Skip to main content

Responses are generated using AI and may contain mistakes.

New-Scale Security Operations PlatformNew-Scale Security Operations Platform Administration Guide

Connect to Exabeam MCP Server

The Model Context Protocol (MCP) is an open standard for AI applications that acts as a bridge between an AI model and external data sources or tools. The main purpose of an MCP server is to make AI models more accurate and useful by providing access to internet-hosted tools and data. This offers real-time information and capabilities that were not part of their original training. Developers can build and host remote MCP servers that communicate with AI tools over the internet.

Exabeam offers a way to connect AI tools to an Exabeam MCP Server. With this connection, you can use your tool of choice to aid in discovering, retrieving, and acting on Exabeam data.

Connection Types

You can connect by either using user-delegated authentication or by application-level API keys. Using user-delegated authentication, you authenticate as yourself using your Exabeam credentials. This means All MCP tool calls, such as case queries and alert lookups, are recorded in the Exabeam Audit Log and attributed to your user account, not a shared application identity. Using API keys means all MCP tool calls are attributed to an application identity rather than the individual user making them.

Most users will want user-delegated due to enhanced compliance requirements and security investigations that require per-user audit trails.

Connect Using User-Delegated Authentication (Recommended)

When you connect an AI client — such as Claude, ChatGPT, or Microsoft Copilot — to Exabeam via the MCP you now authenticate as yourself using your Exabeam credentials. All actions taken through the AI client are performed under your identity, respect your existing role-based permissions, and are attributed to you in the Exabeam Audit Log.

When you connect a supported AI client to the Exabeam MCP server for the first time, you are redirected to an Exabeam login screen to complete a one-time authorization step. After you sign in, the AI client receives a token scoped  to your identity. No API keys or client secrets are required.

Exabeam Region

Exabeam MCP Server URL

OAuth Client ID

US West

https://api.us-west.exabeam.cloud/mcp

a45c8b47-56b1-4b20-82d2-bb16fd548746

US East

https://api.us-east.exabeam.cloud/mcp

Canada

https://api.ca.exabeam.cloud/mcp

Europe

https://api.eu.exabeam.cloud/mcp

Saudi Arabia

https://api.sa.exabeam.cloud/mcp

Singapore

https://api.sg.exabeam.cloud/mcp

Switzerland

https://api.ch.exabeam.cloud/mcp

Japan

https://api.jp.exabeam.cloud/mcp

Australia

https://api.au.exabeam.cloud/mcp

Connection steps will vary depending on the tool. Some examples of connection steps include:

  • Claude

  • Microsoft Copilot (via Copilot Studio, not the end-user Copilot chat interface directly)

  • ChatGPT (only supports custom connectors if your org has developer mode plus custom apps enabled)

An example of setup and connecting to Claude via a Custom Connector is below.

Example Setup: Claude

  1. Go to https://claude.ai and sign in.

  2. Open the left sidebar and select Customize > Connectors.

  3. Click the plus icon and select Add custom connector.

  4. Fill in the fields:

    - Connector name — any name you choose (e.g., Exabeam)   

    - Remote MCP Server URL — the URL for your environment from the table above   

    - OAuth Client ID — the client ID for your environment from the table above    

    - OAuth Secret — leave this blank

  5. Click Add to save.

  6. Select the Exabeam connector you just created and click Connect.

  7. When prompted, enter your Exabeam tenant domain (e.g., yourcompany.exabeam.cloud) and click Continue.

    You will be redirected to your organization's Exabeam login page.

  8. Enter your credentials and complete authentication.

  9. After a successful login, you will be redirected back to Claude.

You are now connected. Exabeam tools are available in your Claude conversations.

Connect Using API Key

To get started, you will need the following pieces of information:

  • API Key

  • API Key Secret

  • Exabeam MCP Server URL (based on region)

    Exabeam Region

    Exabeam MCP Server URL

    Authorization and Token URLs (if required)

    US West

    https://api.us-west.exabeam.cloud/mcp

    Auth URL: https://api.us-west.exabeam.cloud/oauth/authorize

    Token URL: https://api.us-west.exabeam.cloud/oauth/token

    US East

    https://api.us-east.exabeam.cloud/mcp

    Auth URL: https://api.us-east.exabeam.cloud/oauth/authorize

    Token URL: https://api.us-east.exabeam.cloud/oauth/token

    Canada

    https://api.ca.exabeam.cloud/mcp

    Auth URL: https://api.ca.exabeam.cloud/oauth/authorize

    Token URL: https://api.ca.exabeam.cloud/oauth/token

    Europe

    https://api.eu.exabeam.cloud/mcp

    Auth URL: https://api.eu.exabeam.cloud/oauth/authorize

    Token URL: https://api.eu.exabeam.cloud/oauth/token

    Saudi Arabia

    https://api.sa.exabeam.cloud/mcp

    Auth URL: https://api.sa.exabeam.cloud/oauth/authorize

    Token URL: https://api.sa.exabeam.cloud/oauth/token

    Singapore

    https://api.sg.exabeam.cloud/mcp

    Auth URL: https://api.sg.exabeam.cloud/oauth/authorize

    Token URL: https://api.sg.exabeam.cloud/oauth/token

    Switzerland

    https://api.ch.exabeam.cloud/mcp

    Auth URL: https://api.ch.exabeam.cloud/oauth/authorize

    Token URL: https://api.ch.exabeam.cloud/oauth/token

    Japan

    https://api.jp.exabeam.cloud/mcp

    Auth URL: https://api.jp.exabeam.cloud/oauth/authorize

    Token URL: https://api.jp.exabeam.cloud/oauth/token

    Australia

    https://api.au.exabeam.cloud/mcp

    Auth URL: https://api.au.exabeam.cloud/oauth/authorize

    Token URL: https://api.au.exabeam.cloud/oauth/token

Caution

Before connecting, consider the data you wish to share with your AI tool. Exabeam is not responsible for data you expose to your tool.

If you wish to disable this functionality, open a support request or contact your account team.

  1. Follow the Create An API Key instructions to generate an API Key and Secret in the New-Scale Security Operations Platform.

  2. Copy and note the API Key and Secret strings.

  3. In your AI tool's desktop or web UI, configure the connection to the Exabeam MCP server using the API Key, Secret, and MCP server url. Connection steps will vary depending on the tool.

  4. After connecting, you can start interacting with Exabeam data in your AI tool.

Currently Supported Functionality

The list below details the currently supported functionality you can perform with the Exabeam MCP server. New functionality will be added as it becomes available.

Access up to 1,000 records across:

Application

Functionality

Threat Center

  • Search cases

  • Get case details

  • Get threat timeline for a case

  • Get threat timeline for an alert

  • Create a case

  • Update a case

  • Create case notes

  • Update an alert

  • Get threat summary

Search

  • Run searches

  • Get search results

Attack Surface Insights

  • Get entity information (users, devices)

Context Management

  • Get context table records by ID

  • Get a list of all context tables

Threat Detection Management

  • Get correlation rule details

  • Get a list of all correlation rules

  • Get a list of all analytics/detection management rules

Search

  • Get use case score

  • Get MITRE ATT&CK coverage score

Example Queries

Once connected, you can ask Claude to query Exabeam data in natural language. Claude uses your authenticated Exabeam identity to fulfill these requests. You can only access data that your Exabeam role permits so the same restrictions that apply in the Exabeam UI apply here.

  • "Show me a list of critical severity cases from the last 7 days."

  • "Tell me which users were involved in xxxxx case."

  • "Run a search for IP address x.x.x.x and summarize the results."

  • "What's the timelines for case xxxxx?"

  • "Pull alerts from the last 7 days that include MITRE tags."

  • "Create a case for this suspicious activity."

  • "Close case xxxxx as a false positive."

  • "What is our current use case score?"

Note

Exabeam also offers an MCP option for developers to interact directly with Exabeam's API documentation. For more information, see MCP Server for Developers on the Exabeam Developer portal.