On This Page

Home / Edge/ Integrations/ Sending Data/Exabeam Destination

Exabeam Security Operations Platform Destination

Cribl Edge supports sending data to the Exabeam security operations platform or (as some people think of it) SIEM.

The Exabeam Destination supersedes and improves upon the “old way” to get data from Cribl Edge to Exabeam using the Cribl Webhook Destination.

Type: Non-Streaming | TLS Support: Yes | PQ Support: No

For examples of using Cribl Edge to optimize inbound events for Exabeam, see:

  • Splunk to Exabeam, which demonstrates combining several Cribl Functions to transform events before forwarding to Exabeam.

  • Several Exabeam Packs on the Cribl Packs Dispensary, which provide processing Pipelines that you can import and adapt to your needs.

Understand How Exabeam and Cribl Edge Work Together
​

Exabeam parsers expect to receive events in original, unmodified form. To make sure this happens, you’ll sometimes need to use a combination of Event Breakers and Pipelines. In general, knowing this can help you avoid problems or troubleshoot any that do crop up.

When you send data to Exabeam, Cribl Packs are your friends, because Cribl and Exabeam have partnered to create a set of Exabeam-specific Packs, each of which ensures that events from one common data source arrives at Exabeam in precisely the expected form. Cribl Packs also give you the option of dropping events on a per-data-source basis, so that Cribl Edge never sends irrelevant events to Exabeam. To view the Exabeam-specific Cribl Packs, navigate to Processing > Packs. Then select Add Pack > Add from Dispensary, and enter Exabeam in the search field.

Cribl strongly recommends that you use only the Exabeam-specific, Cribl-authored Packs with this Destination. Other Packs can perform transformations – especially reduction – that prevent the Exabeam parsers from triggering.

When the original data source is Microsoft Active Directory (AD) or LDAP, you’ll need to set up an Exabeam Site Collector to perform the initial data capture.

Because Exabeam runs in the Google Cloud Storage (GCS) platform, some setting names include references to GCS.

Finally, Cribl recommends placing Cribl Edge Edge Nodes as close as possible to the sources of the events you want to send to Exabeam. This reduces the length of the path that data must traverse before Cribl Edge optimizes it with compression, reduction, dropping events, and/or redacting sensitive information.

Configure Cloud Storage Permissions
​

For Cribl Edge to send data to Exabeam buckets, the following access permissions must be set on the Cloud Storage side:

  • Fine-grained access control must be enabled on the buckets.
  • The Google service account or user must have the Storage Admin or Owner role.

For details, see the Cloud Storage Overview of Access Control and Understanding Roles documentation.

Create the Cribl Cloud Collector in Exabeam
​

Log in to the Exabeam Security Operations Platform, and on the Home page, select Cloud Collectors. In the resulting page, select the Cribl tile to see a list of Cribl Collectors (the first time you do this, the list will be empty).

Select New Collector, and in the resulting Collector for Cribl drawer:

  1. Enter a name for your new Cribl Cloud Collector.
  2. Optionally, in Advanced Settings, configure the Metadata value TIMEZONE
  3. If your desired site already exists, select it from the SITE drop-down.
    • If your desired site does not exist yet, skip the drop-down and select the manage your sites link underneath. This will take you to a separate UI where you will enter a value for the Metadata value SITENAME, and Exabeam will generate the associated metadata value SITE ID. When you have done this, Exabeam will take you back to the previous UI, and you must then select your newly-created site from the SITE drop-down.
  4. Select Install.

A Hooray! confirmation modal will now replace the Collector for Cribl drawer. In this modal:

  1. Select the copy icon to the right of the encoded Connection String. Save this string in a secure and handy location – it is required when configuring the Cribl Edge Exabeam Destination.
  2. Select Go to Overview to exit the modal.

Although optional, configuring metadata is useful because it allows a single instance of the Exabeam SIEM to differentiate between data from multiple sources. This is relevant for large enterprises whose IT infrastructure comprises many sources whose IP addresses overlap.

Configure Cribl Edge to Output to Cloud Storage Destinations
​

  1. On the top bar, select Products, and then select Cribl Edge. Under Fleets, select a Fleet. Next, you have two options:
    • To configure via QuickConnect, navigate to Routing > QuickConnect (Stream) or Collect (Edge). Select Add Destination and select the Destination you want from the list, choosing either Select Existing or Add New.
    • To configure via the Routes, select Data > Destinations or More > Destinations (Edge). Select the Destination you want. Next, select Add Destination.
  2. In the New Destination modal, configure the following under General Settings:
    • Output ID: Enter a unique name to identify this Exabeam Destination definition. If you clone this Destination, Cribl Edge will add -CLONE to the original Output ID.
    • Description: Optionally, enter a description.
    • Select Autofill with Exabeam Connection String to automatically enter the values for the following Exabeam Settings. Or enter them directly.
    • Google Cloud Storage bucket: Name of the destination bucket – in Exabeam’s Cribl Cloud Collector this is called GCS Bucket Name. This value can be a constant, or a JavaScript expression that can be evaluated only at init time. For example, you can reference a Global Variable like this: myBucket-${C.vars.myVar}.
    • Google Cloud Storage bucket region: In Exabeam’s Cribl Cloud Collector this is called GCS Bucket Region. It is the GCS region where the bucket is located.
    • Collector instance ID: In Exabeam’s Cribl Cloud Collector this is called Instance ID.
    • Access key: In Exabeam’s Cribl Cloud Collector this is called Access Key.
    • Secret: In Exabeam’s Cribl Cloud Collector this is called Secret Key.
    • Site name: In Exabeam’s Cribl Cloud Collector this is called SITENAME. This determines where your data is categorized. Set a static site name or dynamically assign it using a JavaScript expression. For example, to dynamically set the site name based on the cribl_pipeline field you’d use the expression ${C.vars.cribl_pipeline}. This assigns the site name based on the Pipeline value.
    • Site ID: In Exabeam’s Cribl Cloud Collector this is called SITE ID.
    • Timezone offset: In Exabeam’s Cribl Cloud Collector this is called TIMEZONE.
  3. Optionally, you can adjust the Processing and Advanced settings outlined in the sections below.
  4. Select Save, then Commit & Deploy.

Processing Settings
​

Post‑Processing
​

Pipeline: Pipeline or Pack to process data before sending the data out using this output.

System fields: A list of fields to automatically add to events that use this output. By default, includes cribl_pipe (identifying the Cribl Edge Pipeline that processed the event). Supports c* wildcards. Other options include:

  • cribl_host – Cribl Edge Node that processed the event.
  • cribl_input – Cribl Edge Source that processed the event.
  • cribl_output – Cribl Edge Destination that processed the event.
  • cribl_route – Cribl Edge Route (or QuickConnect) that processed the event.
  • cribl_wp – Cribl Edge Worker Process that processed the event.

Advanced Settings
​

Backpressure behavior: Select whether to block or drop events when all receivers are exerting backpressure. (Causes might include an accumulation of too many files needing to be closed.) Defaults to Block.

Max file open time (sec): Maximum amount of time to write to a file. Files open for longer than this limit will be closed and moved to final output location. Defaults to 300 seconds (5 minutes).

Max file idle time (sec): Maximum amount of time to keep inactive files open. Files open for longer than this limit will be closed and moved to final output location. Defaults to 30.

Max open files: Maximum number of files to keep open concurrently. When exceeded, the oldest open files will be closed and moved to final output location. Defaults to 100.

Cribl Edge will also close any files larger than 10 MB.

Disk space protection: Specifies whether to Block (default) or Drop incoming events when the disk space falls below the globally defined Min free disk space amount.

Remove empty staging dirs: When toggled on (the default), deletes empty staging directories after moving files. This prevents the proliferation of orphaned empty directories. When enabled, exposes this additional option:

  • Staging cleanup period: How often (in seconds) to delete empty directories when Remove empty staging dirs is enabled. Defaults to 300 seconds (every 5 minutes). Minimum configurable interval is 10 seconds; maximum is 86400 seconds (every 24 hours).

Enable dead-lettering: Toggle this on to set a maximum number of retries, and to move files to a designated directory when write failures exceed that limit. This prevents data flow blockage and excessive error logging due to undeliverable files. When enabled, exposes two additional fields:

  • Dead-letter location: Specify the storage location for undeliverable files. Defaults to $CRIBL_HOME/state/outputs/dead-letter.
  • Maximum retry limit: Configure the retry limit for failed file deliveries. This setting defines how many times the system will attempt to move a file to its intended location before it is deemed undeliverable and placed in the dead-letter directory. Defaults to 20.

Reuse connections: Whether to reuse connections between requests. Toggling on (default) can improve performance.

Reject unauthorized certificates: Whether to accept certificates (such as self-signed certificates, for example) that cannot be verified against a valid Certificate Authority. Defaults to toggled on.

Environment: If you’re using GitOps, optionally use this field to specify a single Git branch on which to enable this configuration. If empty, the config will be enabled everywhere.

Tags: Optionally, add tags that you can use to filter and group Destinations on the Destinations page. These tags aren’t added to processed events. Use a tab or hard return between (arbitrary) tag names.

Internal Fields
​

Cribl Edge uses a set of internal fields to assist in forwarding data to a Destination.

Field for this Destination:

  • __partition

Troubleshooting
​

Verify that you are sending the original, unmodified events. Study the applicable Exabeam parsers to make sure you understand exactly what they’re doing. If you need to modify events, make sure that when you do, the relevant parsers still trigger.

Nonspecific messages from Google Cloud of the form Error: failed to close file can indicate problems with the permissions listed above.

The Destination’s configuration modal has helpful tabs for troubleshooting:

Live Data: Try capturing live data to see real-time events as they flow through the Destination. On the Live Data tab, click Start Capture to begin viewing real-time data.

Logs: Review and search the logs that provide detailed information about the delivery process, including any errors or warnings that may have occurred.

Test: Ensures that the Destination is correctly set up and reachable. Verify that sample events are sent correctly by clicking Run Test.

You can also view the Monitoring page that provides a comprehensive overview of data volume and rate, helping you identify delivery issues. Analyze the graphs showing events and bytes in/out over time.