Skip to main content

Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

Webhook Cloud Connector

Prerequisites to Configure the Webhook Cloud Connector

If you use a vendor and product that supports pushing alerts or logs into a webhook or an HTTP API endpoint, you can use the Webhook Cloud Connector to ingest application events.

Note

The Webhook Cloud Connector was a part of the Early Access program that is no longer available now. If you are using the early access Webhook Cloud Connector, consider migrating to the new Webhook Cloud Collector. Before you migrate, check if your early access deployment is eligible for migration. Not all early access deployments can be migrated. Continue using your existing early access version if you cannot migrate to the latest version. For more information see Migrate to the Generic Webhook Cloud Collector.

Consider the following limitations before you configure the Webhook Cloud Connector:

  • Batch requests – Each request is limited to 100 Mb and must complete within 2 minutes. For optimal performance it is advised to batch as many messages as possible within a single HTTP POST request, up to the request limit of 100 Mb.

  • Ingestion volume – Up to 500 Gb in Early Access

  • Preconfigured content – Support for preconfigured content is not guaranteed. Use the Auto Parser Generator to verify the parsing status and to develop new parsers, if needed.

  • Planned changes for GA – The request details such as URL and required headers are subject to change, and may require reconfiguring the settings of the product from which you send logs.

Configure the Webhook Cloud Connector

  1. Download your authentication package using the following URL template based on your instance ID: https://<instanceId>:.aa.exabeam.com/api/setup/saas/authPackage.

  2. Open the info.yml file.

  3. Take note of the base64 field in HTTP Post section:

    -name: HTTP Post
 credentials:
    username: "my-username"
    password: "my-password"
    # base64(Username:password)"
    base64: "base64-username-password"

  4. Make an HTTPS request to https://<instanceId>.data.exabeam.com in one of the supported formats:

    HEC format

    Use this format to ingest a cloud log source that can integrate with Splunk HTTP Event Collector via HEC format. When you configure the cloud product to forward logs, use the following configuration:

    • URL: https://<instanceId>.data.exabeam.com?format=hec

    • Headers: Authorization: Basic {base64}

    • HTTP Request Example:

      curl https://<instanceId>.data.exabeam.com?format=hec -H "Authorization: Basic {base64}” -d 
‘{
  "time": 1437522387,
  "host": "stream-logfwd20-141065047-01261326-z3ho-harness-8gmw",
   "source": "Palo Alto Networks FLS LF",
   "event": {
     "LogType": "THREAT",
      "Severity": "Critical”
    }
 }
 {
   "time": 1437522387,
   "host": "stream-logfwd20-141065047-01261326-z3ho-harness-8gmw",
   "source": "Palo Alto Networks FLS LF",
   "event": {
      "LogType": "THREAT",
      "Severity": "Info"
    }
}’

    Line format

    Use this format to ingest a cloud log source that can forward raw logs delimited by a newline. To forward the logs, use the following configuration:

    • URL: https://<instanceId>.data.exabeam.com

    • Headers:

      • Authorization: Basic {base64}

      • Content-type: application/raw-newline

    • HTTP Request Example:

      curl https://{instanceId}.data.exabeam.com -H "Authorization: Basic {base64}" -H 'Content-type: application/raw-newline' -d 
‘Sep 11 15:53:33 zscaler-nss CEF:0|Zscaler|NSSWeblog|5.0|Allowed|Allowed|3|act=Allowed...‘

    JSON format

    Use this format to ingest a cloud log source that can forward logs in JSON format, containing single or multiple objects. To forward the logs, use the following configuration:

    • URL: https://<instanceId>.data.exabeam.com

    • Headers:

      • Authorization: Basic {base64}

      • Content-type: application/json

    • HTTP Request Example:

      curl https://{instanceId}.data.exabeam.com -H "Authorization: Basic {base64}" -H 'Content-type: application/json' -d 
'[
   {
      "name":"John",
      "age":30
   },
   {
      "name":"Tom",
      "age":13,
      "car":"Bmw"
   }
]'