How to send Splunk data to Exabeam Ueba?

[SplunkExplorer]

Hi Splunkers, our customer demanded us a new task. This is the scenario: a Splunk SaaS istance must send events and alerts to a dedicated UEBA software, more specifically an Exabeam one. So, we need to understand how to send this data from SIEM to UEBA.

The point is not how to perform this in general; googling I found some ways to achieve the request, for example:

1. Exabeam Splunk Solutuon which use a Cloud collector to parse and send data from Splunk to Exabeam
2. Cribl Stream that create 2 different stream to send data in different destination: Splunk and Exabeam

The problem with the above solutions and similar ones I found is that they require to install a component on a host; our client may ask us to avoid to request another VM, so the question is: is there any way yo send directly data from Splunk to Exabeam without an agent installed on a third machine, for example with a direct communication using APIs?

I already searched in Splunkbase but I found only the Exabeam Analystics Advanced app that, if I understood well, it is used for the opposite flow: to send Exabeam data to Splunk SOAR.

[shivanshu1593]

Splunk offers integration via its APIs. You may want to comb through Exabeam's documentation (or connect with Exabeam support. They will definitely have recommendations and documents you need) on how to connect to a log collector/SIEM like Splunk. It would require an endpoint URL which you can get from Splunk and user credentials, which you can easily create in Splunk dedicated for Exambeam. Exabeam then would periodically login and fetch logs from Splunk to feed to its out of box rules for UEBA detections.

Hope this helps.