- Introduction to Context Management
- Onboarding a Context Table
- Custom Context Tables
- Create a Custom Context Table by Importing a CSV File
- Create a Custom Context Table Using the Add Custom Option
- Working with Filtered Context Tables
- View and Interact with a Custom or Filtered Context Table
- View the Details Panel for a Custom or Filtered Context Table
- Edit the Configuration of Custom or Filtered Context Tables
- Active Directory Context Tables
- Prerequisites to Onboard an Active Directory Context Table
- Create an Active Directory Context Table
- View and Interact with an Active Directory Context Table
- View the Details Panel for an Active Directory Context Table
- Edit the Configuration of an Active Directory Context Table
- Default User Attribute Mapping for Active Directory
- Default Device Attribute Mapping for Active Directory
- Anomali Context Tables
- Prerequisites to Onboard an Anomali Context Table
- Create an Anomali Context Table
- View and Interact with an Anomali Context Table
- View the Details Panel for an Anomali Context Table
- Edit the Configuration of an Anomali Context Table
- Default IP Attribute Mapping for Anomali
- Default Domain Attribute Mapping for Anomali
- CrowdStrike Context Tables
- Google Workspace Context Tables
- Prerequisites to Onboard a Google Workspace Context Table
- Create a Google Workspace Context Table
- View and Interact with a Google Workspace Context Table
- View the Details Panel for a Google Workspace Context Table
- Edit the Configuration of a Google Workspace Context Table
- Default Google Workspace Attribute Mapping
- Microsoft Entra ID Context Tables
- Prerequisites to Onboard a Microsoft Entra ID Context Table
- Create a Microsoft Entra ID Context Table
- View and Interact with a Microsoft Entra ID Context Table
- View the Details Panel for a Microsoft Entra ID Context Table
- Edit the Configuration of a Microsoft Entra ID Context Table
- Default User Attribute Mapping for Microsoft Entra ID
- Default Device Attribute Mapping for Microsoft Entra ID
- Okta Context Tables
- Recorded Future Context Tables
- Prerequisites to Onboard a Recorded Future Context Table
- Create a Recorded Future Context Table
- View and Interact with a Recorded Future Context Table
- View the Details Panel for a Recorded Future Context Table
- Edit the Configuration of a Recorded Future Context Table
- Default IP Attribute Mapping for Recorded Future
- Default Domain Attribute Mapping for Recorded Future
- REST API Context Tables
- STIX/TAXII Context Tables
- Prerequisites to Onboard a STIX/TAXII Context Table
- Create a STIX/TAXII Context Table
- View and Interact with a STIX/TAXII Context Table
- View the Details Panel for a STIX/TAXII Context Table
- Edit the Configuration of a STIX/TAXII Context Table
- Default IP Attribute Mapping for STIX/TAXII
- Default Domain Attribute Mapping for STIX/TAXII
- Custom Context Tables
- Add Data to an Existing Context Table
- Using Context Data in Downstream Applications
- Pre-Built Context Tables
- Context Management APIs
- Troubleshooting Context Management
- Refresh Rates for Context Tables
Anomali Context Tables
The Anomali option is designed to streamline the process of creating a new context table to onboard threat intelligence data from an Anomali source, including data such as threat detections and indicators of compromise. When an Anomali context table is onboarded, it processes either IP or domain attributes that a corresponding cloud collector has ingested from an Anomali threat intelligence source that supports the STIX/TAXII standard framework.
When the context table is onboarded, it normalizes Anomali context information so that it can be mapped to Exabeam target attributes. This data is used to enrich security content that can be leveraged by downstream services such as Search, Correlation Rules, and Dashboards. By default, Anomali tables map a set of specific IP or domain attributes that are compliant with the Exabeam common information model. This model defines standardized objects for security content across Exabeam products.
The Anomali option is available on the Context Library tab. However, to create an Anomali context table, you must first create an Anomali cloud collector in the Exabeam Cloud Collector service. To further streamline the process, you can opt to have the Anomali context table created automatically from the cloud collector itself. Once the Anomali context table is running in the Context Management service, it can begin processing the data sent from the cloud collector.
Note
Only one Anomali context table can be created for each Anomali cloud collector.
Data in the Anomali context table is refreshed every 24 hours so that your view of threat intelligence data remains up-to-date.
Data in STIX/TAXII-based context tables expires according to the Maximum Age in Days options configured in the corresponding cloud collector. Data expiration avoids maintaining threat indicators for too long. It prevents aging data from becoming inaccurate and resulting in false positives. The following scenarios illustrate how the aging logic operates to remove expired data in a context table:
Scenario 1: A new cloud collector is created with a Maximum Age in Days = 30, and a correspinding cloud collector is auto-generated
In this scenario, the context table is created with data from the past 30 days. Each day a tracking service pulls the delta of new data into the context table and older expired data is removed.
Scenario 2: A new cloud collector is created with a Maximum Age in Days = 0, and a correspinding cloud collector is auto-generated
In this scenario, the context table is created but contains no data initially. Each day a tracking service pulls data into the context table and any previous data is removed. This scenario is useful for clearing out indicators of compromise on a daily basis.
Note
If you update the Maximum Age in Days value for an existing cloud collector, the data contained in the corresponding context table does not change immediately. Changes take place only on the next tracking service data pull.
For more information, see the following sections: