Exabeam Aa
Exabeam AA is a SIEM platform that enhances threat detection and response through behavioral analytics.
Exabeam Advanced Analytics (AA) is a powerful platform for security analytics and operations. It provides capabilities to manage context tables, perform audit event searches, and track data ingestion progress. By integrating Exabeam AA with Swimlane Turbine, users can automate the management of context data, enhance audit capabilities, and streamline security operations. This integration empowers security teams to efficiently handle large volumes of data and improve incident response times.
Prerequisites
Before you can use the Exabeam AA connector for Turbine, you'll need access to the Exabeam API. This requires the following:
- OAuth2 authorization using the following parameters:
- URL: The endpoint for accessing Exabeam's API services.
- API Key: A unique key provided by Exabeam for authenticating API requests.
- API Key Secret: A secret associated with the API Key for secure authentication.
Capabilities
This connector provides the following capabilities:
- Add Context Records To An Existing Table
- Add Context Records To An Existing Table From A CSV File
- Create A Context Table With Metadata
- Get Metadata For A Single Context Table
- Get Metadata For All Existing Context Tables
- Get Table Records By ID
- Get The Available Attributes For A Specific Table Type
- Search Audit Events
- Track Ingestion Progress
Notes
For more information on Exabeam: Exabeam AA Bi-directional API Documentation
Additional Documentation
Configurations
Oauth 2.0 Client Credentials
Authenticates using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
client_id | API Key. | string | Required |
client_secret | API Key Secret. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add Context Records To An Existing Table
Append context records to a specified table in Exabeam AA using the 'id' path parameter and 'operation' in the request body.
Endpoint
- URL: /context-management/v1/tables/{{id}}/addRecords
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Add Context Records To An Existing Table action |
data | array | Optional | Response data |
operation | string | Optional | Parameter for Add Context Records To An Existing Table |
Input Example
{"json_body":{"data":[{"newKey":"New Value"}],"operation":"append"},"path_parameters":{"id":"emp_name_l8PFJfsH"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
jsonEntries | number | Output field: jsonEntries |
totalDuplicates | number | Output field: totalDuplicates |
totalIgnoredMissingKey | number | Output field: totalIgnoredMissingKey |
trackerId | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"jsonEntries":1000,"totalDuplicates":100,"totalIgnoredMissingKey":10,"trackerId":"fbbc124ada3c4ffa94c3c60457512dd3"}}
Add Context Records To An Existing Table From CSV
Append data to an existing Exabeam AA table from a CSV file with header row mapping. Requires 'id' and 'operation' parameters.
Endpoint
- URL: /context-management/v1/tables/{{id}}/addRecordsFromCsv
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Add Context Records To An Existing Table From CSV action |
attachments | array | Required | File to be uploaded |
attachments.file_name | string | Required | Name of the resource |
attachments.file | string | Required | Parameter for Add Context Records To An Existing Table From CSV |
sourceAttribute | string | Optional | Parameter for Add Context Records To An Existing Table From CSV |
operation | string | Optional | Parameter for Add Context Records To An Existing Table From CSV |
Input Example
{"json_body":{"sourceAttribute":"email","operation":"append"},"path_parameters":{"id":"emp_name_l8PFJfsH"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
csvEntries | number | Output field: csvEntries |
totalDuplicates | number | Output field: totalDuplicates |
totalIgnoredMissingKey | number | Output field: totalIgnoredMissingKey |
trackerId | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"csvEntries":1000,"totalDuplicates":100,"totalIgnoredMissingKey":10,"trackerId":"fbbc124ada3c4ffa94c3c60457512dd3"}}
Create A Context Table With Metadata
Generate a new custom context table in Exabeam AA with specified schema attributes. Requires name, contextType, and source.
Endpoint
- URL: /context-management/v1/tables
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
name | string | Optional | Name of the resource |
contextType | string | Optional | Type of the resource |
source | string | Optional | Parameter for Create A Context Table With Metadata |
attributes | array | Optional | Parameter for Create A Context Table With Metadata |
attributes.isKey | boolean | Required | Parameter for Create A Context Table With Metadata |
attributes.id | string | Required | Unique identifier |
attributes.displayName | string | Optional | Name of the resource |
Input Example
{"json_body":{"name":"Public API Example","contextType":"User","source":"Custom","attributes":[{"isKey":true,"id":"email_qopYfK7M","displayName":"User ID"}]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
table | object | Output field: table |
table.attributeMapping | array | Output field: table.attributeMapping |
table.attributeMapping.sourceAttribute | string | Output field: table.attributeMapping.sourceAttribute |
table.attributeMapping.targetAttributeId | string | Unique identifier |
table.attributes | array | Output field: table.attributes |
table.attributes.displayName | string | Name of the resource |
table.attributes.id | string | Unique identifier |
table.attributes.isKey | boolean | Output field: table.attributes.isKey |
table.attributes.type | string | Type of the resource |
table.contextType | string | Type of the resource |
table.id | string | Unique identifier |
table.lastUpdated | number | Output field: table.lastUpdated |
table.name | string | Name of the resource |
table.source | string | Output field: table.source |
table.status | string | Status value |
table.totalItems | number | Output field: table.totalItems |
url | string | URL endpoint for the request |
Output Example
{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"table":{"attributeMapping":[],"attributes":[],"contextType":"Other","id":"EiC5olOacm","lastUpdated":1676018946,"name":"Public API Example","source":"Custom","status":"RUNNING","totalItems":10},"url":"https://example.com/context-management/v1/tables/EiC5olOacm"}}
Get Metadata For A Single Context Table
Retrieve metadata for a specific context table in Exabeam AA, including source, operational status, and attribute mapping, using the table's ID.
Endpoint
- URL: /context-management/v1/tables/{{id}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Metadata For A Single Context Table action |
Input Example
{"path_parameters":{"id":"email_qopYfK7M"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
attributeMapping | array | Output field: attributeMapping |
attributeMapping.sourceAttribute | string | Output field: attributeMapping.sourceAttribute |
attributeMapping.targetAttributeId | string | Unique identifier |
attributes | array | Output field: attributes |
attributes.displayName | string | Name of the resource |
attributes.id | string | Unique identifier |
attributes.isKey | boolean | Output field: attributes.isKey |
attributes.type | string | Type of the resource |
contextType | string | Type of the resource |
id | string | Unique identifier |
lastUpdated | number | Output field: lastUpdated |
name | string | Name of the resource |
source | string | Output field: source |
status | string | Status value |
totalItems | number | Output field: totalItems |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributeMapping":[{},{},{}],"attributes":[{},{},{}],"contextType":"Other","id":"EiC5olOacm","lastUpdated":1676018946,"name":"Public API Example","source":"Custom","status":"RUNNING","totalItems":10}}
Get Metadata For All Existing Context Tables
Retrieve metadata for all Exabeam AA context tables, detailing source, operational status, and attribute mapping.
Endpoint
- URL: /context-management/v1/tables
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"attributeMapping":[],"attributes":[],"contextType":"Other","id":"EiC5olOacm","lastUpdated":1676018946,"name":"Public API Example","source":"Custom","status":"RUNNING","totalItems":10}]}
Get Table Records By ID
Retrieve records from a specific Exabeam AA context table using the provided unique identifier.
Endpoint
- URL: /context-management/v1/tables/{{id}}/records
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.id | string | Required | Parameters for the Get Table Records By ID action |
parameters.limit | number | Optional | Parameters for the Get Table Records By ID action |
parameters.offset | number | Optional | Parameters for the Get Table Records By ID action |
Input Example
{"parameters":{"limit":1,"offset":2},"path_parameters":{"id":"emp_name_l8PFJfsH"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
paging | object | Output field: paging |
paging.count | number | Count value |
paging.limit | number | Output field: paging.limit |
paging.next | array | Output field: paging.next |
paging.next.file_name | string | Name of the resource |
paging.next.file | string | Output field: paging.next.file |
paging.offset | number | Output field: paging.offset |
paging.pages | number | Output field: paging.pages |
paging.prev | array | Output field: paging.prev |
paging.prev.file_name | string | Name of the resource |
paging.prev.file | string | Output field: paging.prev.file |
records | array | Output field: records |
records.attr_1 | string | Output field: records.attr_1 |
records.attr_11 | string | Output field: records.attr_11 |
records.attr_2 | string | Output field: records.attr_2 |
records.attr_22 | string | Output field: records.attr_22 |
records.attr_3 | string | Output field: records.attr_3 |
records.attr_33 | string | Output field: records.attr_33 |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"paging":{"count":3,"limit":25,"next":[],"offset":0,"pages":1,"prev":[]},"records":[{},{},{}]}}
Search Audit Events
Perform rapid search queries on audit events within Exabeam AA using specified fields, startTime, and endTime.
Endpoint
- URL: /audit/v1/events
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
fields | array | Optional | List of fields to be returned from the audit search. |
startTime | string | Optional | ISO 8601 UTC timestamp to start the audit search. |
endTime | string | Optional | ISO 8601 UTC timestamp to end the audit search. |
limit | number | Optional | Limit the number of events returned from the audit search request. |
groupBy | array | Optional | List of fields to GROUP BY. |
orderBy | array | Optional | Order fields by ASC or DESC. |
distinct | boolean | Optional | Include or exclude DISTINCT from the SELECT clause. Defaults to false. |
filter | string | Optional | Filter for specific audit events. |
Input Example
{"json_body":{"fields":["id","id2"],"startTime":"2023-04-10T22:17:36.863Z","endTime":"2023-04-10T22:17:36.863Z","limit":3000,"groupBy":["a","b"],"orderBy":["ASC","DESC"],"distinct":false,"filter":"app:\\\"Search\\\" AND src_ip:\\\"00.00.000.000\\"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
timeStartedMillis | number | Output field: timeStartedMillis |
timeCompletedMillis | number | Output field: timeCompletedMillis |
rows | array | Output field: rows |
rows.additionalProp | object | Output field: rows.additionalProp |
totalRows | number | Output field: totalRows |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"timeStartedMillis":0,"timeCompletedMillis":0,"rows":[{}],"totalRows":0}}
Track Ingestion Progress
Poll the status of an add records job in Exabeam AA using a provided tracker ID.
Endpoint
- URL: /context-management/v1/tables/uploadStatus/{{trackerId}}
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
path_parameters.trackerId | string | Required | Parameters for the Track Ingestion Progress action |
Input Example
{"path_parameters":{"trackerId":"fbbc124ada3c4ffa94c3c60457512dd3"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
totalErrors | number | Error message if any |
totalUploaded | number | Output field: totalUploaded |
uploadStatus | string | Status value |
Output Example
{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"totalErrors":10,"totalUploaded":100,"uploadStatus":"inProgress"}}
Response Headers
Header | Description | Example |
|---|---|---|
content-length | The length of the response body in bytes | 140 |
content-type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Tue, 5 Sep 2023 20:37:23 GMT |