- Introduction to Context Management
- Onboarding a Context Table
- Custom Context Tables
- Create a Custom Context Table by Importing a CSV File
- Create a Custom Context Table Using the Add Custom Option
- Working with Filtered Context Tables
- View and Interact with a Custom or Filtered Context Table
- View the Details Panel for a Custom or Filtered Context Table
- Edit the Configuration of Custom or Filtered Context Tables
- Active Directory Context Tables
- Prerequisites to Onboard an Active Directory Context Table
- Create an Active Directory Context Table
- View and Interact with an Active Directory Context Table
- View the Details Panel for an Active Directory Context Table
- Edit the Configuration of an Active Directory Context Table
- Default Active Directory Attribute Mapping
- Microsoft Entra ID Context Tables
- Prerequisites to Onboard a Microsoft Entra ID Context Table
- Create a Microsoft Entra ID Context Table
- View and Interact with a Microsoft Entra ID Context Table
- View the Details Panel for a Microsoft Entra ID Context Table
- Edit the Configuration of a Microsoft Entra ID Context Table
- Default Microsoft Entra ID Attribute Mapping
- Okta Context Tables
- Custom Context Tables
- Add Data to an Existing Context Table
- Using Context Data in Downstream Applications
- Built-In Threat Intelligence Context Tables
- Context Management APIs
- Troubleshooting Context Management
Create a Custom Context Table Using the Add Custom Option
The Add Custom option, provides greater flexibility for creating and configuring new custom context tables. When using this option, available on the Context Library tab, creating a custom table and uploading data are separate procedures so that you can create the table without uploading data immediately. Custom tables can contain up to a maximum of 500,000 records.
You can also use the Add Custom option to create a user-based context table that is connected to other context tables with a filtered set of user attributes. This functionality is useful when you want to display user information from multiple context tables and filter the display by a specific set of conditions. For more information about filtered context tables, see Working with Filtered Context Tables.
If you prefer a more streamlined approach to creating custom context tables, and plan to upload data from a CSV file, use the Import CSV option on the Context Library tab instead.
To create a custom table using the Add Custom option:
Log into the Exabeam Security Operations Platform with your registered credentials.
Find the Security Management tab and click the Context Management tile.
Navigate to the Context Library tab and click Add Custom. The Custom Context Table panel opens.
In the Configuration section, complete the Definition step by entering the following information:
Context Table Name – A name for the new custom context table you're creating.
Context Type – Select the type of context data the new table will contain. Options include Other and User. If you select User, additional options are displayed that allow you to connect the new context table to existing context tables with a filtered set of attributes.
Create Connection? – This option is displayed if you select User for the Context Type. Click Yes, Create Connection to display the Source Context Table dropdown field. Select one or more existing context tables from the list to serve as sources for data in the new custom context table.
Click Next.
In the Attributes tab, click Add Attributes. The Add Columns/Attributes dialog box opens.
To add attributes as columns in the custom context table, do one of the following:
Select an existing attribute – In the Available Attributes panel on the left, locate an attribute that already exists in the system. Click the plus icon (
) on the attribute, or click and drag, to add it to the Columns panel on the right.The available attributes are arranged in two categories:
Commonly Used – Attributes that are most frequently used. This category is listed first for convenience.
Others – Attributes that are either less frequently used or are custom attributes that already exist in your environment.
You can click the drop down arrow on many of the available attributes to view both a short description of the attribute and an example value. You can also use the Search field if necessary to find a specific attribute.
Note
You cannot include the following attributes in a custom context table: Thumbnail Photo, User Account Control.
Add a new attribute – In the Columns panel on the right, click Add Custom Attribute. Enter a new column name and click the plus icon (
), or click and drag, to add the new column to the list.
Repeat this step until all of the necessary attributes are listed in the Columns panel.
Click the key icon (
) next to one of the columns to designate it as the key attribute for the context table. Only a single attribute can be designated as the key.When you're satisfied with the attributes, click Apply. The Add Columns/Attributes dialog box closes.
Review the custom context table configuration and do one of the following:
If you are creating a User context table, and you opted in Step 4 to create connections with existing context tables, click Next and continue with Step 11 where you will define conditions.
If you are not creating a context table with connections to existing context tables, skip to Step 12.
In the Conditions step, define the filter conditions you want to use to filter the data that will be displayed from the source context tables. You can add conditions in one group or in multiple groups, depending on the complexity required. For information about defining filter conditions, follow the steps in Working with Filtered Context Tables.
Click Create. The new context table is created but does not yet contain any data. In the Context Management Overview tab, custom context tables are displayed with the following icon:
. However, if you created a custom context table that filters data from existing context tables, it displays with the following icon:
.If you want to add data to the custom context table, follow the procedure at one of the links below:
Upload CSV – Import data via a CSV file that you have prepared with the necessary columns.
Add Data Manually – Manually add data one data entity at a time.