- Connector Migration Overview
- Cloud Collectors Overview
- Navigate the Cloud Collectors UI
- Which Collector to Use?
- Hybrid Deployment Experience
- Supported Regions for Cloud Collectors
- Access the Cloud Collectors Service
- Set up a New Cloud Connectors Instance
- New Cloud Collectors
- Apache Kafka Cloud Collector
- Armis Cloud Collector
- Armis Context Collector
- AWS Eventbridge Cloud Collector
- AWS Inspector Cloud Collector
- AWS Redshift Cloud Collector
- AWS Shield Cloud Collector
- Claude Enterprise Cloud Collector
- Egnyte Cloud Collector
- Cybereason Cloud Collector
- Google Alert Center Cloud Collector
- Google Workspace Context Cloud Collector
- OneLogin Cloud Collector
- Palo Alto Networks SaaS Security Cloud Collector
- Rest API Context Cloud Collector
- Symantec CloudSOC Cloud Collector
- Symantec Cloud Secure Web Gateway Cloud Collector
- Symantec Email Security Cloud Collector
- Troubleshooting Cloud Collectors
Prerequisites to Configure the Apache Kafka Cloud Collector
Before you configure the Apache Kafka cloud collector, complete the following prerequisites.
Complete the network on connectivity requirements.
Allow inbound TCP connections from the Exabeam egress IP addresses for your region to every broker's advertised address, on your SASL_SSL port (for example, 9094). Refer to the Allow Exabeam IP Addresses for your Region section to identify the IP range.
Note the Broker address and port. The bootstrap server is the host name. The port is the port of the Kafka listener that uses SASL_SSL with SCRAM-SHA-512. The format is host:port. For more than one broker, use a comma-separated list, such as kafka1.example.com:9094, kafka2.example.com:9094.
If you use hostname, resolve in public DNS, so that Exabeam's cloud can resolve it.
Obtain the CA Certificate in PEM format. The Cloud Collector supports TLS which uses PEM files only. The collector verifies it is talking to the correct Kafka brokers using certificate authority (CA) that signed the broker's certificate. While configuring the cloud collector, in the Certificate field, paste the certificate of the certificate authority (CA) that signed your broker certificates, in PEM format.
Create a dedicated SCRAM-SHA-512 user for Exabeam, with read-only access. If your cluster uses authorization (if an authorizer.class.name is set), grant the user the following permissions:
Permissions for the Kafka topic – Allow Read and Describe on your specific topic, by matching its exact name (using a literal Access Control List—ACL). This lets the collector look up the topic and read its messages.
Permissions for the Kafka consumer group: Allow Read permission on all Kafka consumer groups starting with exabeam-cc- (a prefixed ACL). This enables the cloud collector to join its specific group and save its read position. Each cloud collector uses its own group, named exabeam-cc-<collector-id>. By using a single prefixed ACL covers this cloud collector and any collector that you add later.