Exabeam unveils its cloud platform at RSA Conference 2020 to make security analysts more efficient

Exabeam, the Smarter SIEM™ company, unveils the Exabeam Cloud Platform at RSAC 2020, to help security leaders mature their security posture; aid architects to secure new use cases by expediting the provisioning and consumption of new applications, tools and content; and make security engineers and analysts more efficient with simplicity of use and deployment.

Applications, including the previously announced Exabeam Threat Intelligence Service and the new Exabeam Cloud Archive, will be available on the Cloud Platform through the Exabeam Application Marketplace.

Data graphing and integrations

The Application Marketplace provides analysts and engineers with a single online location

The first tool, the Exabeam Parser Editor, a patented self-service parser tool, is being made available with the launch of the Exabeam Cloud Studio on the Cloud Platform. The multi-tenant Cloud Platform extends Exabeam’s security information and event management (SIEM) solution with capabilities unique to Exabeam – user and entity behaviour analytics (UEBA) and object-centric workspaces – as well as cloud storage, data graphing and integrations with over 250 products.

As a cloud offering, engineering tasks needed to deploy and maintain the infrastructure’s underlying services are eliminated. The Application Marketplace provides analysts and engineers with a single online location to try, buy and deploy Exabeam security management applications to improve how they work. Initial applications include:

• Exabeam Cloud Archive – allows organisations to establish a second, cheaper storage tier for the long-term retention of security without having to endure long search times or inaccessible storage.
• Exabeam Threat Intelligence Service – allows security teams to fully integrate threat intelligence with correlation rules or behavioural analysis models to indicate added risk of notable users and entities.

Software development toolkit

Engineers can use tools to quickly develop the content they need to support new use cases

In the future, applications will also be available from trusted partners. Partners will be able to build applications on the Cloud Platform using Exabeam’s software development toolkit (SDK) or simply sell them through the marketplace.

Of all SOC responsibilities, security pros were least satisfied with responsibility for SIEM content creation, according to the Exabeam 2019 Cybersecurity Professionals Salary, Skills and Stress Survey. The Cloud Studio reduces the frustrations of SIEM content creation. Engineers can use tools to quickly develop the content they need to support new use cases. Initially the Cloud Studio includes:

• Exabeam Parser Editor - a novel solution that will save engineers an average of six hours a week by allowing them to easily build parsers for new log types and modify existing parsers by uploading a log file and using the simple, intuitive UI of a self-service wizard.

Security teams improving productivity

“Exabeam’s mission is to make every security practitioner more efficient,” said Nir Polak, CEO, Exabeam. “We previously helped security teams improve productivity by redefining the modern SIEM with UEBA and SOAR. Now, we are raising the bar again, with a cloud platform that allows them to quickly provision and consume new applications, tools and content.”

Exabeam is also announcing additional new features to the Exabeam Security Management Platform (SMP), a modern SIEM that can be deployed as SaaS, in a public or private cloud, or as software on premises:

• Turnkey playbooks: out-of-the-box automated playbooks for common security investigations, such as phishing, that unlike playbooks in other security orchestration, automation and response (SOAR) products, do not require third-party licenses or configuration.
• New cross-platform integrations that allow analysts to seamlessly pivot from events in a user timeline back to the raw log; view cases automatically enriched with user, entity or artifact details; add evidence to cases (or create new cases) directly from user timelines; and build playbooks to recognise anomalous activity.
• Dark mode: to improve analysts’ visual experience, especially in low-light environments like a dark SOC or late at night when an attack surfaces.

The Threat Intelligence Service is currently available to Exabeam customers at no additional cost. The Cloud Archive will initially be available to Exabeam SaaS Cloud customers in Q2 2020. The Parser Editor will be available in a limited release in Q2 2020. The other new Exabeam SMP features will be available in Q2 2020. For further information about the Exabeam Cloud Platform meet Exabeam at RSAC 2020, South Expo Hall, booth #555.