- Introduction to Context Management
- Onboarding a Context Table
- Custom Context Tables
- Create a Custom Context Table by Importing a CSV File
- Create a Custom Context Table Using the Add Custom Option
- Working with Filtered Context Tables
- View and Interact with a Custom or Filtered Context Table
- View the Details Panel for a Custom or Filtered Context Table
- Edit the Configuration of Custom or Filtered Context Tables
- Active Directory Context Tables
- Prerequisites to Onboard an Active Directory Context Table
- Create an Active Directory Context Table
- View and Interact with an Active Directory Context Table
- View the Details Panel for an Active Directory Context Table
- Edit the Configuration of an Active Directory Context Table
- Default User Attribute Mapping for Active Directory
- Default Device Attribute Mapping for Active Directory
- CrowdStrike Context Tables
- Microsoft Entra ID Context Tables
- Prerequisites to Onboard a Microsoft Entra ID Context Table
- Create a Microsoft Entra ID Context Table
- View and Interact with a Microsoft Entra ID Context Table
- View the Details Panel for a Microsoft Entra ID Context Table
- Edit the Configuration of a Microsoft Entra ID Context Table
- Default User Attribute Mapping for Microsoft Entra ID
- Default Device Attribute Mapping for Microsoft Entra ID
- Okta Context Tables
- Custom Context Tables
- Add Data to an Existing Context Table
- Using Context Data in Downstream Applications
- Pre-Built Context Tables
- Context Management APIs
- Troubleshooting Context Management
Context Management APIs
Certain aspects of context tables can be managed programmatically through Exabeam Open APIs. The table below lists the current actions that can be managed via APIs.
To access context API endpoints, you must have an API key with Manage Context permissions. For information about creating API keys, see Create an API Key in the API Get Started Guide. For a demonstration of how to use the context APIs, see the video in Sample Context API Workflow.
The following table lists the context APIs that are available. For specific information about API request and response parameters, see the Exabeam API Reference Guide and use the left navigation panel to find the Context Management endpoints.
Note
Per announcement in August, the Context Management APIs have changed. The endpoint names were updated and moved to a new base URL: context-management/v1. As of October, endpoints at the old base URL, context-collectors/v1, are now deprecated.
Endpoint | Summary | Description | Response |
|---|---|---|---|
GET /context-management/v1/tables | Get metadata for all existing tables | Retrieve metadata for all existing context tables, including source, operational status, and attribute mapping. | Returns a list of metadata for each existing context table. |
GET /context-management/v1/tables/{id} | Get metadata for a single context table | Retrieve metadata for a specific context table, including source, operational status, and attribute mapping. | Returns the metadata for the specified context table. |
POST /context-management/v1/tables/{tableId}/addRecordsFromCsv | Add context records to an existing table from a CSV file | Add context data records to an existing table using a CSV file. The CSV file must contain a header row with column names for the attributes you want to map. File size can be a maximum of 300 MB or 500,000 records. If the CSV file exceeds these limits, compress it as a ZIP file. A compressed ZIP file must contain only one CSV file. Use the value of the | Returns information about the number of records uploaded, the number of duplicates, and the number of malformed records. The response also includes a tracker ID that can be used to poll the status of the add records job. See the Track ingestion progress API. |
POST /context-management/v1/tables/{id}/addRecords | Add context records to an existing table | Add one or more context data records directly to an existing table by including them in the request body. Use the value of the | Returns information about the number of records uploaded, the number of duplicates, and the number of malformed records. The response also includes a tracker ID that can be used to poll the status of the add records job. See the Track ingestion progress API. |
GET /context-management/v1/tables/uploadStatus/{trackerId} | Track ingestion progress | Use the tracker ID from one of the Post APIs to poll the status of an add records job. | Returns the status of the specified upload job. Status values include: |
POST /context-management/v1/tables | Create a context table with metadata | Create a new context table and provide the necessary data source and attribute mapping. | Returns the metadata and a URL for the newly-created context table. |
GET /context-management/v1/attributes/{contextName} | Get the available attributes for a specific table type | Retrieve all of the available attributes for a specific type of context table. | Returns the available attributes for the specified table type. |
GET /context-management/v1/tables/{sourceName}/records | Get table records by ID | Retrieve the records for a specific context table. | Returns the records in the specified context table. |
DELETE /context-management/v1//tables/{id} | Delete a specific context table | Delete a specific context table, including records and attributes. Use the optional | Returns a success or failure code. |
Sample Context API Workflow
The video below walks through the steps for creating an API key and using it to retrieve an access token for Exabeam open APIs. It then demonstrates how to use the Context API endpoints to populate a custom context table with data from a CSV file.