Exabeam

The Exabeam Security Management Platform provides end-to-end detection, User Event Behavioral Analytics, and SOAR. This integration was integrated and tested with version xx of Exabeam11

Configure Exabeam on Demisto

  1. Navigate to Settings > Integrations > Servers & Services .
  2. Search for Exabeam.
  3. Click Add instance to create and configure a new integration instance.
    • Name : a textual name for the integration instance.
    • Server URL (e.g https://192.168.0.1:{port})
    • Username
    • Trust any certificate (not secure)
    • Use system proxy settings
  4. Click Test to validate the new instance.

Commands

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. Returns notable users in a period of time: exabeam-get-notable-users
  2. Returns all watchlist IDs and titles: exabeam-get-watchlists
  3. Returns all peer groups: exabeam-get-peer-groups
  4. Returns user information data for the username: exabeam-get-user-info
  5. Returns all labels of the user: exabeam-get-user-labels
  6. Returns sessions for the given username and time range: exabeam-get-user-sessions
  7. Deletes a watchlist: exabeam-delete-watchlist
  8. Returns asset data: exabeam-get-asset-data

1. exabeam-get-notable-users

Returns notable users in a period of time.

Base Command

exabeam-get-notable-users

Input
Argument Name Description Required
time_period The time period for which to fetch notable users, such as 3 months, 2 days, 4 hours, 1 year, and so on. Required
limit The maximum number of returned results. Required

Context Output
Path Type Description
Exabeam.User.RiskScore Number The risk score of the notable user.
Exabeam.User.UserFullName String The full name of the user.
Exabeam.User.AverageRiskScore Number The average risk score of the user.
Exabeam.User.FirstSeen Date The date the user was first seen.
Exabeam.User.NotableSessionIds String The ID of the notable session.
Exabeam.User.AccountsNumber Number The number of accounts.
Exabeam.User.LastSeen Date The date the user was last seen.
Exabeam.User.Location String The location of the user.
Exabeam.User.UserName String The name of the user.
Exabeam.User.Labels String The labels of the user.
Exabeam.User.LastActivityType String The last activity type of the user.
Exabeam.User.NotableUser Boolean Whether the user is a notable user.

Command Example

!exabeam-get-notable-users limit=3 time_period="1 year"

Context Example 
{
    "Exabeam.User": [
        {
            "Department": "IT",
            "EmployeeType": "employee",
            "FirstSeen": "2018-08-01T11:50:16",
            "HighestRiskSession": {
                "accounts": [
                    "account_name"
                ],
                "endTime": 1535991695000,
                "initialRiskScore": 9,
                "label": "",
                "loginHost": "login_host",
                "numOfAccounts": 1,
                "numOfAssets": 5,
                "numOfEvents": 6,
                "numOfReasons": 9,
                "numOfSecurityEvents": 0,
                "numOfZones": 0,
                "riskScore": 265,
                "sessionId": "session_id",
                "startTime": 1535973498000,
                "username": "username",
                "zones": []
            },
            "Labels": [
                "privileged_user"
            ],
            "LastActivity": "Account is active",
            "LastSeen": "2018-09-09T16:36:13",
            "Location": "Atlanta",
            "NotableSessionIds": [
                "session_id"
            ],
            "NotableUser": true,
            "RiskScore": null,
            "Title": "Network Engineer",
            "UserFullName": "full_name",
            "UserName": "username"
        },
        {
            "Department": "HR",
            "EmployeeType": "employee",
            "FirstSeen": "2018-07-03T14:26:26",
            "HighestRiskSession": {
                "accounts": [
                    "account_name"
                ],
                "endTime": 1538233298000,
                "initialRiskScore": 14,
                "label": "vpn-in",
                "loginHost": "login_host",
                "numOfAccounts": 2,
                "numOfAssets": 14,
                "numOfEvents": 15,
                "numOfReasons": 9,
                "numOfSecurityEvents": 1,
                "numOfZones": 0,
                "riskScore": 169,
                "sessionId": "session_id",
                "startTime": 1538222645000,
                "username": "username",
                "zones": []
            },
            "Labels": [],
            "LastActivity": "Account is active",
            "LastSeen": "2018-09-30T16:27:01",
            "Location": "Chicago",
            "NotableSessionIds": [
                "session_id"
            ],
            "NotableUser": true,
            "RiskScore": null,
            "Title": "Human Resources Coordinator",
            "UserFullName": "full name",
            "UserName": "username"
        },
        {
            "Department": "Sales",
            "EmployeeType": "employee",
            "FirstSeen": "2018-08-10T15:55:25",
            "HighestRiskSession": {
                "accounts": [
                    "hosborne"
                ],
                "endTime": 1538281057000,
                "initialRiskScore": 0,
                "label": "",
                "loginHost": "",
                "numOfAccounts": 1,
                "numOfAssets": 3,
                "numOfEvents": 62,
                "numOfReasons": 8,
                "numOfSecurityEvents": 1,
                "numOfZones": 0,
                "riskScore": 132,
                "sessionId": "session_id",
                "startTime": 1538250305000,
                "username": "username",
                "zones": []
            },
            "Labels": [
                "privileged_user"
            ],
            "LastActivity": "Account is active",
            "LastSeen": "2018-09-30T16:27:01",
            "Location": "Atlanta",
            "NotableSessionIds": [
                "session_id"
            ],
            "NotableUser": true,
            "RiskScore": null,
            "Title": "Sales Representative",
            "UserFullName": "fullname",
            "UserName": "username"
        }
    ]
}
Human Readable Output

Exabeam Notable Users:

UserName UserFullName Title Department Labels NotableSessionIds EmployeeType FirstSeen LastSeen LastActivity Location
username fullname Network Engineer IT privileged_user session_id employee 2018-08-01T11:50:16 2018-09-09T16:36:13 Account is active Atlanta
username fullname Human Resources Coordinator HR session_id employee 2018-07-03T14:26:26 2018-09-30T16:27:01 Account is active Chicago
username fullname Sales Representative Sales privileged_user session_id employee 2018-08-10T15:55:25 2018-09-30T16:27:01 Account is active Atlanta

2. exabeam-get-watchlists

Returns all watchlist IDs and titles.

Base Command

exabeam-get-watchlists

Required Permissions

The following permissions are required for this command.

  • permission 1
  • permission 2
Input
There are no input arguments for this command.

Context Output
Path Type Description
Exabeam.Watchlist.Category String The watchlist category.
Exabeam.Watchlist.Title String The watchlist title.
Exabeam.Watchlist.WatchlistID String The watchlist ID.

Command Example

!exabeam-get-watchlists

Context Example 
{
    "Exabeam.Watchlist": [
        {
            "Category": "UserLabels",
            "Title": "Executive Users",
            "WatchlistID": "5c869ab0315c745d905a26d9"
        },
        {
            "Category": "UserLabels",
            "Title": "Service Accounts",
            "WatchlistID": "5c869ab0315c745d905a26da"
        },
        {
            "Category": "Users",
            "Title": "user watchlist",
            "WatchlistID": "5dbaba2dd4e62a0009dd7ae4"
        },
        {
            "Category": "PeerGroups",
            "Title": "VP Operations",
            "WatchlistID": "5d8751723b72ea000830066a"
        }
    ]
}
Human Readable Output

Exabeam Watchlists:

WatchlistID Title Category
5c869ab0315c745d905a26d9 Executive Users UserLabels
5c869ab0315c745d905a26da Service Accounts UserLabels
5dbaba2dd4e62a0009dd7ae4 user watchlist Users
5d8751723b72ea000830066a VP Operations PeerGroups

3. exabeam-get-peer-groups

Returns all peer groups.

Base Command

exabeam-get-peer-groups

Required Permissions

The following permissions are required for this command.

  • permission 1
  • permission 2
Input
There are no input arguments for this command.

Context Output
Path Type Description
Exabeam.PeerGroup.Name String The name of the peer group.

Command Example

!exabeam-get-peer-groups

Context Example 
{
    "Exabeam.PeerGroup": [
        {
            "Name": "Marketing"
        },
        {
            "Name": "usa"
        },
        {
            "Name": "101"
        },
        {
            "Name": "Program Manager"
        },
        {
            "Name": "Channel Administrator"
        },
        {
            "Name": "Chief Marketing Officer"
        },
        {
            "Name": ""
        },
        {
            "Name": "Chief Strategy Officer"
        },
        {
            "Name": "CN=Andrew Bautista,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "BitLockerUsersComputers"
        },
        {
            "Name": "trinet"
        },
        {
            "Name": "Admin Operations"
        },
        {
            "Name": "118"
        },
        {
            "Name": "Corp"
        },
        {
            "Name": "102"
        },
        {
            "Name": "CN=Emery Santiago,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "105"
        },
        {
            "Name": "Computer Scientist"
        },
        {
            "Name": "Electrical Engineer"
        },
        {
            "Name": "VP Business Development"
        },
        {
            "Name": "Hardware Engineer"
        },
        {
            "Name": "Executive Assistant"
        },
        {
            "Name": "GenCouncil"
        },
        {
            "Name": "Consulting"
        },
        {
            "Name": "109"
        },
        {
            "Name": "Legal Secretary"
        },
        {
            "Name": "VP Operations"
        },
        {
            "Name": "106"
        },
        {
            "Name": "Washington"
        },
        {
            "Name": "Operations Director"
        },
        {
            "Name": "Process Engineer"
        },
        {
            "Name": "104"
        },
        {
            "Name": "Account Manager"
        },
        {
            "Name": "Shop Floor Supervisor"
        },
        {
            "Name": "IT Operations"
        },
        {
            "Name": "VP Marketing"
        },
        {
            "Name": "HR"
        },
        {
            "Name": "design,milling"
        },
        {
            "Name": "superUsers"
        },
        {
            "Name": "WIFI IL"
        },
        {
            "Name": "ProgramMgmt"
        },
        {
            "Name": "Engagement Manager"
        },
        {
            "Name": "InfoSec"
        },
        {
            "Name": "Sales Operations"
        },
        {
            "Name": "Security Systems Engineer"
        },
        {
            "Name": "design"
        },
        {
            "Name": "CN=Tracee Weber,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "sap"
        },
        {
            "Name": "CN=May Mcconnell,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "jobvite"
        },
        {
            "Name": "Sales"
        },
        {
            "Name": "partners"
        },
        {
            "Name": "CN=Emely Blanchard,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "Corporate Marketing Strategist"
        },
        {
            "Name": "Web Developer"
        },
        {
            "Name": "Domain Admins"
        },
        {
            "Name": "VP Information Systems"
        },
        {
            "Name": "CN=Raelene Thompson,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "VP Engineering"
        },
        {
            "Name": "Marketing Coordinator"
        },
        {
            "Name": "VP Sales"
        },
        {
            "Name": "103"
        },
        {
            "Name": "Product Manager"
        },
        {
            "Name": "Welder"
        },
        {
            "Name": "milling"
        },
        {
            "Name": "VP Human Resources"
        },
        {
            "Name": "Partner Corrdinator"
        },
        {
            "Name": "execs"
        },
        {
            "Name": "117"
        },
        {
            "Name": "Engineering"
        },
        {
            "Name": "Seattle"
        },
        {
            "Name": "107"
        },
        {
            "Name": "Program Director"
        },
        {
            "Name": "Chief Council"
        },
        {
            "Name": "Machinist"
        },
        {
            "Name": "Software Developer"
        },
        {
            "Name": "Office365-Users"
        },
        {
            "Name": "CN=Harris Oliver,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "CN=Tu Petersen,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "ITServiceUsersDomainAdmins"
        },
        {
            "Name": "root"
        },
        {
            "Name": "IT"
        },
        {
            "Name": "Atlanta"
        },
        {
            "Name": "autocad"
        },
        {
            "Name": "Building Engineer"
        },
        {
            "Name": "Dallas"
        },
        {
            "Name": "Security Security Coordinator"
        },
        {
            "Name": "salesforce"
        },
        {
            "Name": "Software Engineer"
        },
        {
            "Name": "110"
        },
        {
            "Name": "Saless"
        },
        {
            "Name": "CN=Marianne Hughes,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "Civil Engineer"
        },
        {
            "Name": "CN=Vince Andrade,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "Security Analyst"
        },
        {
            "Name": "Sales Representative"
        },
        {
            "Name": "Operations"
        },
        {
            "Name": "Jobvite-users"
        },
        {
            "Name": "Chicago"
        },
        {
            "Name": "Los Angeles"
        },
        {
            "Name": "New York"
        },
        {
            "Name": "councilApp"
        },
        {
            "Name": "VP Information Security"
        },
        {
            "Name": "Direct Support"
        },
        {
            "Name": "MA/DCG"
        },
        {
            "Name": "orch_admins"
        },
        {
            "Name": "Chief Operating Officer"
        },
        {
            "Name": "ITInfraAdmins"
        },
        {
            "Name": "Manager, IT Corporate Services"
        },
        {
            "Name": "VP Council"
        },
        {
            "Name": "CN=Felipe Pennington,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "CN=May Mcconnell,OU=US,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local"
        },
        {
            "Name": "Public Relations Officer"
        },
        {
            "Name": "Human Resources Coordinator"
        },
        {
            "Name": "Chief Information Secuity Officer"
        },
        {
            "Name": "Marketing Strategist"
        },
        {
            "Name": "Front Desk Receptionist"
        },
        {
            "Name": "CEO"
        },
        {
            "Name": "IT Administrator"
        },
        {
            "Name": "Sales Coordinator"
        },
        {
            "Name": "Network Engineer"
        },
        {
            "Name": "108"
        }
    ]
}
Human Readable Output

Exabeam Peer Groups:

Name
Marketing
usa
101
Program Manager
Channel Administrator
Chief Marketing Officer
Chief Strategy Officer
CN=Andrew Bautista,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
BitLockerUsersComputers
trinet
Admin Operations
118
Corp
102
CN=Emery Santiago,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
105
Computer Scientist
Electrical Engineer
VP Business Development
Hardware Engineer
Executive Assistant
GenCouncil
Consulting
109
Legal Secretary
VP Operations
106
Washington
Operations Director
Process Engineer
104
Account Manager
Shop Floor Supervisor
IT Operations
VP Marketing
HR
design,milling
superUsers
WIFI IL
ProgramMgmt
Engagement Manager
InfoSec
Sales Operations
Security Systems Engineer
design
CN=Tracee Weber,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
sap
CN=May Mcconnell,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
jobvite
Sales
partners
CN=Emely Blanchard,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
Corporate Marketing Strategist
Web Developer
Domain Admins
VP Information Systems
CN=Raelene Thompson,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
VP Engineering
Marketing Coordinator
VP Sales
103
Product Manager
Welder
milling
VP Human Resources
Partner Corrdinator
execs
117
Engineering
Seattle
107
Program Director
Chief Council
Machinist
Software Developer
Office365-Users
CN=Harris Oliver,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
CN=Tu Petersen,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
ITServiceUsersDomainAdmins
root
IT
Atlanta
autocad
Building Engineer
Dallas
Security Security Coordinator
salesforce
Software Engineer
110
Saless
CN=Marianne Hughes,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
Civil Engineer
CN=Vince Andrade,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
Security Analyst
Sales Representative
Operations
Jobvite-users
Chicago
Los Angeles
New York
councilApp
VP Information Security
Direct Support
MA/DCG
orch_admins
Chief Operating Officer
ITInfraAdmins
Manager, IT Corporate Services
VP Council
CN=Felipe Pennington,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
CN=May Mcconnell,OU=US,OU=Users,OU=Ktenergy,DC=ktenergy,DC=local
Public Relations Officer
Human Resources Coordinator
Chief Information Secuity Officer
Marketing Strategist
Front Desk Receptionist
CEO
IT Administrator
Sales Coordinator
Network Engineer
108

4. exabeam-get-user-info

Returns user information data for the username.

Base Command

exabeam-get-user-info

Required Permissions

The following permissions are required for this command.

  • permission 1
  • permission 2
Input
Argument Name Description Required
username The username of the user to fetch. Required

Context Output
Path Type Description
Exabeam.User.RiskScore Number The risk score of the user.
Exabeam.User.AverageRiskScore Number The average risk score.
Exabeam.User.PeerGroupFieldName String The field name of the peer group.
Exabeam.User.FirstSeen Date The date when the user was first seen.
Exabeam.User.PeerGroupDisplayName String The display name of the Peer group.
Exabeam.User.LastSeen Date The date the user was last seen.
Exabeam.User.PeerGroupFieldValue String The field value of the peer group.
Exabeam.User.Label String The labels of the user.
Exabeam.User.Username String The name of the user.
Exabeam.User.PeerGroupType String The type of the peer group.
Exabeam.User.LastSessionID String The last session ID of the user.
Exabeam.User.LastActivityType String The last activity type of the user.
Exabeam.User.AccountNames String The account name of the user.

Command Example

!exabeam-get-user-info username={username}

Context Example 
{
    "Exabeam.User": {
        "AccountNames": [
            "account_name"
        ],
        "AverageRiskScore": 102.53,
        "FirstSeen": "2018-08-01T11:50:16",
        "Label": [
            "privileged_user"
        ],
        "LastActivityType": "Account is active",
        "LastSeen": "2018-09-09T16:36:13",
        "LastSessionID": "session_id",
        "PeerGroupDisplayName": "root",
        "PeerGroupFieldName": "Peer Groups",
        "PeerGroupFieldValue": "root",
        "PeerGroupType": "Group",
        "RiskScore": 163,
        "Username": "username"
    }
}
Human Readable Output

User jmontoya information:

Username RiskScore AverageRiskScore LastSessionID FirstSeen LastSeen LastActivityType AccountNames PeerGroupFieldName PeerGroupFieldValue PeerGroupDisplayName PeerGroupType
{username} 163 102.53 {session_id} 2018-08-01T11:50:16 2018-09-09T16:36:13 Account is active {account_name} Peer Groups root root Group

5. exabeam-get-user-labels

Returns all labels of the user.

Base Command

exabeam-get-user-labels

Required Permissions

The following permissions are required for this command.

  • permission 1
  • permission 2
Input
There are no input arguments for this command.

Context Output
Path Type Description
Exabeam.UserLabel.Label String The label of the user.

Command Example

!exabeam-get-user-labels

Context Example 
{
    "Exabeam.UserLabel": [
        {
            "Label": "privileged_user"
        },
        {
            "Label": "service_account"
        }
    ]
}
Human Readable Output

Exabeam User Labels:

Label
privileged_user
service_account

6. exabeam-get-user-sessions

Returns sessions for the given username and time range.

Base Command

exabeam-get-user-sessions

Required Permissions

The following permissions are required for this command.

  • permission 1
  • permission 2
Input
Argument Name Description Required
username The username for which to fetch data. Required
start_time The Start time of the time range. For example, 2018-08-01T11:50:16). Optional
end_time The end time of the time range. For example, 2018-08-01T11:50:16. Optional

Context Output
Path Type Description
Exabeam.User.Session.EndTime Date The end time of the session.
Exabeam.User.Session.InitialRiskScore Number The initial risk score of the session.
Exabeam.User.Session.Label String The label of the session.
Exabeam.User.Session.LoginHost String The login host.
Exabeam.User.Session.RiskScore Number The risk score of the session.
Exabeam.User.Session.SessionID String The ID of the session.
Exabeam.User.Session.StartTime Date The start time of the session.
Exabeam.User.Username String The username of the session.

Command Example

!exabeam-get-user-sessions username={username} start_time=2018-08-01T11:50:16

Context Example 
{
    "Exabeam.User": {
        "Session": [
            {
                "EndTime": "2018-08-01T20:00:17",
                "InitialRiskScore": 0,
                "Label": "",
                "LoginHost": "login_host",
                "RiskScore": 0,
                "SessionID": "session_id",
                "StartTime": "2018-08-01T14:05:46"
            },
            {
                "EndTime": "2018-08-02T02:37:51",
                "InitialRiskScore": 0,
                "Label": "vpn-in",
                "LoginHost": "login_host",
                "RiskScore": 0,
                "SessionID": "seesion_id",
                "StartTime": "2018-08-01T23:17:00"
            },
        ],
        "Username": "username"
    }
}
Human Readable Output

User {username} sessions information:

SessionID RiskScore InitialRiskScore StartTime EndTime LoginHost Label
session_id 0 0 2018-08-01T14:05:46 2018-08-01T20:00:17 login_host
session_id 0 0 2018-08-01T23:17:00 2018-08-02T02:37:51 login_host vpn-in

7. exabeam-delete-watchlist

Deletes a watchlist.

Base Command

exabeam-delete-watchlist

Required Permissions

The following permissions are required for this command.

  • permission 1
  • permission 2
Input
Argument Name Description Required
watchlist_id The watchlist ID. Required

Context Output
There are no context output for this command.

Command Example

!exabeam-delete-watchlist watchlist_id=5de50f82088c6a000865408d

Context Example 
{}
Human Readable Output

The watchlist 5de50f82088c6a000865408d was deleted successfully.

8. exabeam-get-asset-data

Returns asset data.

Base Command

exabeam-get-asset-data

Required Permissions

The following permissions are required for this command.

  • permission 1
  • permission 2
Input
Argument Name Description Required
asset_name The name of the asset. Required

Context Output
Path Type Description
Exabeam.Asset.HostName String The host name of the asset.
Exabeam.Asset.IPAddress String The IP address of the asset.
Exabeam.Asset.AssetType String Thr type of the asset.
Exabeam.Asset.FirstSeen Date The date the asset was first seen.
Exabeam.Asset.LastSeen String The date the asset was last seen.

Command Example

!exabeam-get-asset-data asset_name={host_name}

Context Example 
{
    "Exabeam.Asset": {
        "AssetType": "Windows",
        "FirstSeen": "2018-07-03T14:21:00",
        "HostName": "host_name",
        "IPAddress": "ip_address",
        "Labels": null,
        "LastSeen": "2018-09-30T16:23:17"
    }
}
Human Readable Output

Exabeam Asset Data:

AssetType FirstSeen HostName IPAddress LastSeen
Windows 2018-07-03T14:21:00 host_name ip_address 2018-09-30T16:23:17

Edit this page
Report an Issue