Exabeam Security Management Platform
Exabeam Security Management Platform is a comprehensive security solution that enhances threat detection and response through advanced analytics and automation.
Exabeam Security Management Platform is a comprehensive solution for security information and event management (SIEM) that enhances threat detection, investigation, and response. This connector allows Swimlane Turbine users to automate queries to the Exabeam Data Lake, enabling efficient data retrieval and analysis. By integrating with Exabeam, users can streamline their security operations, quickly access relevant data, and enhance their incident response capabilities through automated workflows.
Prerequisites
Before you can use the Exabeam Security Management Platform connector for Turbine, you'll need access to the Exabeam API. This requires the following:
- an API key authentication using the following parameters:
- URL: The endpoint URL for accessing the Exabeam API.
- API Token: A valid API token for authenticating requests to the Exabeam platform.
Capabilities
The Exabeam Security Management Platform integration provides the following capabilities:
- Query Data Lake
Query Exabeam's Data Lake
- The Exabeam Data Lake attempts to normalize the data from various sources but some unique variables may be missing. These variables can be found in the JSON payload which will have the entirety of the API response.
- There are default queries to make automation more simple. They are as follows:
- IP: src_ip:"1.2.3.4" OR dest_ip:"1.2.3.4"
- Domain or URL: "swimlane.com" AND data_type:"web-activity"
- other such as hash or username: "username" (just a raw search of the IOC input)
- The start_time and end_time keys adds the time filter to the above queries and default to a 1-month look back. Ex. The IP query would be: src_ip:"1.2.3.4" OR dest_ip:"1.2.3.4" AND indexTime=[2020-07-22T13:35:35+00:00 TO 2020-08-26T13:35:35+00:00] unless the "time_key" (indexTime) or the time look back is changed.
Additional Documentation
Configurations
API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
ExaAuthToken | Exabeam Auth Token | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Query Data Lake
Query the Data Lake in Exabeam Security Management Platform using specified cluster name and indices.
Endpoint
- URL: /dl/api/es/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
cluster_name | string | Required | Cluster name to query |
indices | array | Required | List of Indices to query |
ioc | string | Optional | The IOC to use in the default queries. Please see the connector documentation for more information. |
custom_query | string | Optional | If supplied, this query will be used and the IOC/default query will be ignored. |
query_default_field | string | Optional | Query Analyze Field |
start_time | string | Optional | Time value |
end_time | string | Optional | Time value |
sort_field | string | Optional | Parameter for Query Data Lake |
sorted_fields | array | Optional | Parameter for Query Data Lake |
source | boolean | Optional | Parameter for Query Data Lake |
sort_order | string | Optional | Parameter for Query Data Lake |
highlight | boolean | Optional | Parameter for Query Data Lake |
query_analyze_wildcard | boolean | Optional | Parameter for Query Data Lake |
doc_values | array | Optional | List of Doc Values. Defaults to [indexTime] |
time_key | string | Optional | If filtering by time filter, which time key to filter by. Defaults to indexTime. |
size | number | Optional | How many records to return. Defaults to 100 |
Input Example
{"cluster_name":"local","indices":["exabeam-*"],"ioc":"1.2.3.4","custom_query":"Custom Query","query_default_field":"message","start_time":"","end_time":"","sort_field":"indexTime","sorted_fields":["*"],"source":true,"sort_order":"desc","highlight":true,"query_analyze_wildcard":true,"doc_values":["indexTime"],"time_key":"indexTime","size":100}
Output
Parameter | Type | Description |
|---|---|---|
results | object | Result of the operation |
Output Example
{}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |