Skip to main content

CollectorsCloud Collectors Administration Guide

Table of Contents

Microsoft Entra ID Context Cloud Collector

The Microsoft Entra ID Context Cloud Collector enables ingestion of user context data into the Exabeam Security Operations Platform. The collector fetches user context data from the Microsoft Entra ID service. The collected context data can then be processed by the Exabeam Context Manager service and the processed data is made available for use in downstream Exabeam New-Scale applications.

If you previously used Microsoft Entra ID context enrichment in Advanced Analytics or Data Lake, migrating to the New-Scale Cloud Collectors service can provide some significant advantages:

  • No dependence on Active Directory – The New-Scale Cloud Collectors service is cloud-native, so Microsoft Entra ID context data can be collected without the need for an Active Directory deployment.

  • Expanded list of attributes – Microsoft Entra ID enrichment in Advanced Analytics or Data Lake is limited to only seven user attributes. In contrast, the collector in the New-Scale Cloud Collector service fetches a much larger set of the available user attributes. A default set of these attributes is mapped to the Exabeam common user information model which defines a standardized user object for security content across Exabeam products. For a list of the default attributes and their mapping, see "Default Microsoft Entra ID Attribute Mapping" in the Microsoft Entra ID Tables in Context Management guide.

  • Support for multiple domains – The New-Scale Cloud Collectors service can support context data collection from multiple Microsoft Entra ID domains through the configuration of multiple collector instances.

  • No additional license requirements – The Cloud Collectors service is included with your existing license.

Note

Microsoft Entra ID context data collected via the New-Scale Cloud Collectors service cannot be leveraged in your Advanced Analytics or Data Lake applications. However, you can continue to use the existing Microsoft Entra ID context enrichment currently available in those applications.

For information about onboarding the Microsoft Entra ID Context Cloud Collector, follow the links below: