Exabeam

Purpose

The Exabeam integration enables AirMDR to:

Ingest Exabeam cases, and alerts that are not part of a case, with their risk scores, priorities, rules and MITRE ATT&CK techniques.
Investigate the threat timeline behind a case or alert: each detection with its risk score, rarity, the users and devices involved, and the query that reproduces its events.
Score users and hosts by Exabeam risk, the same way Exabeam defines entity risk, and flag notable entities.
Search raw event logs and read context tables such as watchlists.
Write results back to Exabeam: add case notes, update or close cases, update alerts, escalate alerts into cases, and add or remove watchlist records.

Supported Versions

Component	Compatibility
Exabeam products	Exabeam New-Scale Security Operations Platform, New-Scale Analytics, New-Scale Fusion and Exabeam SIEM, delivered from the Exabeam cloud.
APIs	Threat Center (v1 and v2 case endpoints), Search v2 and Context Management v1, through the regional API gateway `https://api.<region>.exabeam.cloud`. The Threat Center v1 case create and update endpoints, which Exabeam has deprecated, are not used.
Authentication	Exabeam API key (Key and Secret), exchanged for an OAuth 2.0 access token.
Not supported	Standalone on-premises Exabeam Advanced Analytics, which uses a different API.

Authentication

Authentication methodAirMDR authenticates with an Exabeam API key using the OAuth 2.0 client credentials flow:

Client ID: the Key value of the API key.
Client Secret: the Secret value of the API key.
API URL: the API gateway for your Exabeam region.

Exabeam access tokens last 4 hours and Exabeam asks integrations to request no more than 6 a day. AirMDR requests a token once and reuses it for its full life; the cached token is stored encrypted.

Permission sets

Exabeam API keys have no OAuth scopes. Each key is given a permission set when it is created. Choose the set that covers the skills you want AirMDR to run:

AirMDR capability	Exabeam permission
Search and read alerts, threat summaries	Threat Center alerts (Read)
Search and read cases, notes, history and threat timelines	Threat Center cases (Read)
Search raw event logs	Search, Analyze and Export (Read)
Read context tables	Context Management (Read)
Update or close cases, add notes, create cases, update alerts	The matching Threat Center write permission
Add or remove context table records	Context Management write permission

Exabeam names its permission sets in the API Keys dialog. If one set cannot cover everything, choose the one for the capabilities you need most: the connection check passes as long as the key can read alerts, cases or events.

Pre-requisites

An Exabeam administrator with full access to the subscription. Only full-access administrators can create API keys.

The region your Exabeam subscription is hosted in, which selects the API gateway.

You are logged in to AirMDR with a role that can manage integration connections.

Setup Steps

Create an API key

Sign in to the Exabeam Security Operations Platform.
On the lower left, select Settings, then API Keys.
Select New API Keys (or New Keys when keys already exist).
Enter a descriptive Key Name, such as AirMDR.
In Permissions, select the permission set that covers the capabilities you want, as listed under Permission sets above.
Select Create.
Copy the Key and the Secret into an approved password manager.

Exabeam shows the Secret only once. If it is lost, create a new key and update the AirMDR connection.

Create a key used only by AirMDR, so it can be rotated or revoked on its own.

Find your API gateway

Use the API gateway for your region, not the console address.

Exabeam region	Console address	API URL
US West	`https://org-name.exabeam.cloud`	`https://api.us-west.exabeam.cloud`
US East	`https://org-name.use1.exabeam.cloud`	`https://api.us-east.exabeam.cloud`
Canada	`https://org-name.ca.exabeam.cloud`	`https://api.ca.exabeam.cloud`
Europe	`https://org-name.eu.exabeam.cloud`	`https://api.eu.exabeam.cloud`
Saudi Arabia	`https://org-name.sa.exabeam.cloud`	`https://api.sa.exabeam.cloud`
Singapore	`https://org-name.sg.exabeam.cloud`	`https://api.sg.exabeam.cloud`
Switzerland	`https://org-name.euw6.exabeam.cloud`	`https://api.ch.exabeam.cloud`
Japan	`https://org-name.jp.exabeam.cloud`	`https://api.jp.exabeam.cloud`
Australia	`https://org-name.au.exabeam.cloud`	`https://api.au.exabeam.cloud`

AirMDR also accepts a region code such as us-east or your console address, and maps either to the right gateway.

Configure the connection in AirMDR

Open the Exabeam integration in the AirMDR Integrations Dashboard.
Select the Connections tab, then Add New Connection.
Enter a unique Instance name, such as yourorg-exabeam, and a short Description.
Enter the API URL, the Client ID (the Key) and the Client Secret (the Secret).
Select Save.

Saving runs a connection check: AirMDR requests a token and then makes one real read of alerts, cases or events. A wrong key, a wrong region, or a permission set that reaches none of them is reported immediately.

Skills Provided by this Integration

Skill	Purpose	Changes Exabeam
Search Exabeam Cases	Searches Threat Center cases in a time window by user, host, IP, priority, stage, queue, assignee, minimum risk score or an Exabeam query. Used to ingest Exabeam cases into AirMDR.	No
Search Exabeam Alerts	Searches Threat Center alerts in a time window by user, host, IP, priority, minimum risk score or an Exabeam query, including alerts that are not part of a case.	No
Get Exabeam Case Details	Retrieves one case with its analyst notes and, optionally, its stage and assignment history.	No
Get Exabeam Alert Details	Retrieves one alert with its users, hosts, rules and MITRE techniques.	No
Get Exabeam Threat Timeline	Retrieves the detections behind a case or alert, with risk and rarity scores, entities and the query that reproduces their events.	No
Get Exabeam Entity Risk	Scores users and hosts by the highest risk among the cases and alerts naming them, and flags notable entities.	No
Get Exabeam Threat Summary	Retrieves the Exabeam Copilot summary of an alert.	No
Search Exabeam Events	Searches raw event logs with an Exabeam query, with optional grouping and aggregation.	No
Get Exabeam Context Tables	Lists context tables, or reads the records of one, such as a watchlist.	No
Update Exabeam Case	Changes a case stage, closes it with a reason, reassigns it, or changes its queue, priority or tags.	Yes
Add Exabeam Case Note	Adds a note, such as the AirMDR investigation summary, to a case.	Yes
Create Exabeam Case	Escalates an alert into a case, or opens a case without an alert.	Yes
Update Exabeam Alert Details	Changes an alert name, description, priority or tags, or marks it read.	Yes
Manage Exabeam Context Table Records	Adds records to, or removes records from, a custom context table such as a watchlist.	Yes

To view the inputs and outputs of each skill, open the Exabeam integration, select the Skills tab, and select a skill.

Risk scores

Exabeam risk scores are on a 0 to 100 scale on New-Scale licenses, where Exabeam treats 90 or more as notable. Older Security Operations and Fusion licenses add up detection scores with no upper limit, where 75 or more is critical by default. The skills that filter or flag by risk take the threshold as an input, so set the threshold your analysts use.

Data Flow & Security

What AirMDR reads

Threat Center cases and alerts, their notes, history and threat timelines.
Raw event logs, when Search Exabeam Events is run.
Context table metadata and records.

What AirMDR can change

Only the skills marked Changes Exabeam above, and only when the API key has the matching write permission. A read-only permission set keeps the integration read-only.

Security

The Client Secret is stored encrypted and is sent only to the Exabeam token endpoint.
Access tokens are cached encrypted and reused for their 4-hour life. Saving the connection always requests a new one.
All calls use HTTPS to the Exabeam regional API gateway.

Error Handling

Issue	Resolution
`401` when the connection is saved	The Key, the Secret or the API URL is wrong. Check that the API URL is the gateway for the region of your subscription.
`403` naming a permission set	The key is valid but its permission set does not allow that call. Edit the key in Settings > API Keys and choose a set that includes it, then save the AirMDR connection again so the change applies immediately.
`429` rate limited	Exabeam limits API requests per source address. AirMDR retries automatically; if it persists, run fewer searches at once or narrow time windows.
No results	Read the `query` returned by the skill: it shows the filter and time window sent. Widen the window, or check the user or host spelling.
Results marked `truncated`	More records matched than were returned. Raise the limit or narrow the time window.

Evaluate the Exabeam API

Run the following commands to check that your API key works, replacing the region and credentials. Step 1: Request an access token

curl -X POST https://api.us-west.exabeam.cloud/auth/v1/token \
  -H "Content-Type: application/json" \
  -d '{"client_id": "<KEY>", "client_secret": "<SECRET>", "grant_type": "client_credentials"}'

A successful response is HTTP 200 with an access_token and expires_in of 14400 seconds. Step 2: Search the last day of cases

curl -X POST https://api.us-west.exabeam.cloud/threat-center/v1/search/cases \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"fields": ["caseId", "name", "riskScore", "stage"], "filter": "", "startTime": "<ISO_START>", "endTime": "<ISO_END>", "limit": 10}'

A successful response is HTTP 200 with a rows list. HTTP 403 means the permission set of the key does not include Threat Center cases.

Do not include the Secret or access tokens in screenshots, tickets, chat or email.

Support & Maintenance

Contact AirMDR Support through your designated support channel.
Rotate the API key at least every 12 months, as Exabeam recommends, and update the AirMDR connection with the new Key and Secret.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Pre-requisites

Setup Steps

Skills Provided by this Integration

Risk scores

Data Flow & Security

Error Handling

Evaluate the Exabeam API

Support & Maintenance

​Pre-requisites

​Setup Steps

​Skills Provided by this Integration

​Risk scores

​Data Flow & Security

​Error Handling

​Evaluate the Exabeam API

​Support & Maintenance

Pre-requisites

Setup Steps

Skills Provided by this Integration

Risk scores

Data Flow & Security

Error Handling

Evaluate the Exabeam API

Support & Maintenance