--- title: Exabeam Security Management Platform slug: connectors/exabeam-security-management-platform docTags: createdAt: 2026-06-09T16:30:26.468Z --- Exabeam Security Management Platform is a comprehensive security solution that enhances threat detection and response through advanced analytics and automation. Exabeam Security Management Platform is a comprehensive solution for security information and event management (SIEM) that enhances threat detection, investigation, and response. This connector allows Swimlane Turbine users to automate queries to the Exabeam Data Lake, enabling efficient data retrieval and analysis. By integrating with Exabeam, users can streamline their security operations, quickly access relevant data, and enhance their incident response capabilities through automated workflows. ## Prerequisites Before you can use the Exabeam Security Management Platform connector for Turbine, you'll need access to the Exabeam API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing the Exabeam API. - API Token: A valid API token for authenticating requests to the Exabeam platform. ## Capabilities The Exabeam Security Management Platform integration provides the following capabilities: - Query Data Lake ### Query Exabeam's Data Lake - The Exabeam Data Lake attempts to normalize the data from various sources but some unique variables may be missing. These variables can be found in the JSON payload which will have the entirety of the API response. - There are default queries to make automation more simple. They are as follows: - IP: `src_ip:"1.2.3.4" OR dest_ip:"1.2.3.4"` - Domain or URL: `"swimlane.com" AND data_type:"web-activity"` - other such as hash or username: `"username"` (just a raw search of the IOC input) - The `start_time` and `end_time` keys adds the time filter to the above queries and default to a 1-month look back. Ex. The IP query would be: `src_ip:"1.2.3.4" OR dest_ip:"1.2.3.4" AND indexTime=[2020-07-22T13:35:35+00:00 TO 2020-08-26T13:35:35+00:00]` unless the "time\_key" (indexTime) or the time look back is changed. ## Additional Documentation - [Exabeam Security Management Platform Connector Documentation](https://docs.swimlane.com/connectors/exabeam-security-management-platform) - [Exabeam Security Management Platform API Documentation](https://api.exabeam.com/) - [Exabeam Security Management Platform Authentication Guide](https://docs.swimlane.com/authentication-guides/exabeam-security-management-platform) # Configurations ## API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | ExaAuthToken | Exabeam Auth Token | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Query Data Lake Query the Data Lake in Exabeam Security Management Platform using specified cluster name and indices. ### Endpoint - **URL:** `/dl/api/es/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `cluster_name` | string | Required | Cluster name to query | | `indices` | array | Required | List of Indices to query | | `ioc` | string | Optional | The IOC to use in the default queries. Please see the connector documentation for more information. | | `custom_query` | string | Optional | If supplied, this query will be used and the IOC/default query will be ignored. | | `query_default_field` | string | Optional | Query Analyze Field | | `start_time` | string | Optional | Time value | | `end_time` | string | Optional | Time value | | `sort_field` | string | Optional | Parameter for Query Data Lake | | `sorted_fields` | array | Optional | Parameter for Query Data Lake | | `source` | boolean | Optional | Parameter for Query Data Lake | | `sort_order` | string | Optional | Parameter for Query Data Lake | | `highlight` | boolean | Optional | Parameter for Query Data Lake | | `query_analyze_wildcard` | boolean | Optional | Parameter for Query Data Lake | | `doc_values` | array | Optional | List of Doc Values. Defaults to \[indexTime] | | `time_key` | string | Optional | If filtering by time filter, which time key to filter by. Defaults to indexTime. | | `size` | number | Optional | How many records to return. Defaults to 100 | ### Input Example `{"cluster_name":"local","indices":["exabeam-*"],"ioc":"1.2.3.4","custom_query":"Custom Query","query_default_field":"message","start_time":"","end_time":"","sort_field":"indexTime","sorted_fields":["*"],"source":true,"sort_order":"desc","highlight":true,"query_analyze_wildcard":true,"doc_values":["indexTime"],"time_key":"indexTime","size":100}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ----------------------- | | `results` | object | Result of the operation | ### Output Example `{}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |