Skip to main content

CollectorsCloud Collectors Administration Guide

Configure the DataBahn Cloud Collector

Configuring the DataBahn Cloud Collector involves the following two procedures.

Configure the DataBahn Cloud Collector on New-Scale Security Operations Platform

Set up the DataBahn Cloud Collector to continuously ingest events from DataBahn sources.

  1. Log in to the New-Scale Security Operations Platform with your registered credentials as an administrator.

  2. Navigate to Collectors > Cloud Collectors.

  3. Click New Collector.

  4. Click DataBahn.

  5. Specify a name for the Cloud Collector instance.

    DataBahn_1.png

  6. (Optional) SITE – Select an existing site or to create a new site with a unique ID, click manage your sites. Adding a site name helps you to ensure efficient management of environments with overlapping IP addresses.

    By entering a site name, you associate the logs with a specific independent site. A sitename metadata field is automatically added to all the events that are going to be ingested via this collector. For more information about Site Management, see Define a Unique Site Name.

  7. (Optional) TIMEZONE – Select a time zone applicable to you for accurate detections and event monitoring.

    By entering a time zone, you override the default log time zone. A timezone metadata field is automatically added to all events ingested through this collector.

    Timezone_sitename_site_management_1.png

  8. Click Install.

    DataBahn2.png

    A confirmation message informs you that the new Cloud Collector is created and displays an automatically generated connection string. Click the copy icon to record and use the connection string in DataBahn configuration.

Configure Exabeam Cloud Destination in DataBahn

The Exabeam Cloud destination provides a streamlined method for sending security event data from DataBahn to Exabeam's New-Scale Security Operations Platform.

Use the following steps to configure the Exabeam cloud destination in DataBahn.

  1. Log in to the DataBahn application using your registered credentials.

  2. Navigate to the Destinations section.

  3. Click New Destination.

  4. Enter the following information to add destination.

    • Name – Specify a name for the destination. For example, exabeam-cloud-collector.

    • Description – Enter details to identify the purpose of the destination.

    • Scope – Select CLOUD.

    • Data Plane – Select the configured data plane. For example, prod-dp02.

    • Forward Data Type – Select the forward data type based on your requirements.

      • DataBahn Parsed Object – Select this data type to send normalized data to Exabeam.

      • Raw Event from Source – Select this data type to send raw data in its original format.

    • Destination Type – Select Exabeam cloud destination.

    • Collector Name – Specify the name of the DataBahn Cloud Collector configured on New-Scale Security Operations Platform.

    • Connection String – Paste the connection string that you obtained while configuring the DataBahn cloud collector on New-Scale Security Operations Platform.

      After you paste the connection string, DataBahn automatically extracts and displays the following information for verification for the following fields that are not editable.

      • Collector ID – Displays the unique identifier for the collector instance.

      • Site Name – Displays the site name associated with the collector if it is configured.

      • Site ID – Displays the unique identifier for the site.

      • Time Offset – Displays the timezone offset configured for the collector.

      • GCS Bucket Name – Displays the Google Cloud Storage bucket used by Exabeam for data ingestion.

  5. To save the configuration details, click Add Destination.

    A cloud destination is added to establish a robust data pipeline for advanced security analytics and threat detection.

    Note

    For additional support or advanced configuration options, refer to the official Databahn documentation or contact Databahn support.

Troubleshoot Common Errors

If you encounter any of the following issues while configuring or using the Exabeam Cloud destination, consider the following troubleshooting steps.

Issue

Resolution

Connection Failed

Ensure that you copied the correct connection string from Exabeam New-Scale Security Operations Platform and pasted that in DataBahn without any extra characters.

Authentication Error

Ensure the DataBahn Cloud Collector is properly configured in Exabeam and the connection string is valid.

Data Not Appearing

Check that the site and timezone settings in Exabeam New-Scale Security Operations Platform match your data source requirements.

Network Connectivity

Verify network connectivity between DataBahn and Exabeam Cloud services.

Invalid Connection String

Regenerate the connection string from Exabeam Cloud Collector configuration on New-Scale Security Operations Platform.

Collector Not Found

Verify that the DataBahn Cloud Collector is correctly installed and active in Exabeam New-Scale Security Operations Platform.

Timeout Issues

Check the firewall rules and network connectivity between DataBahn and Exabeam.

Best Practices

Refer to the following best practices for optimal security and performance.

  • Security

    • Store the connection strings securely and rotate them regularly.

    • Use appropriate network security measures between DataBahn and Exabeam.

  • Data Management

    • Configure appropriate site names for better organization of events.

    • Set correct timezone for accurate event correlation.

  • Performance

    • Monitor data ingestion rates and adjust as needed.

    • Use DataBahn Parsed Object format when possible, for better performance.

  • Monitoring

    • Check the status of the DataBahn Cloud Collector in Exabeam regularly.

    • Monitor data flow and set up alerts for any interruptions.