How to Export and Review Exabeam Event Logs
Summary
A guide to exporting Exabeam events through its Search API or UI, converting JSON results to JSONL, and reviewing them in LogTotal. It covers API-key permissions, regional hosts, filters, and common errors.
Key points
- The Search API requires an API key with event-search permission and the correct regional API host.
- The guide demonstrates obtaining an access token and searching events with a filter, time range, selected fields, and result limit.
- It shows converting the JSON response rows into JSONL for upload to LogTotal.
- Troubleshooting advice covers invalid credentials or region, missing search permission, filter or field mismatches, and result limits.
- The guide notes that on-premises Exabeam Data Lake and LogRhythm SIEM use different export or API options.
Article Details
- Topic
- Exporting and reviewing Exabeam event logs using the Search API and LogTotal
Vendors
Products
Exabeam Data LakeOlder on-premises Exabeam Data Lake deployments work differently; see the FAQ.LogTotalBelow is how to get events out, sanitize them, and investigate them for free in LogTotal.New-Scale Security Operations PlatformOn the New-Scale Security Operations Platform, get an access token with your API key, then call the event search API with a filter, a time range and the fields you want.