Exabeam Threat Center API

The Exabeam Threat Center API enables organizations to manage and respond to security incidents through advanced threat detection and case management.

Exabeam Threat Center is a comprehensive security platform designed to enhance threat detection and response capabilities. This connector allows seamless integration with Swimlane Turbine, enabling users to automate alert and case management tasks such as creating, updating, and retrieving details for alerts and cases. By leveraging this integration, security teams can streamline their workflows, reduce manual effort, and enhance their incident response efficiency within the Swimlane Turbine environment.

Supported Version

The Exabeam Threat Center connector supports the latest API version.

Limitations

None to date.

Prerequisites

Before you can use the Exabeam Threat Center API connector for Turbine, you'll need access to the Exabeam API. This requires the following:

OAuth 2.0 Client Credentials authentication using the following parameters:

URL: The endpoint for accessing the Exabeam API.

Client ID: The unique identifier for your application.

Client Secret: The secret key associated with your client ID.

Token URL: The URL used to obtain the OAuth token.

Capabilities

This Connector provides the following capabilities:

Create a new Case

Create a Note for a Case

Get Alert Details

Get Case Details

Get Case Notes

Get Threat Summary

Search for Alerts

Search for Cases

Update Alert Details

Update Case Details

Create a new Case

Creates a new case associated with an alert and updates case details like stage, priority, queue, assignee, closedReason.

Exabeam's documentation for this action can be found here.

Create a Note for a Case

Add a new note to the specified case.

Exabeam's documentation for this action can be found here.

Get Alert Details

Get details for a specific alert, as identified by an alert ID.

Exabeam's documentation for this action can be found here.

Get Case Details

Get details for a specific case, as identified by a case ID.

Exabeam's documentation for this action can be found here.

Get Case Notes

Retrieve a list of notes associated with the specified caseId.

Exabeam's documentation for this action can be found here.

Get Threat Summary

Retrieve the Copilot Threat Summary for an individual alert.

Exabeam's documentation for this action can be found here.

Search for Alerts

Search for alerts that match one or more search criteria.

Exabeam's documentation for this action can be found here.

Search for Cases

Search for cases that match one or more search criteria.

Exabeam's documentation for this action can be found here.

Update Alert Details

Update details for a specific alert, as identified by an alert ID.

Exabeam's documentation for this action can be found here.

Update Case Details

Update details for a specific case, as identified by case ID.

Exabeam's documentation for this action can be found here.

Configurations

Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token_url		string	Required
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
scope	Permission scopes for this action.	array	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Create a new Case

Create a new case in Exabeam Threat Center linked to an alert, updating details such as stage, priority, queue, assignee, and closed reason. Requires alertId and priority.

Endpoint

URL: /threat-center/v2/cases

Method: POST

Input

Argument Name	Type	Required	Description
priority	string	Optional	The priority of the case. Allowed values are LOW, MEDIUM, HIGH, CRITICAL.
alertId	string	Optional	Alert UUID.
assignee	string	Optional	Assignee for the case.
stage	string	Optional	Case stage.
queue	string	Optional	Queue assigned for the case.
closedReason	string	Optional	Reason for case closure.
supportingReason	string	Optional	Additional details for the closedReason.

Input Example

{"json_body":{"priority":"CRITICAL","alertId":"adafff9a-0669-460b-ba2b-8bffda64a968","assignee":"[email protected]","stage":"CLOSED","queue":"Tier 1","closedReason":"Already Mitigated or Resolved","supportingReason":"The issue identified by the threat has already been addressed or resolved."}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alertCreationTimestamp	string	Output field: alertCreationTimestamp
alertId	string	Unique identifier
approxLogTime	string	Time value
assignee	string	Output field: assignee
creationTimestamp	string	Output field: creationTimestamp
caseId	string	Unique identifier
caseNumber	number	Output field: caseNumber
creationBy	string	Output field: creationBy
stage	string	Output field: stage
closedReason	string	Response reason phrase
supportingReason	string	Response reason phrase
alertDescription	string	Output field: alertDescription
hasAttachments	boolean	Output field: hasAttachments
isDeleted	boolean	Output field: isDeleted
lastModifiedBy	string	Output field: lastModifiedBy
lastModifiedTimestamp	string	Output field: lastModifiedTimestamp
mitres	array	Output field: mitres
mitres.tacticKey	string	Output field: mitres.tacticKey
mitres.tactic	string	Output field: mitres.tactic
mitres.techniqueKey	string	Output field: mitres.techniqueKey
mitres.technique	string	Output field: mitres.technique
alertName	string	Name of the resource
priority	string	Output field: priority

Output Example

{"status_code":200,"reason":"OK","json_body":{"alertCreationTimestamp":"2024-03-18T09:35:36.179","alertId":"adafff9a-0669-460b-ba2b-8bffda64a968","approxLogTime":"2024-03-18T09:26:17.192","assignee":"[email protected]","creationTimestamp":"2024-06-12T16:41:04.841","caseId":"0ba39dc8-718b-4e71-98ab-81a61a8ecd89","caseNumber":10,"creationBy":"system","stage":"CLOSED","closedReason":"Already Mitigated or Resolved","supportingReason":"The issue identified by the threat has already been addressed ...

Create a note for a case

Add a new note to a specified case in Exabeam Threat Center API using the caseId as a path parameter.

Endpoint

URL: /threat-center/v1/cases/{{caseId}}/notes

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	The unique identifier of the case to which the note will be added.
note	string	Optional	The content of the note to be added to the case.

Input Example

{"json_body":{"note":"This is a note."},"path_parameters":{"caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":[{"noteId":"5b6f2b9c-9c7a-4c1a-8b32-2b8e5f1d2a10","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"[email protected]","creationTimestamp":"2024-06-12T09:15:30Z","lastModifiedBy":"[email protected]","lastModifiedTimestamp":"2024-06-12T09:15:30Z","text":"Investigating login anomalies."},{"noteId":"7a1d8c2e-3b9a-4e15-9b1f-4f2d1a7c3b55","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"[email protected]","creationTimes...

Get alert details

Retrieve detailed information for a specific alert in Exabeam Threat Center using the alert ID.

Endpoint

URL: /threat-center/v1/alerts/{{alertId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	The unique identifier of the alert for which details are being requested.

Input Example

{"path_parameters":{"alertId":"96de8f5c-ae11-48e8-ace9-c38bb6e056d3"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
creationTimestamp	string	Output field: creationTimestamp
alertId	string	Unique identifier
approxLogTime	string	Time value
creationBy	string	Output field: creationBy
alertDescription	string	Output field: alertDescription
lastModifiedBy	string	Output field: lastModifiedBy
lastModifiedTimestamp	string	Output field: lastModifiedTimestamp
mitres	array	Output field: mitres
mitres.tacticKey	string	Output field: mitres.tacticKey
mitres.tactic	string	Output field: mitres.tactic
mitres.techniqueKey	string	Output field: mitres.techniqueKey
mitres.technique	string	Output field: mitres.technique
alertName	string	Name of the resource
priority	string	Output field: priority
riskScore	number	Score value
status	string	Status value
tags	array	Output field: tags
useCases	array	Output field: useCases
products	array	Output field: products
vendors	array	Output field: vendors
srcHosts	array	Output field: srcHosts
srcIps	array	Output field: srcIps
destHosts	array	Output field: destHosts

Output Example

{"status_code":200,"reason":"OK","json_body":{"creationTimestamp":"2024-04-10T09:16:09.915","alertId":"5119d712-1d4c-4da4-9ae5-fd8ea7d88c20","approxLogTime":"2024-04-10T09:11:30.934","creationBy":"system","alertDescription":"Multiple Anomalies detected for user","lastModifiedBy":"[email protected]","lastModifiedTimestamp":"2024-04-17T08:32:02.522","mitres":[{"tacticKey":"TA0004","tactic":"Privilege Escalation","techniqueKey":"T1078","technique":"Valid Accounts"},{"tacticKey":"TA0011","tactic...

Get Case Details

Get details for a specific case in Exabeam Threat Center using the provided case ID.

Endpoint

URL: /threat-center/v1/cases/{{caseId}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	The unique identifier of the case for which details are being requested.

Input Example

{"path_parameters":{"caseId":"bfd46b02-9a78-4808-a0d7-9db1a5b6e239"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alertCreationTimestamp	string	Output field: alertCreationTimestamp
alertId	string	Unique identifier
approxLogTime	string	Time value
assignee	string	Output field: assignee
assigneeId	string	Unique identifier
creationTimestamp	string	Output field: creationTimestamp
caseId	string	Unique identifier
caseNumber	number	Output field: caseNumber
creationBy	string	Output field: creationBy
stage	string	Output field: stage
closedReason	string	Response reason phrase
alertDescription	string	Output field: alertDescription
hasAttachments	boolean	Output field: hasAttachments
isDeleted	boolean	Output field: isDeleted
lastModifiedBy	string	Output field: lastModifiedBy
lastModifiedTimestamp	string	Output field: lastModifiedTimestamp
mitres	array	Output field: mitres
mitres.tacticKey	string	Output field: mitres.tacticKey
mitres.tactic	string	Output field: mitres.tactic
mitres.techniqueKey	string	Output field: mitres.techniqueKey
mitres.technique	string	Output field: mitres.technique
alertName	string	Name of the resource
priority	string	Output field: priority

Output Example

{"status_code":200,"reason":"OK","json_body":{"alertCreationTimestamp":"2024-04-17T11:45:54.421","alertId":"c867bae5-3c21-4c98-a142-953c01dce1df","approxLogTime":"2024-04-17T11:41:47.564","assignee":"[email protected]","assigneeId":"64f9e3ef1793b179824a8961","creationTimestamp":"2024-04-17T11:48:47.559","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","caseNumber":10,"creationBy":"system","stage":"CLOSED","closedReason":"Closed via automation","alertDescription":"Suspicious activity detected ...

Get Case Notes

Retrieve a list of notes associated with the specified caseId from the Exabeam Threat Center API.

Endpoint

URL: /threat-center/v1/cases/{{caseId}}/notes

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Parameters for the Get Case Notes action

Input Example

{"path_parameters":{"caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":[{"noteId":"5b6f2b9c-9c7a-4c1a-8b32-2b8e5f1d2a10","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"[email protected]","creationTimestamp":"2024-06-12T09:15:30Z","lastModifiedBy":"[email protected]","lastModifiedTimestamp":"2024-06-12T09:15:30Z","text":"Investigating login anomalies."},{"noteId":"7a1d8c2e-3b9a-4e15-9b1f-4f2d1a7c3b55","caseId":"e77e5002-bd35-4e7b-a532-cd76341ef6f3","creationBy":"[email protected]","creationTimes...

Get threat summary

Retrieve the Copilot Threat Summary for an individual alert in Exabeam Threat Center API using the alertId.

Endpoint

URL: /threat-center/v1/alerts/threat-explainer/prompt

Method: POST

Input

Argument Name	Type	Required	Description
parameters.alertCreationTimestamp	string	Optional	Parameters for the Get threat summary action
alertId	string	Optional	Unique ID that identifies an alert.
prompt	string	Optional	Provide relevant data or details about a specific threat to provide additional context and input for the AI-generated summary.

Input Example

{"parameters":{"alertCreationTimestamp":"2024-06-01T00:00:00Z"},"json_body":{"alertId":"cb00d8ca-a4fa-490b-a5a8-9dca5e61d19b","prompt":"When is the rule WEB-OC-F triggered?"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
message	string	Response message

Output Example

{"status_code":200,"reason":"OK","json_body":{"message":"The rule WEB-OC-F is triggered when a web request results in a **failure**. Spec..."}}

Search for alerts

Search for alerts in Exabeam Threat Center API that match specified criteria, including startTime, endTime, fields, and filter.

Endpoint

URL: /threat-center/v1/search/alerts

Method: POST

Input

Argument Name	Type	Required	Description
limit	number	Optional	Limit the number of results returned from the search request.
orderBy	array	Optional	Order results by a specified field in ASC or DESC order.
startTime	string	Optional	Timestamp to start the search (ISO-8601 format)
endTime	string	Optional	Timestamp to end the search (ISO-8601 format)
filter	string	Optional	Filter for specific results.
fields	array	Optional	List of fields to be returned from the search. Use * to return all applicable fields.

Input Example

{"json_body":{"limit":3000,"orderBy":["riskScore DESC"],"startTime":"2024-05-01T00:00:00Z","endTime":"2024-06-01T00:00:00Z","filter":"caseId:null","fields":["alert_123"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
timeStartedMillis	number	Output field: timeStartedMillis
timeCompletedMillis	number	Output field: timeCompletedMillis
rows	array	Output field: rows
totalRows	number	Output field: totalRows

Output Example

{"status_code":200,"reason":"OK","json_body":{"timeStartedMillis":0,"timeCompletedMillis":0,"rows":[{}],"totalRows":0}}

Search for Cases

Search for cases in Exabeam Threat Center API that match specified criteria, including startTime, endTime, fields, and filter.

Endpoint

URL: /threat-center/v1/search/cases

Method: POST

Input

Argument Name	Type	Required	Description
limit	number	Optional	Limit the number of results returned from the search request.
orderBy	array	Optional	Order results by a specified field in ASC or DESC order.
fields	array	Optional	List of fields to be returned from the search. Use * to return all applicable fields.
startTime	string	Optional	Timestamp to start the search (ISO-8601 format)
endTime	string	Optional	Timestamp to end the search (ISO-8601 format)
filter	string	Optional	Filter for specific results.

Input Example

{"json_body":{"limit":3000,"orderBy":["riskScore DESC"],"fields":["alert_123"],"startTime":"2024-05-01T00:00:00Z","endTime":"2024-06-01T00:00:00Z","filter":"NOT stage:\"CLOSED\""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
timeStartedMillis	number	Output field: timeStartedMillis
timeCompletedMillis	number	Output field: timeCompletedMillis
rows	array	Output field: rows
totalRows	number	Output field: totalRows

Output Example

{"status_code":200,"reason":"OK","json_body":{"timeStartedMillis":0,"timeCompletedMillis":0,"rows":[{}],"totalRows":0}}

Update alert details

Update details for a specific alert in Exabeam Threat Center using the alert ID as a path parameter.

Endpoint

URL: /threat-center/v1/alerts/{{alertId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.alertId	string	Required	Unique ID that identifies an alert.
alertDescription	string	Optional	Alert description in either plaintext or HTML format.
alertName	string	Optional	Name of the alert.
priority	string	Optional	Priority level of the alert.
tags	array	Optional	List of tags associated with the alert.

Input Example

{"json_body":{"alertDescription":"Suspicious activity detected on host","alertName":"Multiple Anomalies Detected","priority":"CRITICAL","tags":["Log4j"]},"path_parameters":{"alertId":"eab6bb52-7686-43c2-ba7e-304cae0b75dd"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
creationTimestamp	string	Output field: creationTimestamp
alertId	string	Unique identifier
approxLogTime	string	Time value
creationBy	string	Output field: creationBy
alertDescription	string	Output field: alertDescription
lastModifiedBy	string	Output field: lastModifiedBy
lastModifiedTimestamp	string	Output field: lastModifiedTimestamp
mitres	array	Output field: mitres
mitres.tacticKey	string	Output field: mitres.tacticKey
mitres.tactic	string	Output field: mitres.tactic
mitres.techniqueKey	string	Output field: mitres.techniqueKey
mitres.technique	string	Output field: mitres.technique
alertName	string	Name of the resource
priority	string	Output field: priority
riskScore	number	Score value
status	string	Status value
tags	array	Output field: tags
useCases	array	Output field: useCases
products	array	Output field: products
vendors	array	Output field: vendors
srcHosts	array	Output field: srcHosts
srcIps	array	Output field: srcIps
destHosts	array	Output field: destHosts

Output Example

{"status_code":200,"reason":"OK","json_body":{"creationTimestamp":"2024-03-18T09:40:01.972","alertId":"eab6bb52-7686-43c2-ba7e-304cae0b75dd","approxLogTime":"2024-03-18T09:30:42.312","creationBy":"system","alertDescription":"Suspicious activity detected on host","lastModifiedBy":"[email protected]","lastModifiedTimestamp":"2024-05-29T12:26:17.670","mitres":[{}],"alertName":"Failed login attempts to application initiated multiple times","priority":"LOW","riskScore":10,"status":"READ","tags":[...

Update Case Details

Update details for a specific case in Exabeam Threat Center using the case ID as a path parameter.

Endpoint

URL: /threat-center/v2/cases/{{caseId}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.caseId	string	Required	Unique ID that identifies a case.
alertDescription	string	Optional	Alert description in either plaintext or HTML format.
alertName	string	Optional	Name of the alert.
priority	string	Optional	Priority level of the case.
tags	array	Optional	Tags to group cases.
stage	string	Optional	Current stage of the case.
closedReason	string	Optional	Reason for closing the case, if applicable.
supportingReason	string	Optional	Additional context for the closed reason, if applicable.
assignee	string	Optional	User assigned to the case for investigation and resolution.
queue	string	Optional	Queue for the case.

Input Example

{"json_body":{"alertDescription":"Suspicious activity detected on host","alertName":"Multiple Anomalies Detected","priority":"CRITICAL","tags":["Log4j"],"stage":"INVESTIGATION","closedReason":"False Positive or Duplicate","supportingReason":"The issue identified by the threat has already been addressed or resolved.","assignee":"[email protected]","queue":"Tier 1"},"path_parameters":{"caseId":"ab10c168-7f62-4892-b8e7-d4ee73c82f08"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
alertCreationTimestamp	string	Output field: alertCreationTimestamp
alertId	string	Unique identifier
approxLogTime	string	Time value
assignee	string	Output field: assignee
creationTimestamp	string	Output field: creationTimestamp
caseId	string	Unique identifier
caseNumber	number	Output field: caseNumber
creationBy	string	Output field: creationBy
stage	string	Output field: stage
closedReason	string	Response reason phrase
supportingReason	string	Response reason phrase
alertDescription	string	Output field: alertDescription
hasAttachments	boolean	Output field: hasAttachments
isDeleted	boolean	Output field: isDeleted
lastModifiedBy	string	Output field: lastModifiedBy
lastModifiedTimestamp	string	Output field: lastModifiedTimestamp
mitres	array	Output field: mitres
mitres.tacticKey	string	Output field: mitres.tacticKey
mitres.tactic	string	Output field: mitres.tactic
mitres.techniqueKey	string	Output field: mitres.techniqueKey
mitres.technique	string	Output field: mitres.technique
alertName	string	Name of the resource
priority	string	Output field: priority

Output Example

{"status_code":200,"reason":"OK","json_body":{"alertCreationTimestamp":"2024-04-05T20:11:41.528","alertId":"4331d707-7cbd-4d48-a689-cb230827a442","approxLogTime":"2024-04-05T20:03:000","assignee":"[email protected]","creationTimestamp":"2024-04-05T20:17:41.226","caseId":"ab10c168-7f62-4892-b8e7-d4ee73c82f08","caseNumber":10,"creationBy":"system","stage":"CLOSED","closedReason":"Already Mitigated or Resolved","supportingReason":"The issue identified by the threat has already been addressed or ...

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT

Docs powered by Archbee