---
title: Exabeam Aa
slug: connectors/exabeam-aa
docTags: 
createdAt: 2026-06-09T16:29:45.858Z
---

Exabeam AA is a SIEM platform that enhances threat detection and response through behavioral analytics.

Exabeam Advanced Analytics (AA) is a powerful platform for security analytics and operations. It provides capabilities to manage context tables, perform audit event searches, and track data ingestion progress. By integrating Exabeam AA with Swimlane Turbine, users can automate the management of context data, enhance audit capabilities, and streamline security operations. This integration empowers security teams to efficiently handle large volumes of data and improve incident response times.

## Prerequisites

Before you can use the Exabeam AA connector for Turbine, you'll need access to the Exabeam API. This requires the following:

- OAuth2 authorization using the following parameters:
  - URL: The endpoint for accessing Exabeam's API services.
  - API Key: A unique key provided by Exabeam for authenticating API requests.
  - API Key Secret: A secret associated with the API Key for secure authentication.

## Capabilities

This connector provides the following capabilities:

- Add Context Records To An Existing Table
- Add Context Records To An Existing Table From A CSV File
- Create A Context Table With Metadata
- Get Metadata For A Single Context Table
- Get Metadata For All Existing Context Tables
- Get Table Records By ID
- Get The Available Attributes For A Specific Table Type
- Search Audit Events
- Track Ingestion Progress

## Notes

For more information on Exabeam:
[Exabeam AA Bi-directional API Documentation](https://docs.exabeam.com/apis/)

## Additional Documentation

- [Exabeam Aa Connector Documentation](https://docs.swimlane.com/connectors/exabeam-aa)
- [Exabeam Aa API Documentation](https://docs.exabeam.com/apis/)

# Configurations

## Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

### Configuration Parameters

| **Parameter**  | **Description**                    | **Type** | **Required** |
| -------------- | ---------------------------------- | -------- | ------------ |
| url            | A URL to the target host.          | string   | Required     |
| client\_id     | API Key.                           | string   | Required     |
| client\_secret | API Key Secret.                    | string   | Required     |
| verify\_ssl    | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy    | A proxy to route requests through. | string   | Optional     |

# Actions

## Add Context Records To An Existing Table

Append context records to a specified table in Exabeam AA using the 'id' path parameter and 'operation' in the request body.

### Endpoint

- **URL:** `/context-management/v1/tables/{{id}}/addRecords`
- **Method:** `POST`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                                    |
| -------------------- | -------- | ------------ | ------------------------------------------------------------------ |
| `path_parameters.id` | string   | Required     | Parameters for the Add Context Records To An Existing Table action |
| `data`               | array    | Optional     | Response data                                                      |
| `operation`          | string   | Optional     | Parameter for Add Context Records To An Existing Table             |

### Input Example

`{"json_body":{"data":[{"newKey":"New Value"}],"operation":"append"},"path_parameters":{"id":"emp_name_l8PFJfsH"}}`

### Output

| **Parameter**            | **Type** | **Description**                      |
| ------------------------ | -------- | ------------------------------------ |
| `status_code`            | number   | HTTP status code of the response     |
| `reason`                 | string   | Response reason phrase               |
| `jsonEntries`            | number   | Output field: jsonEntries            |
| `totalDuplicates`        | number   | Output field: totalDuplicates        |
| `totalIgnoredMissingKey` | number   | Output field: totalIgnoredMissingKey |
| `trackerId`              | string   | Unique identifier                    |

### Output Example

`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"jsonEntries":1000,"totalDuplicates":100,"totalIgnoredMissingKey":10,"trackerId":"fbbc124ada3c4ffa94c3c60457512dd3"}}`

## Add Context Records To An Existing Table From CSV

Append data to an existing Exabeam AA table from a CSV file with header row mapping. Requires 'id' and 'operation' parameters.

### Endpoint

- **URL:** `/context-management/v1/tables/{{id}}/addRecordsFromCsv`
- **Method:** `POST`

### Input

| **Argument Name**       | **Type** | **Required** | **Description**                                                             |
| ----------------------- | -------- | ------------ | --------------------------------------------------------------------------- |
| `path_parameters.id`    | string   | Required     | Parameters for the Add Context Records To An Existing Table From CSV action |
| `attachments`           | array    | Required     | File to be uploaded                                                         |
| `attachments.file_name` | string   | Required     | Name of the resource                                                        |
| `attachments.file`      | string   | Required     | Parameter for Add Context Records To An Existing Table From CSV             |
| `sourceAttribute`       | string   | Optional     | Parameter for Add Context Records To An Existing Table From CSV             |
| `operation`             | string   | Optional     | Parameter for Add Context Records To An Existing Table From CSV             |

### Input Example

`{"json_body":{"sourceAttribute":"email","operation":"append"},"path_parameters":{"id":"emp_name_l8PFJfsH"}}`

### Output

| **Parameter**            | **Type** | **Description**                      |
| ------------------------ | -------- | ------------------------------------ |
| `status_code`            | number   | HTTP status code of the response     |
| `reason`                 | string   | Response reason phrase               |
| `csvEntries`             | number   | Output field: csvEntries             |
| `totalDuplicates`        | number   | Output field: totalDuplicates        |
| `totalIgnoredMissingKey` | number   | Output field: totalIgnoredMissingKey |
| `trackerId`              | string   | Unique identifier                    |

### Output Example

`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"csvEntries":1000,"totalDuplicates":100,"totalIgnoredMissingKey":10,"trackerId":"fbbc124ada3c4ffa94c3c60457512dd3"}}`

## Create A Context Table With Metadata

Generate a new custom context table in Exabeam AA with specified schema attributes. Requires name, contextType, and source.

### Endpoint

- **URL:** `/context-management/v1/tables`
- **Method:** `POST`

### Input

| **Argument Name**        | **Type** | **Required** | **Description**                                    |
| ------------------------ | -------- | ------------ | -------------------------------------------------- |
| `name`                   | string   | Optional     | Name of the resource                               |
| `contextType`            | string   | Optional     | Type of the resource                               |
| `source`                 | string   | Optional     | Parameter for Create A Context Table With Metadata |
| `attributes`             | array    | Optional     | Parameter for Create A Context Table With Metadata |
| `attributes.isKey`       | boolean  | Required     | Parameter for Create A Context Table With Metadata |
| `attributes.id`          | string   | Required     | Unique identifier                                  |
| `attributes.displayName` | string   | Optional     | Name of the resource                               |

### Input Example

`{"json_body":{"name":"Public API Example","contextType":"User","source":"Custom","attributes":[{"isKey":true,"id":"email_qopYfK7M","displayName":"User ID"}]}}`

### Output

| **Parameter**                              | **Type** | **Description**                                      |
| ------------------------------------------ | -------- | ---------------------------------------------------- |
| `status_code`                              | number   | HTTP status code of the response                     |
| `reason`                                   | string   | Response reason phrase                               |
| `table`                                    | object   | Output field: table                                  |
| `table.attributeMapping`                   | array    | Output field: table.attributeMapping                 |
| `table.attributeMapping.sourceAttribute`   | string   | Output field: table.attributeMapping.sourceAttribute |
| `table.attributeMapping.targetAttributeId` | string   | Unique identifier                                    |
| `table.attributes`                         | array    | Output field: table.attributes                       |
| `table.attributes.displayName`             | string   | Name of the resource                                 |
| `table.attributes.id`                      | string   | Unique identifier                                    |
| `table.attributes.isKey`                   | boolean  | Output field: table.attributes.isKey                 |
| `table.attributes.type`                    | string   | Type of the resource                                 |
| `table.contextType`                        | string   | Type of the resource                                 |
| `table.id`                                 | string   | Unique identifier                                    |
| `table.lastUpdated`                        | number   | Output field: table.lastUpdated                      |
| `table.name`                               | string   | Name of the resource                                 |
| `table.source`                             | string   | Output field: table.source                           |
| `table.status`                             | string   | Status value                                         |
| `table.totalItems`                         | number   | Output field: table.totalItems                       |
| `url`                                      | string   | URL endpoint for the request                         |

### Output Example

`{"status_code":201,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"table":{"attributeMapping":[],"attributes":[],"contextType":"Other","id":"EiC5olOacm","lastUpdated":1676018946,"name":"Public API Example","source":"Custom","status":"RUNNING","totalItems":10},"url":"https://example.com/context-management/v1/tables/EiC5olOacm"}}`

## Get Metadata For A Single Context Table

Retrieve metadata for a specific context table in Exabeam AA, including source, operational status, and attribute mapping, using the table's ID.

### Endpoint

- **URL:** `/context-management/v1/tables/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                                   |
| -------------------- | -------- | ------------ | ----------------------------------------------------------------- |
| `path_parameters.id` | string   | Required     | Parameters for the Get Metadata For A Single Context Table action |

### Input Example

`{"path_parameters":{"id":"email_qopYfK7M"}}`

### Output

| **Parameter**                        | **Type** | **Description**                                |
| ------------------------------------ | -------- | ---------------------------------------------- |
| `status_code`                        | number   | HTTP status code of the response               |
| `reason`                             | string   | Response reason phrase                         |
| `attributeMapping`                   | array    | Output field: attributeMapping                 |
| `attributeMapping.sourceAttribute`   | string   | Output field: attributeMapping.sourceAttribute |
| `attributeMapping.targetAttributeId` | string   | Unique identifier                              |
| `attributes`                         | array    | Output field: attributes                       |
| `attributes.displayName`             | string   | Name of the resource                           |
| `attributes.id`                      | string   | Unique identifier                              |
| `attributes.isKey`                   | boolean  | Output field: attributes.isKey                 |
| `attributes.type`                    | string   | Type of the resource                           |
| `contextType`                        | string   | Type of the resource                           |
| `id`                                 | string   | Unique identifier                              |
| `lastUpdated`                        | number   | Output field: lastUpdated                      |
| `name`                               | string   | Name of the resource                           |
| `source`                             | string   | Output field: source                           |
| `status`                             | string   | Status value                                   |
| `totalItems`                         | number   | Output field: totalItems                       |

### Output Example

`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"attributeMapping":[{},{},{}],"attributes":[{},{},{}],"contextType":"Other","id":"EiC5olOacm","lastUpdated":1676018946,"name":"Public API Example","source":"Custom","status":"RUNNING","totalItems":10}}`

## Get Metadata For All Existing Context Tables

Retrieve metadata for all Exabeam AA context tables, detailing source, operational status, and attribute mapping.

### Endpoint

- **URL:** `/context-management/v1/tables`
- **Method:** `GET`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |

### Output Example

`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":[{"attributeMapping":[],"attributes":[],"contextType":"Other","id":"EiC5olOacm","lastUpdated":1676018946,"name":"Public API Example","source":"Custom","status":"RUNNING","totalItems":10}]}`

## Get Table Records By ID

Retrieve records from a specific Exabeam AA context table using the provided unique identifier.

### Endpoint

- **URL:** `/context-management/v1/tables/{{id}}/records`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description**                                   |
| -------------------- | -------- | ------------ | ------------------------------------------------- |
| `path_parameters.id` | string   | Required     | Parameters for the Get Table Records By ID action |
| `parameters.limit`   | number   | Optional     | Parameters for the Get Table Records By ID action |
| `parameters.offset`  | number   | Optional     | Parameters for the Get Table Records By ID action |

### Input Example

`{"parameters":{"limit":1,"offset":2},"path_parameters":{"id":"emp_name_l8PFJfsH"}}`

### Output

| **Parameter**           | **Type** | **Description**                  |
| ----------------------- | -------- | -------------------------------- |
| `status_code`           | number   | HTTP status code of the response |
| `reason`                | string   | Response reason phrase           |
| `paging`                | object   | Output field: paging             |
| `paging.count`          | number   | Count value                      |
| `paging.limit`          | number   | Output field: paging.limit       |
| `paging.next`           | array    | Output field: paging.next        |
| `paging.next.file_name` | string   | Name of the resource             |
| `paging.next.file`      | string   | Output field: paging.next.file   |
| `paging.offset`         | number   | Output field: paging.offset      |
| `paging.pages`          | number   | Output field: paging.pages       |
| `paging.prev`           | array    | Output field: paging.prev        |
| `paging.prev.file_name` | string   | Name of the resource             |
| `paging.prev.file`      | string   | Output field: paging.prev.file   |
| `records`               | array    | Output field: records            |
| `records.attr_1`        | string   | Output field: records.attr\_1    |
| `records.attr_11`       | string   | Output field: records.attr\_11   |
| `records.attr_2`        | string   | Output field: records.attr\_2    |
| `records.attr_22`       | string   | Output field: records.attr\_22   |
| `records.attr_3`        | string   | Output field: records.attr\_3    |
| `records.attr_33`       | string   | Output field: records.attr\_33   |

### Output Example

`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"paging":{"count":3,"limit":25,"next":[],"offset":0,"pages":1,"prev":[]},"records":[{},{},{}]}}`

## Search Audit Events

Perform rapid search queries on audit events within Exabeam AA using specified fields, startTime, and endTime.

### Endpoint

- **URL:** `/audit/v1/events`
- **Method:** `POST`

### Input

| **Argument Name** | **Type** | **Required** | **Description**                                                        |
| ----------------- | -------- | ------------ | ---------------------------------------------------------------------- |
| `fields`          | array    | Optional     | List of fields to be returned from the audit search.                   |
| `startTime`       | string   | Optional     | ISO 8601 UTC timestamp to start the audit search.                      |
| `endTime`         | string   | Optional     | ISO 8601 UTC timestamp to end the audit search.                        |
| `limit`           | number   | Optional     | Limit the number of events returned from the audit search request.     |
| `groupBy`         | array    | Optional     | List of fields to GROUP BY.                                            |
| `orderBy`         | array    | Optional     | Order fields by ASC or DESC.                                           |
| `distinct`        | boolean  | Optional     | Include or exclude DISTINCT from the SELECT clause. Defaults to false. |
| `filter`          | string   | Optional     | Filter for specific audit events.                                      |

### Input Example

`{"json_body":{"fields":["id","id2"],"startTime":"2023-04-10T22:17:36.863Z","endTime":"2023-04-10T22:17:36.863Z","limit":3000,"groupBy":["a","b"],"orderBy":["ASC","DESC"],"distinct":false,"filter":"app:\\\"Search\\\" AND src_ip:\\\"00.00.000.000\\"}}`

### Output

| **Parameter**         | **Type** | **Description**                   |
| --------------------- | -------- | --------------------------------- |
| `status_code`         | number   | HTTP status code of the response  |
| `reason`              | string   | Response reason phrase            |
| `timeStartedMillis`   | number   | Output field: timeStartedMillis   |
| `timeCompletedMillis` | number   | Output field: timeCompletedMillis |
| `rows`                | array    | Output field: rows                |
| `rows.additionalProp` | object   | Output field: rows.additionalProp |
| `totalRows`           | number   | Output field: totalRows           |

### Output Example

`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"timeStartedMillis":0,"timeCompletedMillis":0,"rows":[{}],"totalRows":0}}`

## Track Ingestion Progress

Poll the status of an add records job in Exabeam AA using a provided tracker ID.

### Endpoint

- **URL:** `/context-management/v1/tables/uploadStatus/{{trackerId}}`
- **Method:** `GET`

### Input

| **Argument Name**           | **Type** | **Required** | **Description**                                    |
| --------------------------- | -------- | ------------ | -------------------------------------------------- |
| `path_parameters.trackerId` | string   | Required     | Parameters for the Track Ingestion Progress action |

### Input Example

`{"path_parameters":{"trackerId":"fbbc124ada3c4ffa94c3c60457512dd3"}}`

### Output

| **Parameter**   | **Type** | **Description**                  |
| --------------- | -------- | -------------------------------- |
| `status_code`   | number   | HTTP status code of the response |
| `reason`        | string   | Response reason phrase           |
| `totalErrors`   | number   | Error message if any             |
| `totalUploaded` | number   | Output field: totalUploaded      |
| `uploadStatus`  | string   | Status value                     |

### Output Example

`{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Sep 2023 20:37:23 GMT"},"reason":"OK","json_body":{"totalErrors":10,"totalUploaded":100,"uploadStatus":"inProgress"}}`

# Response Headers

| **Header**     | **Description**                                       | **Example**                  |
| -------------- | ----------------------------------------------------- | ---------------------------- |
| content-length | The length of the response body in bytes              | 140                          |
| content-type   | The media type of the resource                        | application/json             |
| Date           | The date and time at which the message was originated | Tue, 5 Sep 2023 20:37:23 GMT |