeamPlatform.ContextTable.id
      description: The unique identifier of the context table.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.lastUpdated
      description: The timestamp of the last update to the context table.
      type: Number
    - contextPath: ExabeamPlatform.ContextTable.name
      description: The name of the context table.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.source
      description: The source of the context table data.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.status
      description: The status of the context table.
      type: String
    - contextPath: ExabeamPlatform.ContextTable.totalItems
      description: The total number of items in the context table.
      type: Number
  - name: exabeam-platform-context-table-delete
    description: Delete a specific context table, including records and attributes.
    arguments:
    - name: table_id
      description: Specify the ID of an existing context table.
      required: true
    - name: delete_unused_custom_attributes
      description: Delete any custom attributes in this table that are not used in another context table.
      defaultValue: 'False'
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
  - name: exabeam-platform-table-record-list
    description: Retrieve the records for a specific context table.
    arguments:
    - name: table_id
      description: ID of the table. Obtain this value by running `exabeam-platform-context-table-list`.
      required: true
    - name: limit
      defaultValue: 50
      description: The number of records to return.
    - name: page
      description: The page number to retrieve.
    - name: page_size
      description: The number of records per page, maximum value is '3000'. Default value is '50'.
  - name: exabeam-platform-table-record-create
    description: Add one or more context records directly to an existing table.
    arguments:
    - name: table_id
      description: ID of the table. Obtain this value by running `exabeam-platform-context-table-list`.
      required: true
    - name: attributes
      description: A dictionary mapping attribute names to their values, for example:`{"attributeName":["val1", "val2"]}`.
      required: true
      type: keyValue
    - name: operation
      description: Options for how data should be uploaded to an existing table.
      defaultValue: Append
      auto: PREDEFINED
      predefined:
      - Append
      - Replace
    - name: interval_in_seconds
      description: The interval in seconds between each poll.
      defaultValue: 30
    - name: timeout
      description: The timeout in seconds until polling ends.
      defaultValue: 600
    - name: tracker_id
      description: Specify the tracker ID from an upload request whose progress you want to track.
      hidden: true
    - name: hide_polling_output
      hidden: true
      description: Suppresses the output of polling operations to reduce clutter in logs.
    polling: true
  - arguments:
    - description: The alertId to fetch a threat summary for.
      name: alert_id
      required: true
    description: Retrieve the Copilot Threat Summary for an individual alert.
    name: exabeam-get-threat-summary
    outputs:
    - contextPath: ExabeamPlatform.Alert.Summary
      description: Threat Summary of the Exabeam Alert.
      type: string
  - arguments:
    - description: ID of the case to be updated.
      name: case_id
      required: true
    - description: Alert description in either plaintext or HTML format. Length <=1024.
      name: alert_description
    - description: Alert name. Length <= 128.
      name: alert_name
    - auto: PREDEFINED
      description: Alert priority.
      name: priority
      predefined:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      type: unknown
    - auto: PREDEFINED
      description: Case stage.
      name: stage
      predefined:
      - NEW
      - INVESTIGATION
      - REMEDIATION
      - CLOSED
    - auto: PREDEFINED
      description: Reason for case closure.
      name: closed_reason
      predefined:
      - Already Mitigated or Resolved
      - False Positive or Duplicate
      - Low Risk
      - Rule Misconfiguration
      - Policy or Setup Issue
      - Other
    - description: Supporting reason for case closure.
      name: supporting_reason
    - description: Assignee for the case.
      name: assignee
    - description: Queue for the case.
      name: queue
    description: Update details for a specific case.
    name: exabeam-update-case-details
  - arguments:
    - description: Unique ID that identifies a case.
      name: case_id
      required: true
    description: Retrieve a list of notes associated with the specified caseId.
    name: exabeam-platform-list-case-notes
  - arguments:
    - description: Unique ID that identifies a case.
      name: case_id
      required: true
    - description: Note text.
      name: note
      required: true
    description: Add a new note to the specified case.
    name: exabeam-platform-create-case-note
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  # Fetch incidents
  isfetch: true
  isfetch:marketplacev2: false
  isfetch:platform: false
  # Fetch events
  isfetchevents: true
  isfetchevents:xsoar: false
fromversion: 6.10.0
tests:
- ExabeamSecurityOperationsPlatform-test
defaultmapperin: "Exabeam Platform - Incoming Mapper"