Exabeam Euba

Exabeam Advanced Analytics

Exabeam EUBA is a security analytics platform that detects insider threats and anomalous user behavior.

Exabeam EUBA is a powerful user and entity behavior analytics platform that enhances threat detection and response capabilities. This connector allows Swimlane Turbine users to seamlessly integrate with Exabeam EUBA, enabling the retrieval of detailed asset data, notable assets, risk timelines, security alerts, and user information. By leveraging this integration, security teams can automate the enrichment of security incidents, streamline threat investigations, and enhance their overall security posture with actionable insights from Exabeam EUBA.

Exabeam Advanced Analytics

The Exabeam Advanced Analytics connector integrates with Turbine to allow for automated actions using the Advanced Analytics API.

Prerequisites

Before you can use the Exabeam EUBA connector for Turbine, you'll need access to the Exabeam API. This requires the following:

an API key authentication using the following parameters:

URL: The endpoint URL for accessing Exabeam services.

Exabeam Authentication Token: A token used to authenticate API requests.

and OAuth2 authorization using the following parameters:

URL: The endpoint URL for accessing Exabeam services.

API Key: A key provided by Exabeam for API access.

API Key Secret: A secret associated with the API key for secure access.

HTTP Basic authentication using the following parameters:

URL: The endpoint URL for accessing Exabeam services.

Username: The username for authenticating with Exabeam.

Password: The password associated with the username for secure access.

Capabilities

This connector provides the following capabilities:

Get Asset Data

Get Asset Risk Timeline Data

Get Asset Security Alerts

Get Asset Sequence Triggered Rules

Get Notable Users

Get Session Info

Get Triggered Rule Stats Data

Get Triggered Rules Data

Get User Info

Get User Sequence Data

Additional Documentation

Exabeam Euba Connector Documentation

Exabeam Euba API Documentation

Configurations

Exabeam EUBA API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
ExaAuthToken	The Exabeam authentication token.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Exabeam EUBA HTTP Basic Authentication

Authenticates using username and password.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
username	Username	string	Required
password	Password	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Exabeam EUBA Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token_url		string	Optional
client_id	The API Key	string	Required
client_secret	The API Key secret.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Asset Data

Retrieve detailed asset data from Exabeam EUBA using a specific identifier such as hostname or IP address.

Endpoint

URL: /uba/api/asset/{{id}}/data

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Asset Data action

Input Example

{"path_parameters":{"id":"darnellw-offici or 8.8.8.8"}}

Output Example

{"json_body":{}}

Get Asset Notables

Retrieve a list of notable assets from Exabeam EUBA based on time frame and optional parameters: unit, num, and numberOfResults.

Endpoint

URL: /uba/api/assets/notable

Method: GET

Input

Argument Name	Type	Required	Description
parameters.unit	string	Required	The timeDuration unit.
parameters.num	number	Required	Number of timeDuration unit.
parameters.numberOfResults	number	Required	Number results to return.

Input Example

{"parameters":{"unit":"day","num":1,"numberOfResults":10}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
assets	array	Output field: assets
assets.asset	object	Output field: assets.asset
assets.asset.hostName	string	Name of the resource
assets.asset.ipAddress	string	Output field: assets.asset.ipAddress
assets.asset.assetType	string	Type of the resource
assets.asset.firstSeen	number	Output field: assets.asset.firstSeen
assets.asset.lastSeen	number	Output field: assets.asset.lastSeen
assets.asset.riskState	string	Output field: assets.asset.riskState
assets.asset.compromisedTime	number	Time value
assets.asset.riskSession	string	Output field: assets.asset.riskSession
assets.highestRiskScore	number	Score value
assets.highestRiskSequence	object	Output field: assets.highestRiskSequence
assets.highestRiskSequence.id	string	Unique identifier
assets.highestRiskSequence.entityName	string	Name of the resource
assets.highestRiskSequence.entityValue	string	Value for the parameter
assets.highestRiskSequence.day	number	Output field: assets.highestRiskSequence.day
assets.highestRiskSequence.triggeredRuleCountOpt	number	Output field: assets.highestRiskSequence.triggeredRuleCountOpt
assets.highestRiskSequence.riskScoreOpt	number	Output field: assets.highestRiskSequence.riskScoreOpt
assets.incidentIds	array	Unique identifier
assets.incidentIds.file_name	string	Unique identifier
assets.incidentIds.file	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 04 Nov 2024 13:09:02 GMT","Content-Type":"text/plain; charset=utf-8","Content-Length":"37","Connection":"keep-alive","Cache-Control":"no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Expires":"0","Pragma":"no-cache","Request-Time":"3","Set-Cookie":"CSRF_TOKEN=7941d625e16b411528c7a789109f671f905cf54d-1730725741886-c9a57a1f5b00f9...","Strict-Transport-Security":"max-age=31536000","Vary":"Accept-Encoding","X-Frame-Options":"SAMEORIG...

Get Asset Risk Timeline

Retrieve an asset's risk timeline from Exabeam EUBA using its unique ID and specified time range, including startTime and endTime.

Endpoint

URL: /uba/api/asset/{{id}}/sequences

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	The asset ID.
parameters.startTime	number	Required	Start time of the time range (in UNIX epoch time).
parameters.endTime	number	Required	End time of the time range (in UNIX epoch time).

Input Example

{"parameters":{"startTime":1726073820000,"endTime":1726073820000},"path_parameters":{"id":"darnellw-offici or 8.8.8.8"}}

Output Example

{"json_body":{}}

Get Asset Security Alerts

Retrieve security alerts linked to a specific asset in Exabeam EUBA by providing the unique asset ID.

Endpoint

URL: /uba/api/asset/{{id}}/securityAlerts

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Asset Security Alerts action
parameters.sortBy	string	Optional	Sort by a specific field.
parameters.sortOrder	number	Optional	Parameters for the Get Asset Security Alerts action
parameters.numberOfResults	number	Optional	Maximum number results to return.

Input Example

{"parameters":{"sortBy":"user","sortOrder":1,"numberOfResults":100},"path_parameters":{"id":"darnellw-offici or 8.8.8.8"}}

Output Example

{"json_body":{}}

Get Asset Sequence Triggered Rules

Retrieve details of rules triggered by an asset sequence in Exabeam EUBA using the specified asset ID.

Endpoint

URL: /uba/api/asset/sequence/{{id}}/triggeredRules

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Asset Sequence Triggered Rules action
parameters.limit	string	Optional	Parameters for the Get Asset Sequence Triggered Rules action

Input Example

{"parameters":{"limit":"20"},"path_parameters":{"id":"darnellw-offici or 8.8.8.8"}}

Output Example

{"json_body":{}}

Get Notable Users

Retrieve a list of notable users from Exabeam EUBA based on specified time frame and parameters like unit, num, and numberOfResults.

Endpoint

URL: /uba/api/users/notable

Method: GET

Input

Argument Name	Type	Required	Description
parameters.unit	string	Required	The timeDuration unit.
parameters.num	number	Required	Number of timeDuration unit.
parameters.numberOfResults	number	Required	Number results to return.

Input Example

{"parameters":{"unit":"day","num":1,"numberOfResults":10}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
users	array	Output field: users
users.user	object	Output field: users.user
users.user.username	string	Name of the resource
users.user.riskScore	number	Score value
users.user.averageRiskScore	number	Score value
users.user.pastScores	array	Output field: users.user.pastScores
users.user.lastSessionId	string	Unique identifier
users.user.firstSeen	number	Output field: users.user.firstSeen
users.user.lastSeen	number	Output field: users.user.lastSeen
users.user.lastActivityType	string	Type of the resource
users.user.lastActivityTime	number	Time value
users.user.labels	array	Output field: users.user.labels
users.user.pendingRiskTransfers	array	Output field: users.user.pendingRiskTransfers
users.user.pendingRiskTransfers.ruleId	object	Unique identifier
users.user.pendingRiskTransfers.ruleId.name	string	Unique identifier
users.user.pendingRiskTransfers.sourceSequenceName	string	Name of the resource
users.user.pendingRiskTransfers.sourceEventId	string	Unique identifier
users.user.pendingRiskTransfers.score	number	Score value
users.user.pendingRiskTransfers.time	number	Time value
users.user.latestUserComment	object	Output field: users.user.latestUserComment
users.user.latestUserComment.commentId	string	Unique identifier
users.user.latestUserComment.commentType	string	Type of the resource
users.user.latestUserComment.commentObjectId	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 2 May 2024 20:37:23 GMT"},"reason":"OK","json_body":{"users":[{}]}}

Get Session Info

Retrieve detailed information for a specific session in Exabeam EUBA using the provided unique identifier.

Endpoint

URL: /uba/api/session/{{id}}/info

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Session Info action

Input Example

{"path_parameters":{"id":"darnellw-offici or 8.8.8.8"}}

Output Example

{"json_body":{}}

Get Triggered Rule Stats

Retrieve statistical data for a specific triggered rule in Exabeam EUBA using the provided unique identifier.

Endpoint

URL: /uba/api/triggeredRules/{{id}}/stats

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get Triggered Rule Stats action
parameters.minNumberOfBytes	number	Optional	Parameters for the Get Triggered Rule Stats action
parameters.numberOfResults	number	Optional	Parameters for the Get Triggered Rule Stats action

Input Example

{"parameters":{"minNumberOfBytes":1024,"numberOfResults":20},"path_parameters":{"id":"darnellw-offici or 8.8.8.8"}}

Output Example

{"json_body":{}}

Get Triggered Rules Data

Retrieve data for all rules triggered within a specific sequence in Exabeam EUBA.

Endpoint

URL: /uba/api/user/sequence/triggeredRules

Method: GET

Input

Argument Name	Type	Required	Description
parameters.sequenceId	string	Optional	Parameters for the Get Triggered Rules Data action
parameters.sequenceType	string	Optional	Parameters for the Get Triggered Rules Data action

Input Example

{"parameters":{"sequenceId":"[email protected]","sequenceType":"Sequence Type"}}

Output Example

{"json_body":{}}

Get User Info

Retrieve enriched user information, behavioral patterns, and risk scores for a specified ID from Exabeam EUBA.

Endpoint

URL: /uba/api/user/{{id}}/info

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get User Info action

Input Example

{"path_parameters":{"id":"darnell.waters"}}

Output Example

{"json_body":{}}

Get User Sequences Data

Retrieve user sessions, account lockouts, and data feeds for a specified username within a defined time range in Exabeam EUBA.

Endpoint

URL: /uba/api/user/{{username}}/sequences

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.username	string	Required	Username to fetch data.
parameters.startTime	number	Required	Start time of the time range (in UNIX epoch time).
parameters.endTime	number	Required	End time of the time range (in UNIX epoch time).

Input Example

{"parameters":{"startTime":1726073820000,"endTime":1726073820000},"path_parameters":{"username":"darnell.waters"}}

Output Example

{"json_body":{}}

Get User Watchlists

Retrieve a list of user watchlists from Exabeam EUBA using the specified 'id' path parameter.

Endpoint

URL: /uba/api/watchlist/user/{{id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.id	string	Required	Parameters for the Get User Watchlists action

Input Example

{"path_parameters":{"id":"swimlane"}}

Output Example

{"json_body":{}}

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache, no-store, must-revalidate
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	8dd4d60a8a6e2e9c-HYD
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	37
Content-Type	The media type of the resource	text/plain; charset=utf-8
Date	The date and time at which the message was originated	Thu, 2 May 2024 20:37:23 GMT
Expires	The date/time after which the response is considered stale	0
Pragma	HTTP response header: Pragma	no-cache
Request-Time	HTTP response header: Request-Time	3
Server	Information about the software used by the origin server	cloudflare
Set-Cookie	HTTP response header: Set-Cookie	CSRF_TOKEN=7941d625e16b411528c7a789109f671f905cf54d-1730725741886-c9a57a1f5b00f99552e6d6ae; Path=/; Secure; HTTPOnly
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000
Vary	HTTP response header: Vary	Accept-Encoding
X-Frame-Options	HTTP response header: X-Frame-Options	SAMEORIGIN