Skip to main content

Responses are generated using AI and may contain mistakes.

Exabeam SearchExabeam Search Guide

Table of Contents

Threat Intelligence Enrichment

Threat intelligence data is available to the Search application from the Context Management service. Context Management provides different types of threat intelligence context tables:

  • Pre-built context tables include Exabeam-provided, curated threat intelligence data about known malicious domains and IP addresses. For information about these context tables, see Pre-Built-Threat Intelligence Context Tables. The following context tables are included:

    • Exabeam Threat Intelligence Domains — Collects data about known malicious domains.

    • Exabeam Treat Intelligence IPs — Collects data about known malicious IP addresses

  • STIX/TAXII-based context tables are tables that provide external threat intelligence data from any log source that supports the STIX/TAXII framework. For more information about these context tables, see STIX/TAXII Context Tables. Pre-configured formats may be available for some external log sources in the Context Management service.

The Context Management service injects indicators of compromise (IOC) tags into event logs. When added to events, these enriched IOC fields mark the event records as having specific characteristics that may be evidence of a security breach.

As event records are ingested, they are validated against existing threat intelligence data, and are marked with IOC metadata.

You can use the following fields to build queries and reports leveraging enriched IOC information:

  • is_ioc — (boolean) Populated (true), any time an event record matches a parsed field value against a threat intelligence data source.

  • ioc_types — (array of strings) Populated with IOC types, such as IP_trojan, Domain_ransomware, etc.

  • ioc_fields — (array of strings) Populated with the IOC field names whose values matched threat intelligence data, such as src_ip, host, etc.

  • ioc_sources — (array of strings) Populated with the name of the log sources from which data marked as an IOC was ingested.

When using the Basic search mode, you can select the IOC fields from the Common event fields list to include them in a query.