Skip to main content

Incident ResponderIncident Responder Documentation

Version: i56

Exabeam Actions Service

Get started using basic actions with the Exabeam Actions service.

Exabeam Actions is an in-house service that is free to use and available out-of-the-box. With the Exabeam Actions service, you can start using actions or playbooks, like turnkey playbooks, without purchasing additional services from third parties.Turnkey Playbooks

The service supports basic actions, including:

  • Detonate File in Sandbox

  • Detonate URL in Sandbox

  • Get Domain Reputation

  • Get URL Reputation

  • Get Email Reputation

  • Get IP Reputation

  • Get File Reputation

To assess the reputation of an entity, Exabeam Actions searches across various sources, like threat feeds and IP reputation lists, for evidence that the entity may be risky. Then, it compares the evidence against a set of conditions. Depending on which conditions the evidence matches, Exabeam Actions assigns the entity a severity level between 0 and 99. If the entity has a severity level of 50 and above, Exabeam Actions considers the entity to have a malicious reputation.