Exabeam

No entries match these filters. Clear filters

1. announced Oct 1, 2026 · issue 093

   October 2026 LogRhythm SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. adds a community MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for local AI workflows, self-service compliance reporting engine, new rule-management APIs, AIE log ID drilldown, and Intelligence Sync proxy routing.

   • Adds a community Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server that connects local generative AI models with LogRhythm SIEM data for on-premises queries, investigations, and alert triage.
   • Adds a next-generation self-service reporting engine with a library of customizable compliance graphs and reports that can be scheduled for recurring audit workflows.
   • Adds new APIs for automated rule creation and real-time rule statistics in the Advanced Intelligence Engine.
   • Adds log ID tracking to the Advanced Intelligence Engine (AIE) for precise event drilldown.
   • Adds proxy routing support for the LogRhythm Intelligence Sync service to meet complex network compliance requirements.

   5 details in Everything

   • New integration Generative AI Collectors for ChatGPT, Google Gemini, and GitHub Copilot
   • Updated supported platform OpenSearch replaces Elasticsearch as the self-hosted search foundation
2. announced Oct 1, 2026 · issue 093

   October 2026 New-Scale adds a persistent Nova AI sidebar, Related Cases correlation in Threat Center, Outcomes Navigator overrides, data segregation for MSSPs, and weekly Executive Digest email reports.

   • Adds a persistent Nova AI sidebar that follows analysts through Threat Center, search timelines, and Outcomes Navigator while retaining conversational context across workflows.
   • Adds Exabeam Related Cases in Threat Center, correlating active and historical cases through shared artifacts and entities — including users, hosts, and IP addresses — and surfacing earlier notes and containment playbooks.
   • Adds Outcomes Navigator overrides, letting security leaders adjust use case coverage scores when custom or unrecognized data sources satisfy specific security techniques.
   • Adds Threat Center data segregation, partitioning a single New-Scale subscription into virtual tenants with dedicated site management and role-based access controls for MSSPs and business units.
   • Updates Executive Digest to deliver weekly email reports that translate technical security posture improvements into business outcomes for executives.

   5 details in Everything

   • New integration Claude Enterprise ingestion
   • New integration Agentic SOC plugin for Claude Code and OpenAI Codex
3. New Threat Center Endpoint (2026-09-16) Sep 16, 2026 · issue 077

   Exabeam Threat Center gains a new API endpoint for retrieving full case lifecycle history and audit events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

4. docs update Sep 16, 2026 · issue 076

   Exabeam Threat Detection Management gains automatic activity notifications⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

5. Exabeam September 2026 Sep 2026 · release notes

   Exabeam Sept 2026 adds Google Alert Center collector, Custom Send Email action, triggerDependencyExpression field, and Nova persistent sidebar.

   • Custom Send Email action under the threatcenter pre-built service for automated email notifications
   • Send Case Templated Email pre-built playbook for templated case notifications
   • triggerDependencyExpression analytics rule field with HasRuleTriggeredOnSameEvent() function to restrict rule triggers based on other rule state
   • Configurable tenant session timeout duration in the administration settings
   • Google Alert Center Cloud Collector for ingesting Google Workspace security alerts

   +3 more show less

   • Advanced Settings section in the Cribl Cloud Collector config for mapping Cribl metadata fields (default and custom)
   • Persistent AI sidebar (Exabeam Nova) available globally across the New-Scale UI
   • Exabeam MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. enhancements: API endpoints to update/create management rules, get rule details by template ID, and list/get parsers filtered by state/type

   8 details in Everything

6. New Log Stream Endpoints (2026-08-27) Aug 27, 2026 · release notes

   Exabeam adds REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. to manage Log Stream parsers, event builders, and enrichers programmatically

   • Adds Log Stream Enrichers endpoints (Create, List, Get, Update, Delete, Bulk delete, Enable, Disable) for managing enricher lifecycle
   • Adds Log Stream Event Builders endpoints (Create, List, Get by ID, Get by Parser ID, Update, Delete) for configuring event builders
   • Adds Log Stream Parsers endpoints (Create, List, Get, Update, Delete, Bulk delete, Enable, Disable) for managing parser configurations

   3 details in Everything

7. New Site Collector Direct Access Agent (DAA) Endpoints (2026-08-27) Aug 27, 2026 · release notes

   Exabeam adds endpoints to manage Direct Access Agent (DAA) Windows collectors for install/uninstall/support commands

   • Site Collectors > DAA Agents > Get a DAA collector installation command endpoint is now available
   • Site Collectors > DAA Agents > Get a DAA collector uninstallation command endpoint is now available
   • Site Collectors > DAA Agents > Get a DAA collector support-package command endpoint is now available

   3 details in Everything

8. docs update Aug 24, 2026 · issue 055

   Exabeam Context Management now supports REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. Context Tables.

   • Adds support for REST API Context Tables, enabling practitioners to populate and manage context table data programmatically via REST API.

   1 detail in Everything

9. docs update Aug 1, 2026 · issue 032

   Exabeam adds Agent Behavior Analytics to baseline, detect, and investigate AI agent activity across Claude, ChatGPT, Gemini, Copilot, and more.

   • New Agent Behavior Analytics (ABA) capability establishes behavioral baselines for AI agents and autonomous workflows, detecting misuse, drift, abnormal tool usetool useA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions., risky access, and out-of-role activity.
   • Correlates AI agent activity with users, entities, applications, and security events to accelerate investigation and response.
   • New Exabeam Agent Sensor collects and normalizes activity across AI models and runtimes.

   3 details in Everything

10. docs update Aug 1, 2026 · issue 032

    Exabeam extends behavioral analytics to AI agents and autonomous activity across major AI platforms via OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor..

11. Exabeam August 2026 Aug 2026 · release notes

    Exabeam August 2026 adds cloud collectors, Log Stream APIs, and new analytics time functions.

    • Adds AWS Eventbridge Cloud Collector, AWS Shield Cloud Collector, Egnyte Cloud Collector, Symantec Email Security Cloud Collector, Symantec Cloud Secure Web Gateway Cloud Collector, Google Workspace Context Cloud Collector, REST API Context Cloud Collector, Armis Cloud Collector, Armis Context Cloud Collector, AWS Inspector Cloud Collector, AWS Redshift Cloud Collector, Cybereason Cloud Collector, Google Security Operations Cloud Collector, Palo Alto Networks SaaS Security Cloud Collector, and Symantec CloudSOC Cloud Collector to ingest logs from new sources.
    • Adds the /log-stream/v1/... public API endpoints for Log Stream to programmatically manage parsers, event builders, and event enrichers.
    • Adds timeofday(), timeofweek(), and timeofmonth() functions to analytics rule configurations to retrieve event date/time components.
    • Adds m_collector_id metadata field to Cloud Collector events for targeted searching.
    • Adds the Array Contains operator to Context Management filtered tables for array attribute filtering.

    +2 more show less

    • Adds role-based access controlrole-based access controlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (Can View, Can View and Edit, Can View, Edit and Delete) at the dashboard level.
    • Adds read-only permission level for Log Stream to view parsers, enrichers, and filters without modification.

    7 details in Everything

12. docs update Jul 24, 2026 · issue 024

    Exabeam Outcomes Navigator adds support for the OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Applications framework.

    └──▷ HOW TO FIND IT
    Assess your environment's agentic AI security posture against the OWASP Top 10 for Agentic Applications framework in Outcomes Navigator.
    📍In Outcomes Navigator, navigate to the OWASP Top 10 for Agentic Applications framework to view, assess, and improve your configuration.
    • Supports the OWASP Top 10 for Agentic Applications framework, enabling practitioners to view, assess, and improve security configurations against agentic AI risks.

    1 detail in Everything

13. docs update Jul 24, 2026 · docs issue 004

    Exabeam Outcomes Navigator adds support for the OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Applications framework.

    └──▷ HOW TO FIND IT
    Assess your environment's agentic AI security posture against the OWASP Top 10 for Agentic Applications framework in Outcomes Navigator.
    📍In Outcomes Navigator, navigate to the OWASP Top 10 for Agentic Applications framework to view, assess, and improve your configuration.
    • Supports the OWASP Top 10 for Agentic Applications framework, enabling practitioners to view, assess, and improve security configurations against agentic AI risks.

    1 detail in Everything

14. Enhanced Threat Center Endpoint (2026-07-15) Jul 15, 2026 · issue 017

    Exabeam Threat Center adds caseClosedTimestamp field to case details, enabling Time-to-Close metrics.

    • Adds caseClosedTimestamp (date-time string) to the Get Case Details response schema, exposing when a case was closed for Time to Close (TTC) and Mean Time to Close (MTTC) calculations.

    1 detail in Everything

15. Exabeam July 2026 Jul 2026 · release notes

    Exabeam July 2026 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. user-delegated auth, native field extraction expressions, and early access cloud collectors.

    • Adds Get Case Details and Get Alert Details actions to the pre-built threatcenter service in Automation Management, returning fields like alertId, caseNumber, and mitres.
    • Adds a custom value field under Silent Monitoring Threshold for log source policies, allowing values from 30 minutes to 72 hours or a user-defined duration.
    • Adds new native field extraction expressions (Directory, Name, Extension, Registered Domain, etc.) for defining conditions in custom enrichment rules in Log Stream.
    • Adds the Google Workspace Context Cloud Collector, and early access support for Armis, AWS Inspector, AWS Redshift, Cybereason, Google Security Operations, Palo Alto SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security, and Symantec CloudSOC cloud collectors.
    • Adds a new NSA Detections Overview Dashboard pre-built dashboard visualizing alert counts by use case, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. techniques/tactics, and rule IDs.

    +6 more show less

    • Adds Every 2 Weeks as a recurrence option in the Recurrence field for scheduling reports.
    • Captures failed login attempts in the Audit Log as query-able events with the same schema as success events.
    • Enables Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) connections using user-level authentication instead of shared application-level API keys.
    • Adds support for tracking coverage of the OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Top 10 for Agentic Applications framework in Outcomes Navigator, including AI Coverage Score.
    • Expands the supported date range for viewing search results in the Timeline view from 7 days to 31 days.
    • Adds a server-side filter option to Show only rows with detections toggle in the Timeline view for early access, re-querying the full dataset rather than limiting to initial 5,000 records.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The deprecated activity_type values (including alert-create, case-modify, detection_group_rule-enable, etc.) will be removed, consolidating audit events into activity_type:audit-log:success/fail.
    • !Site Collectors 2.21 no longer supports ports 8880, 9093, 9877, 9878, and 9879; these must be removed or closed.
    • !The Log Source Monitoring feature is deprecated effective September 1, 2026, requiring migration to the Log Sources tile on the New-Scale Security Operations Platform home page.
16. New Threat Center Endpoints (2026-06-16) Jun 16, 2026 · issue 014

    Exabeam adds Threat Center API endpoints to retrieve threat timelines by alert ID or case ID.

    • New API endpoint to retrieve a threat timeline given a specific alert ID.
    • New API endpoint to retrieve a threat timeline given a specific case ID.

    2 details in Everything

17. New Threat Center Endpoints (2026-06-16) Jun 16, 2026 · release notes

    New endpoints added to retrieve threat timelines for specific alerts or case IDs.

    • Added Threat Center > Threat Timeline > Get the threat timeline given an alert id endpoint.
    • Added Threat Center > Threat Timeline > Get the threat timeline given a case id endpoint.

    2 details in Everything

18. Exabeam June 2026 Jun 2026 · release notes

    Exabeam June 2026 adds Phishing Email Inbox Collector, OpenAI/REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. collectors, Nova rule creator, and Entity Health dashboard.

    • Phishing Email Inbox Cloud Collector ingests phishing mailbox metadata and logs
    • OpenAI Cloud Collector ingests data from your Open AI platform (early access)
    • REST API Context Collector ingests context data from REST API endpoints (early access)
    • REST API Context Tables support custom context sources mapped via the REST API Context collector
    • Entity Health Dashboard shows entity coverage, uniqueness, and identity resolution issues (early access)

    +23 more show less

    • Optional Email Address and Username Prefix Linking allows linking identities with identical prefixes but different domains
    • Attack Surface Insights rules can preview up to five matching entities using the Test Conditions button
    • Exabeam Nova Rule Creator drafts correlation and analytics rules from natural language descriptions
    • Correlation rule templates updated for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. v19 Stealth and Defense Impairment tactics (77 templates)
    • Search results display increased to 5,000 events across Timeline, List, and Table views
    • Timeline view supports continuous scrolling without manual paging
    • Timeline query date range expanded to 31 days (early access opportunity)
    • Global Search can now search by ip_address and full_name fields
    • Visualization charts support Series Positioning, Scale Type, Missing Date handling, and Results Count limits
    • Custom Visualization window defaults Field = user, Metric = count, Chart Type = bar chart
    • Log Stream audit log covers event-enricher and platform-event-enricher operation types
    • Log Stream Parsers Overview shows Tier Distribution and Parsed vs. Unparsed graphs for the last 24 hours
    • Log Stream extraction preview supports exa_regex syntax and $.. recursive JSON syntax
    • Exabeam MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. now supports getting threat summaries, context tables, correlation rules, and MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. coverage scores
    • Outcomes Navigator queries Search for rule-trigger activity_type to verify analytics rule satisfaction
    • Service Health App Config tab introduces dedicated RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions (Read, Write, Delete)
    • Direct Access Agent (DAA) Windows Event Log Collector collects logs natively from Windows servers
    • Threat Center watchlists increased limit to 40 and support reordering via drag-and-drop
    • Watchlist entity display shows open/closed cases and alerts with direct navigation links
    • New Early Access Pre-Built Analytics Rules for AI agent installation, OpenClaw activity, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. permission abuse
    • Pre-built Phishing Rule detection grouping rule groups detections by email subject
    • Merge Phishing Detection Engine Cases playbook merges related phishing cases over a 14-day period
    • Phishing Rule Detections assigned static rarity score of 50 in Threat Center

    28 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Log Sources tab in Site Collectors will be deprecated in August 2026; migrate to the Log Sources application.
19. Exabeam May 2026 May 2026 · release notes

    Exabeam May 2026 adds PingOne/S2W/Workday collectors, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. case management, and Post-Default enrichers.

    • Adds PingOne Identity Cloud Collector for user activity audit logs
    • Adds S2W Threat Intelligence Cloud Collector for threat intel ingestion
    • Adds Workday Cloud Collector for user activity logs from Workday API
    • Adds OAuth2.0 JWT Grant authentication support to the REST API Cloud Collector
    • Adds Pre-Default and Post-Default ordering options for custom enrichers in Log Stream

    +9 more show less

    • Adds case creation, update, note creation, and alert update capabilities to the Exabeam MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface.
    • Adds a platform-wide global search bar accessible via the Navigation Center
    • Adds the Manage All Schedule Reports permission level for administrators
    • Adds Exabeam Nova auto-creation panel alongside Basic panel in Custom Visualization authoring
    • Adds the GetContextAttribute() function for precise context table queries in analytics rules
    • Adds public/private visibility toggle for saved searches in Threat Center
    • Adds sorting by title, creator, and modification date to saved searches
    • Adds filtering of field names in the Search Results Summary list
    • Adds NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework., NIIST CSF, and NIIS2 compliance framework support in Outcomes Navigator

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The following pre-built enrichment rules have been removed: UID to User Lookup, EmployeeNumber to User Lookup, Email to User Enricher-1, Destination Email to Destination User Enricher-1, Email to User Enricher-2, Destination Email to Destination User Enricher-2, User SID to User Lookup, Microsoft User UPN to User/Email Enricher, CrowdStrike Asset ID to User Lookup, Discard EM External, Discard EM Ephemeral, Discard Exabeam Users
    • !The following pre-built analytics rules have been removed: Cntx-SA-ECrit, Cntx-PC-ECrit-CS, Cntx-PC-ECrit-Server, NumDCP-Network-DEC-SE-DE, NumDCP-Network-DIPC-DP-DIP, NumDCP-Network-DIPC-DP-DIP-SE, NumDCP-Network-DIPC-DP-DIP-SIP, NumDCP-Network-DIPC-O-DIP-SE, NumDCP-Network-DIPC-O-DIP-SIP, NumDCP-Network-DIPC-O-DIP-U, NumDCP-Network-DIPC-SE-DIP, NumDCP-Network-DIPC-U-DIP, Prof-Network-ToExtIP-O-DP, Prof-Network-ToExtIP-O-SE, Prof-Network-ToExtIP-O-SZ
20. Exabeam April 2026 Apr 2026 · release notes

    Exabeam April 2026 adds MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. integration, device entity search, and new detection rules.

    • Adds Exabeam Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Server to connect external AI tools for discovering and acting on Exabeam data
    • Adds Device Entity option in Basic search mode and Entities tab in Search results to view device details without leaving the application
    • Adds Trigger on first match and Group by Field options for Sequence correlation rules
    • Adds Require supporting reason toggle in Threat Center settings to make case closed reasons mandatory
    • Adds new pre-built analytics rules including Fact-EL-UnauthorizedWindowsRDP, Prof-AI-TI-UTN-FN, and NumCP-VPNlnF-EC-O-U-1Day

    +2 more show less

    • Adds PingOne Identity Cloud Collector for early access to ingest user activity logs
    • Adds Workday Cloud Collector for early access to ingest user activity logs from the Workday API

    7 details in Everything

21. Exabeam March 2026 Mar 2026 · release notes

    Exabeam March 2026 adds AI monitoring collectors, Agent Behavior Analytics detections, Outcomes Navigator compliance tracking, and configurable analytics rule logic.

    • Adds ChatGPT Enterprise Cloud Collector for ingesting ChatGPT Enterprise data via Agent Behavior Analytics
    • Adds Microsoft Copilot support with Agent Behavior Analytics for monitoring AI-driven activity
    • Adds new AI-driven detections including identity/privilege misuse, prompt/model abuse, and agent lifecycle monitoring
    • Adds Discard_EM_USER and Discard_EM_HOST m_tags values in Log Stream enrichment rules to control entity type creation in Attack Surface Insights
    • Adds Link Reasons column to view linking methods between user entities and accounts in Attack Surface Insights

    +30 more show less

    • Adds automatic bulk tag removal capability in Attack Surface Insights rules actions
    • Adds manual playbook execution on manually created Threat Center cases via Automation Management
    • Adds Automation History tab for viewing automation history on manually created Threat Center cases
    • Adds ChatGPT Enterprise Cloud Collector and Microsoft Entra ID Context Cloud Collector enhancements with MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone./SSPR attributes
    • Adds Phishing Email Inbox Cloud Collector in Early Access for phishing mailbox monitoring
    • Adds new Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. user context table columns: MFA Capable, MFA Registered, SSPR Registered, Auth Methods Registered, Manager
    • Adds new Agent Behavior Analytics context tables: AI/LLM Web Domains, AI/LLM Web Categories, AI/LLM Applications
    • Adds new detection context tables Unsafe Countries and Credentials Dumping Processes for New-Scale Analytics
    • Adds Home tab in Dashboards application to set a default landing dashboard
    • Adds Threat Center Dashboard Enhancements including Mean Time to Close measure, four new dimensions, and filters by Case Creation Timestamp/Case Number
    • Adds global search bar Early Access feature for platform-wide entity lookup
    • Adds Outcomes Navigator compliance coverage tracking for HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. and PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. with Compliance Coverage Score
    • Adds customizable framework selection in Outcomes Navigator (TDIR, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior., HIPAA, PCIPCIA hardware bus standard that connects peripheral devices to a computer's motherboard; cyber tools targeting hardware-level forensics or memory analysis use it to access device registers and DMA regions directly. DSS)
    • Adds configurable Detection Rule Display preference to control rule information display in Search
    • Adds visible rule severity scores on the Detections tab Details panel in Search
    • Adds pinned fields persistence to top of Parsed Fields list in Search Details panel
    • Adds locked header row and compact display improvements to Search Table view
    • Adds new column options menu per cell and Details link in Search Table view
    • Adds Reorder button for enrichment rule priority ordering in Log Stream Enrichments tab
    • Adds new selection menu with Expressions and Fields lists for field mapping in Log Stream enrichment rules
    • Adds Direct Access Agent (DAA) Windows Collector Early Access for native Windows Event Log collection
    • Adds Case Bulk Edit capability to update up to 50 cases at once in Threat Center
    • Adds step-by-step risk score explanation view under How was this calculated? in Threat Center
    • Adds complex AND/OR and nested logic support for Applicable Events in Analytics Rule Builder
    • Adds three new analytics rule functions: isRandomHostName(), isRandomDomain(), contextGetValue()
    • Adds minTotalEventsThreshold and maxTotalEventsThreshold fields to analytics rule JSON configuration for numericCountProfiledFeature rules
    • Adds Testing status indicator in Analytics Rule Builder Change column and direct Testing selection
    • Adds new QUICK SEARCH column (managed via Manage Columns) to navigate to triggering events from analytics rules
    • Adds Score Unless field configuration in the Analytics Rule Builder for profiledFeature and factFeature rules
    • Adds 25+ new pre-built AI-focused analytics rules including token count, first-time role/group/agent creation, and prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. indicators

    35 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Dimensions whose names start with Closed Timestamp have been renamed to start with Case Closed Timestamp in the Threat Center data model
22. Exabeam February 2026 Feb 2026 · release notes

    Exabeam Feb 2026 adds Mimecast Incydr/S2W TI collectors, AI use case support, rule training periods, and new cloud/credential detection rules.

    • Adds Mimecast Incydr Cloud Collector for File events ingestion
    • Adds S2W Threat Intelligence Cloud Collector (Early Access) for threat intel ingestion
    • Adds agentic_ai_security use case support in Outcomes Navigator
    • Adds minimumTrainingPeriodInDays field to analytics rule JSON config or builder to delay triggering during baseline establishment
    • Enables CIM 2.0 fields selection in the analytics rule builder for applicable events

    +5 more show less

    • Adds minOrderOfMagnitude field support with range 1–32 for numeric profiled feature rules
    • Adds suppression toggle under Suppress Length to prevent repeated triggering on specified fields
    • Adds new correlation rule templates: AWS root account logged in without MFA, Large amount of failed delivery status notifications for this Gmail account, Remote HTA file executed using 'mshta.exe', and Remote MSI file executed using 'msiexec.exe'
    • Adds dozens of new pre-built analytics rules covering credential dumping, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., persistence, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. session hijacking, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. attacks, malicious code execution, and AI misuse
    • Enhances timeline view in search to automatically include source events that did not meet query criteria but triggered a detection

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed option to add rows directly to filtered context tables; must add to parent context tables instead
    • !Removed Custom Default parser category in Log Stream
23. Exabeam MCP Server for Developers (2026-01-14) Jan 14, 2026 · release notes

    Exabeam adds an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI assistants to interact with API documentation.

    └──▷ HOW TO FIND IT
    Connect an AI assistant to Exabeam for exploring APIs via natural language.
    📍Configure your AI client (e.g., Claude, ChatGPT) to use the Exabeam MCP server endpoint as documented at https://developers.exabeam.com/exabeam/docs/exabeam-mcp-server-for-developers.
24. Exabeam January 2026 Jan 2026 · release notes

    Exabeam New-Scale SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. adds Gmail and Palo Alto XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. cloud collectors, Context Management key icon, and Host to IP enrichment customization.

    • Adds Gmail BigQuery Cloud Collector for ingesting gmail logs
    • Adds Palo Alto Networks XDR Cloud Collector for ingesting Cortex XDR security alert logs
    • Adds a visible key icon (\u25CB) in column headers to identify the key attribute in Context Management custom and pre-built tables
    • Adds Threat Unix Commands pre-built detection context table populated with default attacker-used Unix commands
    • Adds Host To IP Excluded Hosts pre-built detection context table to exclude domain controllers or host servers from enrichment

    +2 more show less

    • Enables customization of the Host to IP enrichment condition via the HostToIP platform enrichment rule in the Log Stream Enrichment tab
    • Reduces the default SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS certificate lifetime to 100 days for Site Collectors

    7 details in Everything

25. Exabeam December 2025 Dec 2025 · release notes

    Exabeam Dec 2025 adds Azure/Gemini collectors, User Entity Links table, detection grouping by ID, analytics rule insights and JSON export

    • Adds Azure Blob Storage Cloud Collector for ingesting threat detections, security alerts, and defender OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. logs from Azure
    • Adds Azure Virtual Network Flow Cloud Collector for ingesting virtual network flow logs
    • Adds Gemini Enterprise Cloud Collector for ingesting Model Armor prompts logs via GCP Pub/Sub
    • Adds Gmail BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. Cloud Collector in Early Access for ingesting Gmail logs
    • Adds User Entity Links pre-built context table to control identity-to-entity linking in Attack Surface Insights

    +15 more show less

    • Extends entity deletion window in Attack Surface Insights to entities created in the past 1,000 days
    • Adds Event ID hover, Find in search link, and Copy to clipboard button for user entity details
    • Adds detection grouping by Detection ID in Correlation Rules, Threat Center, and Threat Detection Management
    • Expands Condition Operators for Filtered Context Tables to include Equals Ignoring Case, Starts With, Not Starts With, Not Equals
    • Makes Log Source Policy conditions editable and adds Date Filter and TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. setting for log source retention
    • Enhances Host to IP Enrichment in Log Stream with expanded default filters and early access for custom exclusion conditions
    • Adds Global Token Revocation (Universal Logout) option when configuring Auth0 with Okta Identity Provider
    • Limits Webhook View Details dialog to the 10 most recent responses over 48 hours to improve load performance
    • Toggles parsed fields display and reduces drill-down clicks in the Search Timeline View
    • Extends default search retention from 31 days to 45 days for New-Scale Analytics and Fusion licenses
    • Adds Threat Center global notifications including Case name, Exabeam Nova Investigation Summary, Risk score, Classification, and Threat vector
    • Adds Analytics Rules Insights column with suggested exclusion expressions for over-triggering rules
    • Adds JSON tab to view analytics rule configuration and Required Event Fields list in rule details
    • Enforces prerequisite to apply pending analytics rule changes before enabling or deleting exclusions
    • Adds 46 new pre-built analytics rules for defense evasion, persistence, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and reconnaissance

    20 details in Everything

26. Exabeam November 2025 Nov 2025 · release notes

    Exabeam Nov 2025 adds new cloud collectors, correlation rule schedules, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for local accounts, and AI dashboard creation

    • Adds the Broadcom Carbon Black Cloud Collector, Cylance Protect (now Arctic Wolf) Cloud Collector, and GitHub Cloud Collector to ingest alerts, events, and audit logs from their respective sources.
    • Adds the Early Access Azure Blob Storage Cloud Collector, Azure Virtual Network Flow Cloud Collector, and Palo Alto Networks XDR Cloud Collector for ingesting Azure threat detections, virtual network flow logs, and Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. security alerts.
    • Enables scheduling of correlation rules to trigger daily, weekly, monthly, or during custom start/end time periods via the create or edit action in the correlation rule interface.
    • Adds four new pre-built correlation rule templates for adversary reconnaissance: Fsutil Peripheral Device Discovery Command, Password Policy Discovery Commands, System Language Discovery Commands, and Log Enumeration Commands.
    • Extends Exabeam Nova AI to auto-create dashboard visualizations for the Anomaly Fields data model using natural language prompts.

    +8 more show less

    • Allows deletion of custom services and actions in the Automation Management section, provided they are removed from all existing playbooks first.
    • Adds Multi-factor Authentication (MFA) support for local accounts, requiring TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. registration on next login when enabled in Single Sign-On/MFA settings.
    • Enhances Live Tail filtering to allow filtering the log stream by source collector in addition to parser.
    • Adds alert_created_time, case_created_time, and case_closed_time timestamps to case webhook payloads, and alert_created_time to alert webhook payloads.
    • Increases playbook name character limit to 205 characters and allows creation of up to 20 advanced playbooks without a trigger.
    • Adds filtering of automation services by creator in the Automation Management section.
    • Organizes Attack Surface Insights entity details by source, separating Context Data and Event Data attributes.
    • Displays pre-built service origin with Exabeam name and logo under the CREATED BY column for pre-built services.

    13 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Custom Default category of parsers in Log Stream is discontinued; custom default parsers are removed one region at time starting January 2026, and corresponding standard default parsers will be enabled.
27. Exabeam October 2025 Oct 2025 · release notes

    Exabeam New-Scale October 2025 adds Salesforce/Snowflake collectors, IP-based UI/API restrictions, expanded search context tables, and new registry analytics rules.

    • Adds Salesforce EventLog Cloud Collector to ingest event data from the Salesforce cloud.
    • Adds Snowflake Cloud Collector for Login History, Others, and Query History event types.
    • Adds Broadcom Carbon Black Cloud Collector in Early Access to ingest Alerts, Events, and Audit Logs from storage buckets.
    • Enables import and export of JSON configuration settings for the REST API Cloud Collector via the Early Access program.
    • Adds a new IP-Based Access page in Settings to restrict UI and public API access by IP address or range.

    +12 more show less

    • Adds an Entities tab in the Search Details panel to view user entity information and pivot to timelines directly from search results.
    • Expands context table display in Search results, showing source table name, column, and extracted value in purple chips within List/Timeline views.
    • Increases analytics rule description character limit to 1,024 characters in the analytics rule builder.
    • Makes actOnCondition mandatory and trainOnCondition mandatory/true (defaulted to true) for factFeature rules created via JSON.
    • Removes configurability of trainOnCondition in the analytics rule builder for factFeature rules, defaulting it to true.
    • Makes value optional for factFeature rules in JSON configuration.
    • Makes Count per field optional for numericCountProfiledFeature, numericDistinctCountProfiledFeature, and numericSumProfiledFeature rules in the builder.
    • Adds 30+ new pre-built analytics rules focused on registry manipulations, service configurations, and DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. registrations.
    • Excludes Advanced Analytics rules with session-end events from coverage calculations, marking them as Unsupported.
    • Enhances Event tab Parsed Fields in Details panel to show expanded context table records with arrows indicating the source column.
    • Adds host-to-IP enrichment using a dynamic mapping table for logs matching specific activity types by default.
    • Allows customization of host-to-IP enrichment conditions (activity types, outcomes, vendors) via Early Access program.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !trainOnCondition is no longer configurable in the analytics rule builder for factFeature rules and defaults to true.
    • !actOnCondition becomes a mandatory field when creating factFeature rules via JSON.
28. Exabeam September 2025 Sep 2025 · release notes

    Exabeam September 2025 adds new Cloud Collectors, Custom Analytics Rule Builder, and Peer Comparison in Outcomes Navigator

    • Adds GCP Cloud Logging Cloud Collector for log ingestion from Google Cloud services.
    • Adds GCP Security Command Center Cloud Collector for security data ingestion.
    • Adds Progress ShareFile Cloud Collector supporting AccessChange, SharesSend, Activity, and SharesRequest endpoints.
    • Adds Early Access Cylance Protect (now Arctic Wolf) Cloud Collector for Memory Protection and Threats.
    • Adds Early Access Salesforce EventLog Cloud Collector for various Salesforce event types.

    +11 more show less

    • Adds Early Access Snowflake Cloud Collector for Login History, Others, and Query History.
    • Enables creation of standalone cases from correlation detections via detection grouping rule using the correlation rule group by field.
    • Adds Analytics Rules Severity setting to manually tune case/alert risk scores with weights for None, Low, Medium, High, and Critical.
    • Adds Custom Analytics Rule Builder in Threat Detection Management with a point-and-click interface.
    • Adds Peer Comparison feature in Outcomes Navigator under MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&ACK Coverage and Use Case Coverage tabs.
    • Allows sorting search exports chronologically via the sort order selector in exported results.
    • Enables viewing associated detection events in Timeline view via the Show Associated Events option.
    • Adds capability to open cases or alerts in a new browser tab by right-clicking the list item.
    • Increases case note character limit to 10,000 characters and custom closed reason limit to 10,000 characters.
    • Increases attachment size limit to 15 MB per file.
    • Adds Silent Monitoring Threshold feature allowing configuration of the Warn After Silent For duration from 30 minutes to 72 hours.

    16 details in Everything

29. Exabeam August 2025 Aug 2025 · release notes

    Exabeam August 2025 adds dozens of Cloud Collectors, Automation Agents, and Search UI enhancements

    • Adds AWS CloudWatch Alarms Cloud Collector for ingesting AWS CloudWatch alarms related events
    • Adds AWS GuardDuty Cloud Collector for ingesting GuardDuty Findings from AWS S3 bucket
    • Adds AWS Security Lake Cloud Collector for ingesting security events from AWS S3 Security Lake bucket
    • Adds DataBahn Cloud Collector for ingesting events from DataBahn sources
    • Adds Dropbox Cloud Collector for ingesting team activity logs from Dropbox

    +12 more show less

    • Adds Qualys Cloud Collector for ingesting Activity Logs and Vulnerabilities including VM host detection events from Qualys sources
    • Adds Slack Cloud Collector for ingesting events from the Audit Logs API endpoints
    • Adds Tenable Cloud Collector for ingesting vulnerability events from Tenable APIs
    • Adds Zoom Cloud Collector for ingesting events from the sign-in/sign-out activity and operational logs endpoints
    • Adds GitHub Cloud Collector in Early Access to ingest GitHub enterprise audit logs via the GitHub Enterprise Audit API endpoint
    • Adds GCP Cloud Logging Cloud Collector in Early Access to ingest logs from Google Cloud services
    • Adds GCP Security Command Center Cloud Collector in Early Access to ingest logs from GCP Security Command Center
    • Adds Progress ShareFile Cloud Collector in Early Access to ingest logs from the ShareFile endpoints: AccessChange, SharesSend, Activity, and SharesRequest
    • Adds Automation Agents to securely connect Automation Management to segmented networks using Docker-assigned JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. for remote playbook execution
    • Adds Pre-Defined Case Closed Reasons available when changing case stage to Closed in rule-based playbooks or the Threat Center Overview tab
    • Adds Vulnerability Scanners context table as a pre-built correlation rules context table in Context Management
    • Adds Support for Sort Order in Saved and Exported Searches persisted in the Sorting column for recent and saved searches lists

    17 details in Everything

30. Exabeam July 2025 Jul 2025 · release notes

    Exabeam New-Scale July 2025 adds Anomali & Qualys cloud collectors, custom analytics rules, and context record deletion API.

    • Adds Anomali Cloud Collector to facilitate threat intelligence data collection from an Anomali source that supports the STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. framework
    • Adds support for authentication via Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. Account for Azure EventHub Cloud Collector
    • Adds Dropbox Cloud Collector Early Access to facilitate ingestion of team activity logs from Dropbox
    • Adds Qualys Cloud Collector Early Access to facilitate ingestion of Activity Logs, and Vulnerabilities including VM host detection events from Qualys sources
    • Adds Slack Cloud Collector Early Access to facilitate ingestion of events from the Audit Logs API endpoints

    +4 more show less

    • Enables export of log sources via the Log Source service for monitoring active and inactive log sources
    • Allows selection of unique log source identifiers when creating a log source policy in the Log Source service
    • Extends notification capabilities with Global Email Notifications to send email notifications to a specific user or a shared distribution list
    • Adds Custom Analytics Rules capability allowing creation of analytics rules in JSON format and import into Threat Detection Management

    9 details in Everything

31. Exabeam June 2025 Jun 2025 · release notes

    Exabeam New-Scale adds 9 new UBA correlation rules, 6 Cloud Collectors, Timeline View in Search, and bulk Scheduled Reports actions.

    • Adds Cisco Secure Endpoint Cloud Collector, CrowdStrike Context Devices Cloud Collector, Trellix Endpoint Security Cloud Collector, Anomali Cloud Collector, AWS GuardDuty Cloud Collector, AWS Security Lake Cloud Collector, Tenable Cloud Collector, and Zoom Cloud Collector to facilitate ingestion of security events from their respective sources.
    • Adds 16 new or updated correlation rule templates including 'UBA: Large number of denied access events towards external domain', UBA: Account or Group or Privileges Modified, Server-side request forgeryServer-side request forgeryServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., and Volume Shadow Copy Created to identify insider threats and reconnaissance.
    • Expands the Trigger Count filter on the Anomalies Dashboard with an increased maximum value of 10,000 for more accurate anomaly trigger rate reporting.
    • Adds eight new pre-built compliance dashboards: CMMC Analyst/Management, HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. Analyst/Management, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001 Analyst/Management, NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. Analyst/Management, NIST 800-171 Analyst/Management, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. Analyst/Management, and PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. Analyst/Management.
    • Adds Send Now and Delete bulk actions to the Scheduled Reports tab to send multiple reports immediately or remove them without waiting for configured delivery times.

    +6 more show less

    • Expands access to create custom enrichment rules in the Log Stream application to all New-Scale license holders (SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents., Fusion, Analytics) and introduces a new operator for context keys and on-the-fly custom field creation.
    • Adds support for custom user roles in Multi-Org Management to configure permissions tailored to specific needs for parent or child organizations.
    • Introduces Exabeam Nova Analyst Assistant, an AI assistant that interprets MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Coverage Summary or Use Case Coverage Summary to generate natural language responses about security posture.
    • Expands access to the Timeline view of search results to all license types and adds a configurable server-side sort order selector in the Search bar for chronological ordering.
    • Adds notifications on the Long-Term Consumption Details page when users reach 100% or exceed their long-term search quota based on license terms.
    • Adds new Public API endpoints for License Consumption to read current license level, historical usage data, and details for each license type (SIEM, NSA/AA, Long-term Search, Long-term Storage, API).

    11 details in Everything

32. Exabeam May 2025 May 2025 · release notes

    Exabeam May 2025 adds CrowdStrike and STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data. Cloud Collectors, custom enrichment rules in Log Stream, and alert management features.

    • Adds CrowdStrike Context Devices Cloud Collector to ingest device data without the Exabeam Ingester for CrowdStrike license add-on
    • Adds STIX/TAXII Cloud Collector to collect threat intelligence about IP addresses or domains and auto-generate a context table in Context Management
    • Adds Recorded Future Context Cloud Collector to collect STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form./TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. threat intelligence and auto-generate a Recorded Future context table
    • Enables creating, editing, and duplicating custom enrichment rules directly in the Enrichments tab of Log Stream for those with a New-Scale Analytics license or Early Access program
    • Adds AI-generated MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage summary in Outcomes Navigator identifying top three techniques with increased/decreased scores and recommendations

    +5 more show less

    • Adds watchlists feature to monitor and rank entities by risk score over time, including five pre-built lists and custom creation based on entity tags
    • Adds entity tags from Attack Surface Insights to Threat Center cases or alerts to enable searching for specific kinds of entities
    • Enables dismissing individual or multiple alerts with reason, user, and timestamp recorded in the Overview tab and alert history
    • Allows marking alerts as read/unread, tracking status in the STATUS column, and reverting dismissed alerts to unread when risk scores increase by a specified percentage (default 10%)
    • Adds Hide Dismissed toggle in the Alerts tab to filter out dismissed alerts from the list

    10 details in Everything

33. Exabeam April 2025 Apr 2025 · release notes

    New cloud collectors for Cloudflare, Google Workspace, LastPass, ServiceNow, Vectra; API endpoints for access control and service health; expanded IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. search via ioc_sources

    • Adds support for five new Cloud Collectors: Cloudflare, Google Workspace, LastPass, ServiceNow, and Vectra.
    • Introduces regex filtering capability for CrowdStrike Falcon (via FDR), AWS S3, AWS CloudTrailCloudTrailAWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. (via S3), SentinelOne CloudFunnel, Cisco Umbrella, and Azure Event Hub Cloud Collectors.
    • Adds an ioc_sources attribute to enriched IOC fields in Context Management and Search to identify the log source of a suspected IOC record.
    • Enables context table searching on non-key columns using IN "table name"."column name" syntax in Advanced search mode.
    • Provides three new Access Control API endpoints to programmatically retrieve lists of users, roles, and API keys.

    +2 more show less

    • Adds an Exabeam Public API endpoint under Service Health Consumption to retrieve license information for Long Term Search, Long Term Storage, and Correlation Rules using OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. client credentials.
    • Updates the default Search UI in Attack Surface Insights to provide a blank slate by removing the default search query for user and device entities.

    7 details in Everything

34. Exabeam March 2025 Mar 2025 · release notes

    Exabeam March 2025 adds Mimecast/Sophos/STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form.-TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. collectors, Exabeam Nova AI, and Threat Center sorting/filtering.

    • Adds Mimecast Cloud Collector with support for Archive Search Logs, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Attachment Protection Logs, TTP Impersonation Protect Logs, TTP URL Logs, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Logs, Archive Message View Logs, and Audit Events
    • Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. Cloud Collector to facilitate data collection from REST API endpoints
    • Adds Sophos Cloud Collector for alerts and events data sources
    • Adds Event Exploration on Search via Cloud Collectors with an Open in Search option to view prepopulated queries
    • Adds Cloudflare, Google Workspace, LastPass, Vectra, STIX/TAXIISTIX/TAXIISTIX is an OASIS-maintained JSON schema for expressing threat intelligence objects; TAXII is the companion HTTP protocol for exchanging them, giving cyber tools a vendor-neutral way to share indicators and threat data., and Recorded Future Context Cloud Collectors in Early Access

    +14 more show less

    • Adds STIX/TAXII Context Tables in Context Management for processing threat intelligence data
    • Adds a Scheduled Reports tab in the Dashboards application with Run Now, Edit, Duplicate, and Delete controls
    • Adds ability to add descriptive child names in the Multi-Org Console
    • Introduces Exabeam Nova, an agentic AI tool for automating investigative tasks
    • Adds Coverage Summaries with Use Case Coverage Score and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Coverage Scores in Outcomes Navigator
    • Extends Data Insights availability to users with any Exabeam Security Operations licenses
    • Enhances Entity Search with support for full name or any username/email address and new tooltips
    • Adds Windows Server 2025 and Windows Server 2025 Core support for Agent Collectors
    • Enhances Threat Center with Exabeam Nova Analyst Assistant using the 50 most recently grouped detections
    • Adds Created, Queue, and Assignee columns to Threat Center cases
    • Adds sorting by Grouped By, Stage, Queue, and Assignee in Threat Center
    • Adds filtering capabilities for cases (priority, grouped by value, stage, queue, assignee) and alerts (priority, grouped by value)
    • Increases Notes character limit to 4,000 in Threat Center
    • Shows full name of the rule type in the Threat Timeline

    19 details in Everything

35. Exabeam February 2025 Feb 2025 · release notes

    New UK region support, Cisco Meraki/Sophos/Mimecast/REST/Kafka collectors, correlation rule statuses/descriptions, NL visualization, device context search, license PDF export

    • Cisco Meraki Cloud Collector available in Early Access for data collection from Cisco Meraki APIs
    • Mimecast Cloud Collector available in Early Access for Archive Search Logs, TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. Attachment Protection Logs, TTP Impersonation Protect Logs, TTP URL Logs, SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Logs, Archive Message View Logs, and Audit Events
    • Sophos Cloud Collector available in Early Access for alerts and events data sources
    • REST API Cloud Collector available in Early Access for data collection from REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints
    • Kafka Collector added to Site Collectors 2.6 for collecting logs in any text format from Kafka servers

    +9 more show less

    • Archive Windows Collector added to Site Collectors 2.6 for *.gz, *.tar, *.tar.gz, *.gzip, *.rar, *.7z log files
    • Archive Linux Collector added to Site Collectors 2.6 for *.7z, *.arj, *.bzip2, *.cab, *.gzip, *.iso, *.lzh, *.rar, *.gz, *.tar, *.tar.gz, *.z, and *.zip log files
    • Correlation rules now support Stopped status (auto-disabled if triggered >50 times in 5 minutes) and Testing status (outcomes suppressed)
    • Correlation rules now support a user-defined description field visible in list and details views, auto-reused from templates
    • Threat Center Alert visualizations can be auto-created using natural language prompts via Exabeam Nova
    • Basic and Advanced Search now supports querying device context tables for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., CrowdStrike, and Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
    • License View dashboard adds option to export details as a PDF file
    • Analytics rules changes can now be applied using the Apply Changes Without Training option in bulk operations
    • All Threat Center cases are automatically assigned a unique numeric case ID for human-readable reference and search

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Search API limit parameter no longer accepts -1; it must be a positive integer (default 3,000)
36. Exabeam January 2025 Jan 2025 · release notes

    New-Scale platform introduces Attack Surface Insights directory, Threat Detection Management hub, advanced playbooks with actions/loops, and Site Collector multi-template sup

    • Adds Attack Surface Insights as a new directory for organizational resources (entities) linked by contextual data.
    • Adds Threat Detection Management as a centralized interface for creating, testing, and tuning correlation and analytics detection rules.
    • Introduces advanced playbooks in Automation Management that support actions, branches, loops, manual execution, draft deployment, and run history viewing.
    • Enables creation of No Trigger Playbooks that can only be manually run on specific cases or alerts without automatic triggers.
    • Adds deep integration of Automation Management into Threat Center, including the Automation tab in case/alert Overview showing recent playbooks/actions and full history.

    +32 more show less

    • Introduces Box Cloud Collector for ingesting user and enterprise events from Box.
    • Adds Cisco Meraki Cloud Collector (Early Access) for security events, alerts, and config changes via Cisco Meraki APIs.
    • Adds Recorded Future Cloud Collector for ingesting API Alerts.
    • Introduces ServiceNow Cloud Collector (Early Access) ingesting data from Incident, Task, Change Request, Syslog Transaction, and other source types.
    • Updates Context Management to support Custom, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., CrowdStrike, and Microsoft Entra ID context tables for device data.
    • Adds New-Scale Analytics pre-built context tables in Context Management for supporting the New-Scale Analytics engine and Attack Surface Insights.
    • Adds Show Results in Search option to dashboard visualizations for rule-triggered events, enabling pivoting to Search.
    • Renames all dashboards activity types from report to dashboard in audit logs and adds specific event types: dashboard-create, dashboard-delete, dashboard-download, dashboard-export, dashboard-import, dashboard-modify, dashboard-publish, folder-create, folder-delete, folder-modify, scheduled_task-create, scheduled_task-delete, scheduled_task-modify.
    • Adds Dependencies column to Log Stream Parsers Overview tab to show parser completeness and quality.
    • Introduces Enrichments tab in Log Stream for viewing, managing, enabling/disabling, editing, exporting, and importing enrichment rules.
    • Adds Event Filtering tab in Log Stream to filter events routed to New-Scale Analytics detection engine or Attack Surface Insights application.
    • Allows device context tables (Active Directory, CrowdStrike, Microsoft Entra ID) in both Basic and Advanced search queries.
    • Introduces Relative time range option for Search queries allowing custom start/end relative dates.
    • Adds guardrails/warnings for pipe operator misuse in Advanced Search mode suggesting AND or WHERE alternatives.
    • Introduces Timeline view for Search results to visualize investigation timelines of detection events.
    • Adds Rule Details panel in Search showing raw logs, parsed fields, and associated rules for detection events.
    • Adds Insights tab in Event Details panel for visualizing surrounding context (assets, countries, files) for user/device events.
    • Adds Entities tab to Basic Search pre-built lists for searching user/entity accounts with enriched data.
    • Adds multi-template support for Windows File Collector and Linux File Collector allowing different log conditions per template.
    • Adds configurable Splunk fetch interval options in the Splunk collector.
    • Adds support package generation command via PowerShell for Windows Event Log, File, and Archive Collectors.
    • Adds support for Ubuntu 24.04 operating system for Site Collector installation.
    • Adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. connection option with custom security certificates to Kafka Collector (Early Access).
    • Enables investigation of triggered analytics rules as detections in Threat Center for New-Scale portfolio license holders.
    • Updates risk score calculation in Threat Center to use behavioral analytics rarity scores and confidence factors.
    • Adds ability to manually create cases from scratch without an associated alert in Threat Center.
    • Enables AI-generated case names (Copilot Case Names) for cases converted from alerts in Threat Center.
    • Enhances entity display in Threat Center showing full name/email for users and hostname for devices.
    • Allows viewing device entity details from Attack Surface Insights directly within Threat Center.
    • Adds User Entity Search capability via Entities tab to find cases/alerts grouped by specific user entities.
    • Adds new SCOPE column in Threat Center listing counts of Rules, Users, Endpoints, MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. tactics/techniques, and Use Cases.
    • Enhances investigation timeline navigation to automatically filter Search events by assigned risk score.

    37 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Correlation rules in test mode no longer create Threat Center cases or alerts; events now have activity type rule-trigger-test.