https://cybertoolchain.io/tools/exabeam New releases and features in Exabeam, tracked by The Cyber Toolchain. en Wed, 16 Sep 2026 18:11:12 GMT https://developers.exabeam.com/exabeam/changelog/new-threat-center-endpoint-1 https://developers.exabeam.com/exabeam/changelog/new-threat-center-endpoint-1 Wed, 16 Sep 2026 18:11:12 GMT Exabeam Threat Center gains a new API endpoint for retrieving full case lifecycle history and audit events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `GET` API endpoint under `Threat Center > Cases > Get case lifecycle history` for retrieving the comprehensive lifecycle history, stage transitions, and audit events of a case.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://developers.exabeam.com/exabeam/changelog/enhanced-threat-center-endpoint https://developers.exabeam.com/exabeam/changelog/enhanced-threat-center-endpoint Wed, 15 Jul 2026 19:46:03 GMT Exabeam Threat Center adds `caseClosedTimestamp` field to case details, enabling Time-to-Close metrics. • Adds `caseClosedTimestamp` (date-time string) to the Get Case Details response schema, exposing when a case was closed for Time to Close (TTC) and Mean Time to Close (MTTC) calculations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://developers.exabeam.com/exabeam/changelog/new-threat-center-endpoints-1 https://developers.exabeam.com/exabeam/changelog/new-threat-center-endpoints-1 Tue, 16 Jun 2026 20:50:52 GMT Exabeam adds Threat Center API endpoints to retrieve threat timelines by alert ID or case ID. • New API endpoint to retrieve a threat timeline given a specific alert ID. • New API endpoint to retrieve a threat timeline given a specific case ID. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://developers.exabeam.com/exabeam/changelog/new-threat-center-endpoints-1 https://developers.exabeam.com/exabeam/changelog/new-threat-center-endpoints-1 Tue, 16 Jun 2026 20:50:52 GMT New endpoints added to retrieve threat timelines for specific alerts or case IDs. • Added `Threat Center > Threat Timeline > Get the threat timeline given an alert id` endpoint. • Added `Threat Center > Threat Timeline > Get the threat timeline given a case id` endpoint. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/june-2026.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/june-2026.html Mon, 01 Jun 2026 00:00:00 GMT Exabeam June 2026 adds Phishing Email Inbox Collector, OpenAI/REST API collectors, Nova rule creator, and Entity Health dashboard. • Phishing Email Inbox Cloud Collector ingests phishing mailbox metadata and logs • OpenAI Cloud Collector ingests data from your Open AI platform (early access) • REST API Context Collector ingests context data from REST API endpoints (early access) • REST API Context Tables support custom context sources mapped via the REST API Context collector • Entity Health Dashboard shows entity coverage, uniqueness, and identity resolution issues (early access) • Optional Email Address and Username Prefix Linking allows linking identities with identical prefixes but different domains • Attack Surface Insights rules can preview up to five matching entities using the `Test Conditions` button • Exabeam Nova Rule Creator drafts correlation and analytics rules from natural language descriptions • Correlation rule templates updated for MITRE ATT&CK v19 Stealth and Defense Impairment tactics (77 templates) • Search results display increased to 5,000 events across Timeline, List, and Table views • Timeline view supports continuous scrolling without manual paging • Timeline query date range expanded to 31 days (early access opportunity) • Global Search can now search by `ip_address` and `full_name` fields • Visualization charts support Series Positioning, Scale Type, Missing Date handling, and Results Count limits • Custom Visualization window defaults `Field` = user, `Metric` = count, `Chart Type` = bar chart • Log Stream audit log covers event-enricher and platform-event-enricher operation types • Log Stream Parsers Overview shows Tier Distribution and Parsed vs. Unparsed graphs for the last 24 hours • Log Stream extraction preview supports `exa_regex` syntax and `$..` recursive JSON syntax • Exabeam MCP Server now supports getting threat summaries, context tables, correlation rules, and MITRE coverage scores • Outcomes Navigator queries Search for `rule-trigger` activity_type to verify analytics rule satisfaction • Service Health App Config tab introduces dedicated RBAC permissions (Read, Write, Delete) • Direct Access Agent (DAA) Windows Event Log Collector collects logs natively from Windows servers • Threat Center watchlists increased limit to 40 and support reordering via drag-and-drop • Watchlist entity display shows open/closed cases and alerts with direct navigation links • New Early Access Pre-Built Analytics Rules for AI agent installation, OpenClaw activity, and MCP permission abuse • Pre-built Phishing Rule detection grouping rule groups detections by email subject • Merge Phishing Detection Engine Cases playbook merges related phishing cases over a 14-day period • Phishing Rule Detections assigned static rarity score of 50 in Threat Center Breaking changes: • The Log Sources tab in Site Collectors will be deprecated in August 2026; migrate to the Log Sources application. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/may-2026.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/may-2026.html Fri, 01 May 2026 00:00:00 GMT Exabeam May 2026 adds PingOne/S2W/Workday collectors, MCP case management, and Post-Default enrichers. • Adds `PingOne Identity Cloud Collector` for user activity audit logs • Adds `S2W Threat Intelligence Cloud Collector` for threat intel ingestion • Adds `Workday Cloud Collector` for user activity logs from Workday API • Adds `OAuth2.0 JWT Grant` authentication support to the `REST API Cloud Collector` • Adds `Pre-Default` and `Post-Default` ordering options for custom enrichers in Log Stream • Adds case creation, update, note creation, and alert update capabilities to the Exabeam MCP Server • Adds a platform-wide global search bar accessible via the Navigation Center • Adds the `Manage All Schedule Reports` permission level for administrators • Adds `Exabeam Nova` auto-creation panel alongside Basic panel in Custom Visualization authoring • Adds the GetContextAttribute() function for precise context table queries in analytics rules • Adds public/private visibility toggle for saved searches in Threat Center • Adds sorting by title, creator, and modification date to saved searches • Adds filtering of field names in the Search Results Summary list • Adds `NIST 800-53`, `NIIST CSF`, and `NIIS2` compliance framework support in Outcomes Navigator Breaking changes: • The following pre-built enrichment rules have been removed: `UID to User Lookup`, `EmployeeNumber to User Lookup`, `Email to User Enricher-1`, `Destination Email to Destination User Enricher-1`, `Email to User Enricher-2`, `Destination Email to Destination User Enricher-2`, `User SID to User Lookup`, `Microsoft User UPN to User/Email Enricher`, `CrowdStrike Asset ID to User Lookup`, `Discard EM External`, `Discard EM Ephemeral`, `Discard Exabeam Users` • The following pre-built analytics rules have been removed: `Cntx-SA-ECrit`, `Cntx-PC-ECrit-CS`, `Cntx-PC-ECrit-Server`, `NumDCP-Network-DEC-SE-DE`, `NumDCP-Network-DIPC-DP-DIP`, `NumDCP-Network-DIPC-DP-DIP-SE`, `NumDCP-Network-DIPC-DP-DIP-SIP`, `NumDCP-Network-DIPC-O-DIP-SE`, `NumDCP-Network-DIPC-O-DIP-SIP`, `NumDCP-Network-DIPC-O-DIP-U`, `NumDCP-Network-DIPC-SE-DIP`, `NumDCP-Network-DIPC-U-DIP`, `Prof-Network-ToExtIP-O-DP`, `Prof-Network-ToExtIP-O-SE`, `Prof-Network-ToExtIP-O-SZ` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/april-2026.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/april-2026.html Wed, 01 Apr 2026 00:00:00 GMT Exabeam April 2026 adds MCP Server integration, device entity search, and new detection rules. • Adds Exabeam Model Context Protocol (MCP) Server to connect external AI tools for discovering and acting on Exabeam data • Adds Device Entity option in Basic search mode and Entities tab in Search results to view device details without leaving the application • Adds Trigger on first match and Group by Field options for Sequence correlation rules • Adds Require supporting reason toggle in Threat Center settings to make case closed reasons mandatory • Adds new pre-built analytics rules including Fact-EL-UnauthorizedWindowsRDP, Prof-AI-TI-UTN-FN, and NumCP-VPNlnF-EC-O-U-1Day • Adds PingOne Identity Cloud Collector for early access to ingest user activity logs • Adds Workday Cloud Collector for early access to ingest user activity logs from the Workday API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/march-2026.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/march-2026.html Sun, 01 Mar 2026 00:00:00 GMT Exabeam March 2026 adds AI monitoring collectors, Agent Behavior Analytics detections, Outcomes Navigator compliance tracking, and configurable analytics rule logic. • Adds `ChatGPT Enterprise Cloud Collector` for ingesting ChatGPT Enterprise data via Agent Behavior Analytics • Adds `Microsoft Copilot` support with Agent Behavior Analytics for monitoring AI-driven activity • Adds new AI-driven detections including identity/privilege misuse, prompt/model abuse, and agent lifecycle monitoring • Adds `Discard_EM_USER` and `Discard_EM_HOST` `m_tags` values in Log Stream enrichment rules to control entity type creation in Attack Surface Insights • Adds `Link Reasons` column to view linking methods between user entities and accounts in Attack Surface Insights • Adds automatic bulk tag removal capability in Attack Surface Insights rules actions • Adds manual playbook execution on manually created Threat Center cases via Automation Management • Adds `Automation History` tab for viewing automation history on manually created Threat Center cases • Adds `ChatGPT Enterprise Cloud Collector` and `Microsoft Entra ID Context Cloud Collector` enhancements with MFA/SSPR attributes • Adds `Phishing Email Inbox Cloud Collector` in Early Access for phishing mailbox monitoring • Adds new Microsoft Entra ID user context table columns: `MFA Capable`, `MFA Registered`, `SSPR Registered`, `Auth Methods Registered`, `Manager` • Adds new Agent Behavior Analytics context tables: `AI/LLM Web Domains`, `AI/LLM Web Categories`, `AI/LLM Applications` • Adds new detection context tables `Unsafe Countries` and `Credentials Dumping Processes` for New-Scale Analytics • Adds `Home` tab in Dashboards application to set a default landing dashboard • Adds `Threat Center Dashboard Enhancements` including Mean Time to Close measure, four new dimensions, and filters by Case Creation Timestamp/Case Number • Adds global search bar Early Access feature for platform-wide entity lookup • Adds Outcomes Navigator compliance coverage tracking for HIPAA and PCI DSS with Compliance Coverage Score • Adds customizable framework selection in Outcomes Navigator (TDIR, MITRE ATT&CK, HIPAA, PCI DSS) • Adds configurable `Detection Rule Display` preference to control rule information display in Search • Adds visible rule severity scores on the `Detections` tab Details panel in Search • Adds pinned fields persistence to top of Parsed Fields list in Search Details panel • Adds locked header row and compact display improvements to Search Table view • Adds new column options menu per cell and `Details` link in Search Table view • Adds `Reorder` button for enrichment rule priority ordering in Log Stream Enrichments tab • Adds new selection menu with Expressions and Fields lists for field mapping in Log Stream enrichment rules • Adds Direct Access Agent (DAA) Windows Collector Early Access for native Windows Event Log collection • Adds `Case Bulk Edit` capability to update up to 50 cases at once in Threat Center • Adds step-by-step risk score explanation view under How was this calculated? in Threat Center • Adds complex AND/OR and nested logic support for Applicable Events in Analytics Rule Builder • Adds three new analytics rule functions: isRandomHostName(), isRandomDomain(), contextGetValue() • Adds `minTotalEventsThreshold` and `maxTotalEventsThreshold` fields to analytics rule JSON configuration for numericCountProfiledFeature rules • Adds `Testing` status indicator in Analytics Rule Builder Change column and direct Testing selection • Adds new `QUICK SEARCH` column (managed via Manage Columns) to navigate to triggering events from analytics rules • Adds `Score Unless` field configuration in the Analytics Rule Builder for profiledFeature and factFeature rules • Adds 25+ new pre-built AI-focused analytics rules including token count, first-time role/group/agent creation, and prompt injection indicators Breaking changes: • Dimensions whose names start with `Closed Timestamp` have been renamed to start with `Case Closed Timestamp` in the Threat Center data model Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/february-2026.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/february-2026.html Sun, 01 Feb 2026 00:00:00 GMT Exabeam Feb 2026 adds Mimecast Incydr/S2W TI collectors, AI use case support, rule training periods, and new cloud/credential detection rules. • Adds `Mimecast Incydr Cloud Collector` for File events ingestion • Adds `S2W Threat Intelligence Cloud Collector` (Early Access) for threat intel ingestion • Adds `agentic_ai_security` use case support in Outcomes Navigator • Adds `minimumTrainingPeriodInDays` field to analytics rule JSON config or builder to delay triggering during baseline establishment • Enables CIM 2.0 fields selection in the analytics rule builder for applicable events • Adds `minOrderOfMagnitude` field support with range 1–32 for numeric profiled feature rules • Adds suppression toggle under `Suppress Length` to prevent repeated triggering on specified fields • Adds new correlation rule templates: `AWS root account logged in without MFA`, `Large amount of failed delivery status notifications for this Gmail account`, `Remote HTA file executed using 'mshta.exe'`, and `Remote MSI file executed using 'msiexec.exe'` • Adds dozens of new pre-built analytics rules covering credential dumping, privilege escalation, persistence, data exfiltration, lateral movement, RDP session hijacking, Kerberos attacks, malicious code execution, and AI misuse • Enhances timeline view in search to automatically include source events that did not meet query criteria but triggered a detection Breaking changes: • Removed option to add rows directly to filtered context tables; must add to parent context tables instead • Removed `Custom Default` parser category in Log Stream Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://developers.exabeam.com/exabeam/changelog/mcp https://developers.exabeam.com/exabeam/changelog/mcp Wed, 14 Jan 2026 16:39:24 GMT Exabeam adds an MCP server for AI assistants to interact with API documentation. • Adds `MCP server` integration enabling AI assistants (Claude, ChatGPT, Gemini) to interact with Exabeam's API documentation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/january-2026.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2026-release-notes/january-2026.html Thu, 01 Jan 2026 00:00:00 GMT Exabeam New-Scale SOC adds Gmail and Palo Alto XDR cloud collectors, Context Management key icon, and Host to IP enrichment customization. • Adds `Gmail BigQuery Cloud Collector` for ingesting gmail logs • Adds `Palo Alto Networks XDR Cloud Collector` for ingesting Cortex XDR security alert logs • Adds a visible key icon (`\u25CB`) in column headers to identify the key attribute in Context Management custom and pre-built tables • Adds `Threat Unix Commands` pre-built detection context table populated with default attacker-used Unix commands • Adds `Host To IP Excluded Hosts` pre-built detection context table to exclude domain controllers or host servers from enrichment • Enables customization of the Host to IP enrichment condition via the `HostToIP` platform enrichment rule in the Log Stream Enrichment tab • Reduces the default SSL/TLS certificate lifetime to 100 days for Site Collectors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/december-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/december-2025.html Mon, 01 Dec 2025 00:00:00 GMT Exabeam Dec 2025 adds Azure/Gemini collectors, User Entity Links table, detection grouping by ID, analytics rule insights and JSON export • Adds Azure Blob Storage Cloud Collector for ingesting threat detections, security alerts, and defender OTP logs from Azure • Adds Azure Virtual Network Flow Cloud Collector for ingesting virtual network flow logs • Adds Gemini Enterprise Cloud Collector for ingesting Model Armor prompts logs via GCP Pub/Sub • Adds Gmail BigQuery Cloud Collector in Early Access for ingesting Gmail logs • Adds User Entity Links pre-built context table to control identity-to-entity linking in Attack Surface Insights • Extends entity deletion window in Attack Surface Insights to entities created in the past 1,000 days • Adds Event ID hover, 'Find in search' link, and 'Copy to clipboard' button for user entity details • Adds detection grouping by Detection ID in Correlation Rules, Threat Center, and Threat Detection Management • Expands Condition Operators for Filtered Context Tables to include Equals Ignoring Case, Starts With, Not Starts With, Not Equals • Makes Log Source Policy conditions editable and adds Date Filter and TTL setting for log source retention • Enhances Host to IP Enrichment in Log Stream with expanded default filters and early access for custom exclusion conditions • Adds Global Token Revocation (Universal Logout) option when configuring Auth0 with Okta Identity Provider • Limits Webhook View Details dialog to the 10 most recent responses over 48 hours to improve load performance • Toggles parsed fields display and reduces drill-down clicks in the Search Timeline View • Extends default search retention from 31 days to 45 days for New-Scale Analytics and Fusion licenses • Adds Threat Center global notifications including Case name, Exabeam Nova Investigation Summary, Risk score, Classification, and Threat vector • Adds Analytics Rules Insights column with suggested exclusion expressions for over-triggering rules • Adds JSON tab to view analytics rule configuration and Required Event Fields list in rule details • Enforces prerequisite to apply pending analytics rule changes before enabling or deleting exclusions • Adds 46 new pre-built analytics rules for defense evasion, persistence, privilege escalation, and reconnaissance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/november-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/november-2025.html Sat, 01 Nov 2025 00:00:00 GMT Exabeam Nov 2025 adds new cloud collectors, correlation rule schedules, MFA for local accounts, and AI dashboard creation • Adds the `Broadcom Carbon Black Cloud Collector`, `Cylance Protect (now Arctic Wolf) Cloud Collector`, and `GitHub Cloud Collector` to ingest alerts, events, and audit logs from their respective sources. • Adds the Early Access `Azure Blob Storage Cloud Collector`, `Azure Virtual Network Flow Cloud Collector`, and `Palo Alto Networks XDR Cloud Collector` for ingesting Azure threat detections, virtual network flow logs, and Cortex XDR security alerts. • Enables scheduling of correlation rules to trigger daily, weekly, monthly, or during custom start/end time periods via the `create` or `edit` action in the correlation rule interface. • Adds four new pre-built correlation rule templates for adversary reconnaissance: `Fsutil Peripheral Device Discovery Command`, `Password Policy Discovery Commands`, `System Language Discovery Commands`, and `Log Enumeration Commands`. • Extends Exabeam Nova AI to auto-create dashboard visualizations for the `Anomaly Fields` data model using natural language prompts. • Allows deletion of custom `services` and `actions` in the Automation Management section, provided they are removed from all existing playbooks first. • Adds Multi-factor Authentication (MFA) support for local accounts, requiring TOTP registration on next login when enabled in Single Sign-On/MFA settings. • Enhances Live Tail filtering to allow filtering the log stream by source collector in addition to parser. • Adds `alert_created_time`, `case_created_time`, and `case_closed_time` timestamps to case webhook payloads, and `alert_created_time` to alert webhook payloads. • Increases playbook name character limit to 205 characters and allows creation of up to 20 advanced playbooks without a trigger. • Adds filtering of automation services by creator in the Automation Management section. • Organizes Attack Surface Insights entity details by source, separating `Context Data` and `Event Data` attributes. • Displays pre-built service origin with Exabeam name and logo under the `CREATED BY` column for pre-built services. Breaking changes: • The `Custom Default` category of parsers in Log Stream is discontinued; custom default parsers are removed one region at time starting January 2026, and corresponding standard default parsers will be enabled. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/october-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/october-2025.html Wed, 01 Oct 2025 00:00:00 GMT Exabeam New-Scale October 2025 adds Salesforce/Snowflake collectors, IP-based UI/API restrictions, expanded search context tables, and new registry analytics rules. • Adds `Salesforce EventLog Cloud Collector` to ingest event data from the Salesforce cloud. • Adds `Snowflake Cloud Collector` for Login History, Others, and Query History event types. • Adds `Broadcom Carbon Black Cloud Collector` in Early Access to ingest Alerts, Events, and Audit Logs from storage buckets. • Enables import and export of JSON configuration settings for the `REST API Cloud Collector` via the Early Access program. • Adds a new `IP-Based Access` page in Settings to restrict UI and public API access by IP address or range. • Adds an `Entities` tab in the Search Details panel to view user entity information and pivot to timelines directly from search results. • Expands context table display in Search results, showing source table name, column, and extracted value in purple chips within List/Timeline views. • Increases analytics rule description character limit to 1,024 characters in the analytics rule builder. • Makes `actOnCondition` mandatory and `trainOnCondition` mandatory/true (defaulted to true) for `factFeature` rules created via JSON. • Removes configurability of `trainOnCondition` in the analytics rule builder for `factFeature` rules, defaulting it to true. • Makes `value` optional for `factFeature` rules in JSON configuration. • Makes `Count per` field optional for `numericCountProfiledFeature`, `numericDistinctCountProfiledFeature`, and `numericSumProfiledFeature` rules in the builder. • Adds 30+ new pre-built analytics rules focused on registry manipulations, service configurations, and DLL registrations. • Excludes Advanced Analytics rules with `session-end` events from coverage calculations, marking them as `Unsupported`. • Enhances Event tab Parsed Fields in Details panel to show expanded context table records with arrows indicating the source column. • Adds host-to-IP enrichment using a dynamic mapping table for logs matching specific activity types by default. • Allows customization of host-to-IP enrichment conditions (activity types, outcomes, vendors) via Early Access program. Breaking changes: • `trainOnCondition` is no longer configurable in the analytics rule builder for `factFeature` rules and defaults to true. • `actOnCondition` becomes a mandatory field when creating `factFeature` rules via JSON. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/september-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/september-2025.html Mon, 01 Sep 2025 00:00:00 GMT Exabeam September 2025 adds new Cloud Collectors, Custom Analytics Rule Builder, and Peer Comparison in Outcomes Navigator • Adds `GCP Cloud Logging` Cloud Collector for log ingestion from Google Cloud services. • Adds `GCP Security Command Center` Cloud Collector for security data ingestion. • Adds `Progress ShareFile` Cloud Collector supporting AccessChange, SharesSend, Activity, and SharesRequest endpoints. • Adds Early Access Cylance Protect (now Arctic Wolf) Cloud Collector for Memory Protection and Threats. • Adds Early Access `Salesforce EventLog` Cloud Collector for various Salesforce event types. • Adds Early Access `Snowflake` Cloud Collector for Login History, Others, and Query History. • Enables creation of standalone cases from correlation detections via `detection grouping rule` using the `correlation rule group by field`. • Adds `Analytics Rules Severity` setting to manually tune case/alert risk scores with weights for None, Low, Medium, High, and Critical. • Adds `Custom Analytics Rule Builder` in Threat Detection Management with a point-and-click interface. • Adds `Peer Comparison` feature in Outcomes Navigator under MITRE ATT&ACK Coverage and Use Case Coverage tabs. • Allows sorting search exports chronologically via the `sort order selector` in exported results. • Enables viewing associated detection events in Timeline view via the `Show Associated Events` option. • Adds capability to open cases or alerts in a new browser tab by right-clicking the list item. • Increases case note character limit to 10,000 characters and custom closed reason limit to 10,000 characters. • Increases attachment size limit to 15 MB per file. • Adds `Silent Monitoring Threshold` feature allowing configuration of the 'Warn After Silent For' duration from 30 minutes to 72 hours. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/august-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/august-2025.html Fri, 01 Aug 2025 00:00:00 GMT Exabeam August 2025 adds dozens of Cloud Collectors, Automation Agents, and Search UI enhancements • Adds AWS CloudWatch Alarms Cloud Collector for ingesting AWS CloudWatch alarms related events • Adds AWS GuardDuty Cloud Collector for ingesting GuardDuty Findings from AWS S3 bucket • Adds AWS Security Lake Cloud Collector for ingesting security events from AWS S3 Security Lake bucket • Adds DataBahn Cloud Collector for ingesting events from DataBahn sources • Adds Dropbox Cloud Collector for ingesting team activity logs from Dropbox • Adds Qualys Cloud Collector for ingesting Activity Logs and Vulnerabilities including VM host detection events from Qualys sources • Adds Slack Cloud Collector for ingesting events from the Audit Logs API endpoints • Adds Tenable Cloud Collector for ingesting vulnerability events from Tenable APIs • Adds Zoom Cloud Collector for ingesting events from the sign-in/sign-out activity and operational logs endpoints • Adds GitHub Cloud Collector in Early Access to ingest GitHub enterprise audit logs via the GitHub Enterprise Audit API endpoint • Adds GCP Cloud Logging Cloud Collector in Early Access to ingest logs from Google Cloud services • Adds GCP Security Command Center Cloud Collector in Early Access to ingest logs from GCP Security Command Center • Adds Progress ShareFile Cloud Collector in Early Access to ingest logs from the ShareFile endpoints: AccessChange, SharesSend, Activity, and SharesRequest • Adds Automation Agents to securely connect Automation Management to segmented networks using Docker-assigned JWTs for remote playbook execution • Adds Pre-Defined Case Closed Reasons available when changing case stage to Closed in rule-based playbooks or the Threat Center Overview tab • Adds Vulnerability Scanners context table as a pre-built correlation rules context table in Context Management • Adds Support for Sort Order in Saved and Exported Searches persisted in the Sorting column for recent and saved searches lists Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/july-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/july-2025.html Tue, 01 Jul 2025 00:00:00 GMT Exabeam New-Scale July 2025 adds Anomali & Qualys cloud collectors, custom analytics rules, and context record deletion API. • Adds Anomali Cloud Collector to facilitate threat intelligence data collection from an Anomali source that supports the STIX/TAXII framework • Adds support for authentication via Microsoft Entra ID Account for Azure EventHub Cloud Collector • Adds Dropbox Cloud Collector Early Access to facilitate ingestion of team activity logs from Dropbox • Adds Qualys Cloud Collector Early Access to facilitate ingestion of Activity Logs, and Vulnerabilities including VM host detection events from Qualys sources • Adds Slack Cloud Collector Early Access to facilitate ingestion of events from the Audit Logs API endpoints • Enables export of log sources via the Log Source service for monitoring active and inactive log sources • Allows selection of unique log source identifiers when creating a log source policy in the Log Source service • Extends notification capabilities with Global Email Notifications to send email notifications to a specific user or a shared distribution list • Adds Custom Analytics Rules capability allowing creation of analytics rules in JSON format and import into Threat Detection Management Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/june-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/june-2025.html Sun, 01 Jun 2025 00:00:00 GMT Exabeam New-Scale adds 9 new UBA correlation rules, 6 Cloud Collectors, Timeline View in Search, and bulk Scheduled Reports actions. • Adds `Cisco Secure Endpoint Cloud Collector`, `CrowdStrike Context Devices Cloud Collector`, `Trellix Endpoint Security Cloud Collector`, `Anomali Cloud Collector`, `AWS GuardDuty Cloud Collector`, `AWS Security Lake Cloud Collector`, `Tenable Cloud Collector`, and `Zoom Cloud Collector` to facilitate ingestion of security events from their respective sources. • Adds 16 new or updated correlation rule templates including 'UBA: Large number of denied access events towards external domain', 'UBA: Account or Group or Privileges Modified', 'Server-side request forgery', and 'Volume Shadow Copy Created' to identify insider threats and reconnaissance. • Expands the `Trigger Count` filter on the Anomalies Dashboard with an increased maximum value of 10,000 for more accurate anomaly trigger rate reporting. • Adds eight new pre-built compliance dashboards: CMMC Analyst/Management, HIPAA Analyst/Management, ISO 27001 Analyst/Management, NIST 800-53 Analyst/Management, NIST 800-171 Analyst/Management, NIST CSF Analyst/Management, and PCI DSS Analyst/Management. • Adds `Send Now` and `Delete` bulk actions to the Scheduled Reports tab to send multiple reports immediately or remove them without waiting for configured delivery times. • Expands access to create custom enrichment rules in the Log Stream application to all New-Scale license holders (SIEM, Fusion, Analytics) and introduces a new operator for context keys and on-the-fly custom field creation. • Adds support for custom user roles in Multi-Org Management to configure permissions tailored to specific needs for parent or child organizations. • Introduces Exabeam Nova Analyst Assistant, an AI assistant that interprets MITRE ATT&CK Coverage Summary or Use Case Coverage Summary to generate natural language responses about security posture. • Expands access to the Timeline view of search results to all license types and adds a configurable server-side sort order selector in the Search bar for chronological ordering. • Adds notifications on the Long-Term Consumption Details page when users reach 100% or exceed their long-term search quota based on license terms. • Adds new Public API endpoints for License Consumption to read current license level, historical usage data, and details for each license type (SIEM, NSA/AA, Long-term Search, Long-term Storage, API). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/may-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/may-2025.html Thu, 01 May 2025 00:00:00 GMT Exabeam May 2025 adds CrowdStrike and STIX/TAXII Cloud Collectors, custom enrichment rules in Log Stream, and alert management features. • Adds `CrowdStrike Context Devices Cloud Collector` to ingest device data without the Exabeam Ingester for CrowdStrike license add-on • Adds `STIX/TAXII Cloud Collector` to collect threat intelligence about IP addresses or domains and auto-generate a context table in Context Management • Adds `Recorded Future Context Cloud Collector` to collect STIX/TAXII threat intelligence and auto-generate a Recorded Future context table • Enables creating, editing, and duplicating custom enrichment rules directly in the `Enrichments` tab of Log Stream for those with a New-Scale Analytics license or Early Access program • Adds AI-generated MITRE ATT&CK coverage summary in Outcomes Navigator identifying top three techniques with increased/decreased scores and recommendations • Adds `watchlists` feature to monitor and rank entities by risk score over time, including five pre-built lists and custom creation based on entity tags • Adds entity tags from Attack Surface Insights to Threat Center cases or alerts to enable searching for specific kinds of entities • Enables dismissing individual or multiple alerts with reason, user, and timestamp recorded in the `Overview` tab and `alert history` • Allows marking alerts as read/unread, tracking status in the `STATUS` column, and reverting dismissed alerts to unread when risk scores increase by a specified percentage (default 10%) • Adds `Hide Dismissed` toggle in the Alerts tab to filter out dismissed alerts from the list Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/april-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/april-2025.html Tue, 01 Apr 2025 00:00:00 GMT New cloud collectors for Cloudflare, Google Workspace, LastPass, ServiceNow, Vectra; API endpoints for access control and service health; expanded IOC search via ioc_sources • Adds support for five new Cloud Collectors: Cloudflare, Google Workspace, LastPass, ServiceNow, and Vectra. • Introduces regex filtering capability for CrowdStrike Falcon (via FDR), AWS S3, AWS CloudTrail (via S3), SentinelOne CloudFunnel, Cisco Umbrella, and Azure Event Hub Cloud Collectors. • Adds an `ioc_sources` attribute to enriched IOC fields in Context Management and Search to identify the log source of a suspected IOC record. • Enables context table searching on non-key columns using `IN "table name"."column name"` syntax in Advanced search mode. • Provides three new Access Control API endpoints to programmatically retrieve lists of users, roles, and API keys. • Adds an Exabeam Public API endpoint under Service Health Consumption to retrieve license information for Long Term Search, Long Term Storage, and Correlation Rules using OAuth 2.0 client credentials. • Updates the default Search UI in Attack Surface Insights to provide a blank slate by removing the default search query for user and device entities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/march-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/march-2025.html Sat, 01 Mar 2025 00:00:00 GMT Exabeam March 2025 adds Mimecast/Sophos/STIX-TAXII collectors, Exabeam Nova AI, and Threat Center sorting/filtering. • Adds Mimecast Cloud Collector with support for Archive Search Logs, TTP Attachment Protection Logs, TTP Impersonation Protect Logs, TTP URL Logs, SIEM Logs, Archive Message View Logs, and Audit Events • Adds REST API Cloud Collector to facilitate data collection from REST API endpoints • Adds Sophos Cloud Collector for alerts and events data sources • Adds Event Exploration on Search via Cloud Collectors with an 'Open in Search' option to view prepopulated queries • Adds Cloudflare, Google Workspace, LastPass, Vectra, STIX/TAXII, and Recorded Future Context Cloud Collectors in Early Access • Adds STIX/TAXII Context Tables in Context Management for processing threat intelligence data • Adds a Scheduled Reports tab in the Dashboards application with Run Now, Edit, Duplicate, and Delete controls • Adds ability to add descriptive child names in the Multi-Org Console • Introduces Exabeam Nova, an agentic AI tool for automating investigative tasks • Adds Coverage Summaries with Use Case Coverage Score and MITRE ATT&CK Coverage Scores in Outcomes Navigator • Extends Data Insights availability to users with any Exabeam Security Operations licenses • Enhances Entity Search with support for full name or any username/email address and new tooltips • Adds Windows Server 2025 and Windows Server 2025 Core support for Agent Collectors • Enhances Threat Center with Exabeam Nova Analyst Assistant using the 50 most recently grouped detections • Adds Created, Queue, and Assignee columns to Threat Center cases • Adds sorting by Grouped By, Stage, Queue, and Assignee in Threat Center • Adds filtering capabilities for cases (priority, grouped by value, stage, queue, assignee) and alerts (priority, grouped by value) • Increases Notes character limit to 4,000 in Threat Center • Shows full name of the rule type in the Threat Timeline Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/february-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/february-2025.html Sat, 01 Feb 2025 00:00:00 GMT New UK region support, Cisco Meraki/Sophos/Mimecast/REST/Kafka collectors, correlation rule statuses/descriptions, NL visualization, device context search, license PDF export • `Cisco Meraki Cloud Collector` available in Early Access for data collection from Cisco Meraki APIs • `Mimecast Cloud Collector` available in Early Access for Archive Search Logs, TTP Attachment Protection Logs, TTP Impersonation Protect Logs, TTP URL Logs, SIEM Logs, Archive Message View Logs, and Audit Events • `Sophos Cloud Collector` available in Early Access for alerts and events data sources • `REST API Cloud Collector` available in Early Access for data collection from REST API endpoints • `Kafka Collector` added to Site Collectors 2.6 for collecting logs in any text format from Kafka servers • `Archive Windows Collector` added to Site Collectors 2.6 for *.gz, *.tar, *.tar.gz, *.gzip, *.rar, *.7z log files • `Archive Linux Collector` added to Site Collectors 2.6 for *.7z, *.arj, *.bzip2, *.cab, *.gzip, *.iso, *.lzh, *.rar, *.gz, *.tar, *.tar.gz, *.z, and *.zip log files • Correlation rules now support `Stopped` status (auto-disabled if triggered >50 times in 5 minutes) and `Testing` status (outcomes suppressed) • Correlation rules now support a user-defined `description` field visible in list and details views, auto-reused from templates • Threat Center Alert visualizations can be auto-created using natural language prompts via Exabeam Nova • Basic and Advanced Search now supports querying `device context tables` for Active Directory, CrowdStrike, and Microsoft Entra ID • `License View` dashboard adds option to export details as a PDF file • Analytics rules changes can now be applied using the `Apply Changes Without Training` option in bulk operations • All Threat Center cases are automatically assigned a unique numeric `case ID` for human-readable reference and search Breaking changes: • Search API `limit` parameter no longer accepts `-1`; it must be a positive integer (default 3,000) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/january-2025.html https://docs.exabeam.com/en/new-scale-soc-platform/all/release-notes/2025-release-notes/january-2025.html Wed, 01 Jan 2025 00:00:00 GMT New-Scale platform introduces Attack Surface Insights directory, Threat Detection Management hub, advanced playbooks with actions/loops, and Site Collector multi-template sup • Adds `Attack Surface Insights` as a new directory for organizational resources (entities) linked by contextual data. • Adds `Threat Detection Management` as a centralized interface for creating, testing, and tuning correlation and analytics detection rules. • Introduces `advanced playbooks` in Automation Management that support `actions`, `branches`, `loops`, manual execution, draft deployment, and run history viewing. • Enables creation of `No Trigger Playbooks` that can only be manually run on specific cases or alerts without automatic triggers. • Adds deep integration of Automation Management into `Threat Center`, including the `Automation` tab in case/alert `Overview` showing recent playbooks/actions and full history. • Introduces `Box Cloud Collector` for ingesting user and enterprise events from Box. • Adds `Cisco Meraki Cloud Collector` (Early Access) for security events, alerts, and config changes via Cisco Meraki APIs. • Adds `Recorded Future Cloud Collector` for ingesting API Alerts. • Introduces `ServiceNow Cloud Collector` (Early Access) ingesting data from Incident, Task, Change Request, Syslog Transaction, and other source types. • Updates Context Management to support `Custom`, `Active Directory`, `CrowdStrike`, and `Microsoft Entra ID` context tables for device data. • Adds `New-Scale Analytics` pre-built context tables in Context Management for supporting the New-Scale Analytics engine and Attack Surface Insights. • Adds `Show Results in Search` option to dashboard visualizations for rule-triggered events, enabling pivoting to Search. • Renames all dashboards activity types from `report` to `dashboard` in audit logs and adds specific event types: `dashboard-create`, `dashboard-delete`, `dashboard-download`, `dashboard-export`, `dashboard-import`, `dashboard-modify`, `dashboard-publish`, `folder-create`, `folder-delete`, `folder-modify`, `scheduled_task-create`, `scheduled_task-delete`, `scheduled_task-modify`. • Adds `Dependencies` column to Log Stream Parsers Overview tab to show parser completeness and quality. • Introduces `Enrichments` tab in Log Stream for viewing, managing, enabling/disabling, editing, exporting, and importing enrichment rules. • Adds `Event Filtering` tab in Log Stream to filter events routed to New-Scale Analytics detection engine or Attack Surface Insights application. • Allows device context tables (`Active Directory`, `CrowdStrike`, `Microsoft Entra ID`) in both Basic and Advanced search queries. • Introduces `Relative` time range option for Search queries allowing custom start/end relative dates. • Adds guardrails/warnings for pipe operator misuse in Advanced Search mode suggesting `AND` or `WHERE` alternatives. • Introduces `Timeline view` for Search results to visualize investigation timelines of detection events. • Adds `Rule Details` panel in Search showing raw logs, parsed fields, and associated rules for detection events. • Adds `Insights` tab in Event Details panel for visualizing surrounding context (assets, countries, files) for user/device events. • Adds `Entities` tab to Basic Search pre-built lists for searching user/entity accounts with enriched data. • Adds multi-template support for Windows File Collector and Linux File Collector allowing different log conditions per template. • Adds configurable `Splunk fetch interval` options in the Splunk collector. • Adds support package generation command via PowerShell for Windows Event Log, File, and Archive Collectors. • Adds support for Ubuntu 24.04 operating system for Site Collector installation. • Adds SSL connection option with custom security certificates to Kafka Collector (Early Access). • Enables investigation of triggered analytics rules as `detections` in Threat Center for New-Scale portfolio license holders. • Updates `risk score` calculation in Threat Center to use behavioral analytics rarity scores and confidence factors. • Adds ability to manually create cases from scratch without an associated alert in Threat Center. • Enables AI-generated case names (`Copilot Case Names`) for cases converted from alerts in Threat Center. • Enhances entity display in Threat Center showing full name/email for users and hostname for devices. • Allows viewing device entity details from Attack Surface Insights directly within Threat Center. • Adds `User Entity Search` capability via Entities tab to find cases/alerts grouped by specific user entities. • Adds new `SCOPE` column in Threat Center listing counts of Rules, Users, Endpoints, MITRE ATT&CK tactics/techniques, and Use Cases. • Enhances investigation timeline navigation to automatically filter Search events by assigned risk score. Breaking changes: • Correlation rules in test mode no longer create Threat Center `cases` or `alerts`; events now have `activity type` `rule-trigger-test`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/exabeam