What’s New in Exabeam Product Development — July 2023

Welcome back to the blog! According to leading NASA climatologist, Gavin Schmidt, the month of July witnessed Earth’s hottest temperatures in “hundreds if not thousands of years!” This unprecedented heat seems to have propelled our dedicated product development team indoors, resulting in an extensive array of features and enhancements to the Exabeam Security Operations Platform.

Let’s dive into the highlights of this July’s Exabeam feature release.

In this article:

• Site Collectors: enhancements
• Cloud Collectors: introducing audit logs
• Context Collectors: APIs and expanded audit logs
• Log Stream: improved Event Builder and error messages
• Search: increased power and log retention enforcement#search
• Dashboards: Nine new prepackaged dashboards and CDIR notation
• Correlation Rules: chains and templates
• Alert and Case Management: threat timelines
• Conclusion

Site Collectors: enhancements

Windows Event Collector (WEC), one of the most common data sources, is now supported with Site Collector. This release allows the collection of logs natively from Windows servers. Users can also perform WEC upgrades over the Exabeam management UI, and manage WEC templates.

Furthermore, Site Collector installation enhancements, port pre-checks, and detailed error messages provide a smoother setup and troubleshooting process. Clear and concise error messages assist users in identifying and resolving issues promptly.

Read the Site Collectors release notes.

Cloud Collectors: introducing audit logs

Exabeam has incorporated audit logs for Cloud Collectors, allowing the tracking of configuration changes. This enhancement empowers users to monitor every aspect of their cloud environment, ensuring heightened security and compliance, including FedRAMP, HIPAA, PCI-DSS, and NERC.

Read the Cloud Collectors release notes.

Context Collectors: APIs and expanded audit logs

Context Collectors now offer the ability to create and read context tables programmatically using APIs. These new API enhancements enable customers to automate user onboarding, validation, and health checks.

Besides this, audit logs now report on configuration changes to Create, Modify, Disable in our new cloud platform, simplifying compliance reporting and requirements.

Read the Context Collectors release notes.

Log Stream: improved Event Builder and error messages

To provide users with more control over Event Builder rules in Log Stream, Exabeam introduces the option to specify multiple parser conditions, allowing for precise data stream filtering.

In addition, the platform offers improved parser error messages, equipping users with essential information, including root cause and next steps for troubleshooting. This feature update facilitates troubleshooting without the need for prior support engagement.

Read the Log Stream release notes.

Search: increased power and log retention enforcement

The Search feature receives a significant boost, providing users with suggestions for subjects, products, and vendors when building advanced queries. This enhancement offers a guided approach to searching and refining results.

Add to this the ability to use any date time field to build advanced queries, while new syntax operators enable searches for exact matches, significantly narrowing down search results.

Read the Search release notes.

Dashboards: Nine new prepackaged dashboards and CDIR notation

Dashboard enthusiasts can now enjoy the freedom to create visualizations with custom fields, fostering even more insightful analysis.

Also, filtering IP addresses with CDIR notation adds a level of sophistication to network security measures, granting users a powerful tool to safeguard their networks.

Read the Dashboards release notes.

Correlation Rules: chains and templates

In Correlation Rules, Exabeam introduces a sequence of conditions as a trigger, allowing for the seamless cascading of events, akin to setting up a series of dominoes.

What’s more, the platform offers 10 new templates, streamlining the creation of correlation rules and simplifying the process for users.

Read the Correlation Rules release notes.

Alert and Case Management: threat timelines

Exabeam unveils a completely overhauled Alert and Case Management experience, offering users the ability to view timelines of an alert or case. Threat timelines provide a view into the detections from correlation rule triggers and their related events. This enhancement creates a comprehensive and insightful investigative environment.

Moreover, performance improvements cater to large datasets, making searches and dashboard creation more efficient and reliable.

Read the Alert and Case Management release notes.

Conclusion

The Exabeam July feature release is coming in hot with a bunch of exciting new features. Be sure to join us next month for yet another impressive list of new features that promise to add more value for our customers.

Stay cool out there, everyone!

To learn more about all these updates, visit the Exabeam Community to read documentation, and sign up for webinars to keep track of all the latest announcements.