Hi Splunkers, our customer demanded us a new task. This is the scenario: a Splunk SaaS istance must send events and alerts to a dedicated UEBA software, more specifically an Exabeam one. So, we need ...
See more...
Hi Splunkers, our customer demanded us a new task. This is the scenario: a Splunk SaaS istance must send events and alerts to a dedicated UEBA software, more specifically an Exabeam one. So, we need to understand how to send this data from SIEM to UEBA.
The point is not how to perform this in general; googling I found some ways to achieve the request, for example:
Exabeam Splunk Solutuon which use a Cloud collector to parse and send data from Splunk to Exabeam
Cribl Stream that create 2 different stream to send data in different destination: Splunk and Exabeam
The problem with the above solutions and similar ones I found is that they require to install a component on a host; our client may ask us to avoid to request another VM, so the question is: is there any way yo send directly data from Splunk to Exabeam without an agent installed on a third machine, for example with a direct communication using APIs? I already searched in Splunkbase but I found only the Exabeam Analystics Advanced app that, if I understood well, it is used for the opposite flow: to send Exabeam data to Splunk SOAR.