Exabeam
The Exabeam connector (exabeam, category siem) pulls notable risk-scored sessions and normalizes each into the AiSOC alert shape, mapping the source severity onto the five-tier ladder (info | low | medium | high | critical).
Setup
- In Connectors -> Add connector, choose Exabeam.
- Fill in the connection fields shown in the wizard (endpoint URL + API token; secrets are stored in the credential vault, never in plaintext).
- Click Test connection to verify credentials, then Save. The in-process scheduler begins polling on the default cadence.
Events flow through ingest (OCSF normalize) -> Kafka -> fusion, where detections fire and alerts are auto-triaged (copilot).
Configuration reference
| Field | Label | Type | Required | Default | Notes |
|---|---|---|---|---|---|
base_url | Cluster URL | string | yes | — | — |
api_key | API Key ID | secret | yes | — | encrypted at rest |
api_secret | API Secret | secret | yes | — | encrypted at rest |
verify_tls | Verify TLS certificate | boolean | no | True | — |
Credential handling
api_key, api_secret are encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API. See credential vault.