1. Expel Help Center
  2. Connect Your Technology
  3. SIEM Integrations
  4. Exabeam

Exabeam Fusion New-Scale SIEM Setup for Workbench

This article explains how to grant Expel access to your Exabeam Fusion New-Scale SIEM.

 

In this article

Step 1: Create an API key

 

Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech.

  1. Log in to the Exabeam web console.

  2. Navigate to Settings > API Keys.

    api-keys-new-scale-siem.png

  3. Create a new API Key with the Search, Analyze and Export permission set.

    new-api-key-new-scale-siem.png

  4. When the new key is generated, copy the KEY ID and KEY SECRET.

  5. Navigate to Exabeam docs to determine your Exabeam API base URL.

Step 2: Configure the technology in Workbench

 

 

Now that we have the correct access configured and noted the credentials, we can integrate your tech with Workbench.

  1. Navigate to Workbench > Organization Settings > Security Devices.

  2. Search for and select Exabeam Fusion New-Scale SIEM Collector.

  3. Type the KEY ID and KEY SECRET generated in Step 1.

    add-security-device-new-scale-siem.png

 

 

You can see if the device is healthy on the Security Devices page. It may take a few minutes to see the device listed as healthy.

To check if alerts are coming through, navigate to the Alerts Analysis page. Scroll to the device you want to check and click View alerts. Switch to grid view, then check the list for device alerts. It can take 36 to 72 hours for alerts to appear after setup, as we tune your device.

Tip

This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!

Related articles