- Introduction to Context Management
- Onboarding a Context Table
- Custom Context Tables
- Create a Custom Context Table by Importing a CSV File
- Create a Custom Context Table Using the Add Custom Option
- Working with Filtered Context Tables
- View and Interact with a Custom or Filtered Context Table
- View the Details Panel for a Custom or Filtered Context Table
- Edit the Configuration of Custom or Filtered Context Tables
- Active Directory Context Tables
- Prerequisites to Onboard an Active Directory Context Table
- Create an Active Directory Context Table
- View and Interact with an Active Directory Context Table
- View the Details Panel for an Active Directory Context Table
- Edit the Configuration of an Active Directory Context Table
- Default User Attribute Mapping for Active Directory
- Default Device Attribute Mapping for Active Directory
- CrowdStrike Context Tables
- Microsoft Entra ID Context Tables
- Prerequisites to Onboard a Microsoft Entra ID Context Table
- Create a Microsoft Entra ID Context Table
- View and Interact with a Microsoft Entra ID Context Table
- View the Details Panel for a Microsoft Entra ID Context Table
- Edit the Configuration of a Microsoft Entra ID Context Table
- Default User Attribute Mapping for Microsoft Entra ID
- Default Device Attribute Mapping for Microsoft Entra ID
- Okta Context Tables
- Custom Context Tables
- Add Data to an Existing Context Table
- Using Context Data in Downstream Applications
- Pre-Built Context Tables
- Context Management APIs
- Troubleshooting Context Management
Microsoft Entra ID Context Tables
The Microsoft Entra ID option is designed to streamline the process of creating a new Microsoft Entra ID context table. When the context table is onboarded, it normalizes Microsoft Entra ID context information so that it can be leveraged by downstream New-Scale Security Operations Platform services such as Search, Correlation Rules, and Dashboards.
By default, Microsoft Entra ID context tables map a set of specific user or device attributes that are compliant with the Exabeam common user information model. This model defines a standardized user or device object for security content across Exabeam products.
The Microsoft Entra ID option is available on the Context Library tab. To create the context table, you must first have a Microsoft Entra ID cloud collector configured and running in the Exabeam Cloud Collectors service. Then you can create the context table in the Context Management service and it can begin processing the data sent from the cloud collector.
For more information, see the following sections:
Note
License Requirement for Device Context Tables
Currently, device context data can only be accessed if you have the New-Scale Analytics license. Access to device data will be available to other licenses in the near future.