Exabeam Admin flashcards
Exabeam Admin · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- New-Scale Platform
- Exabeam's cloud-native security operations platform combining data lake ingestion, correlation, UEBA and agent behavior analytics, and case management, available as SaaS or in a customer tenancy.
- LogRhythm Platform Manager
- The LogRhythm component hosting the admin console, AI Engine, and API services; it coordinates Data Processors and Data Indexers and is a critical singleton requiring protection.
- Data Indexer role
- LogRhythm component that stores indexed log metadata to serve searches; capacity is scaled by adding indexers, independent of parsing throughput handled by Data Processors.
- Data Processor role
- LogRhythm component that receives raw logs, parses and normalizes them, applies enrichment, and forwards to indexers; scaled for ingestion and parsing throughput.
- Hybrid deployment model
- Architecture where log collection and some processing remain on-premises for data residency or latency reasons while analytics and storage run in the cloud.
- Syslog collection ports
- Standard syslog uses UDP or TCP 514; TLS-protected syslog commonly uses TCP 6514; HTTPS 443 carries API and console traffic and must be allowed end to end.
- Normalization
- Mapping vendor-specific log fields to a common schema covering user, host, source and destination IP, outcome, and event time, enabling correlation and behavioral baselining.
- Event time versus ingest time
- Event time is when the source recorded the activity; ingest time is when the platform received it. Skew between them breaks session assembly and timeline accuracy.
- Tiered retention
- Storage strategy keeping recent data in fast searchable storage and older data in warm or cold object storage to satisfy compliance retention at lower cost.
- Log source silence alert
- Monitoring rule that fires when a configured source sends no events for its expected interval, distinguishing collection failure from genuinely quiet activity.
- Parser failure diagnosis
- Comparing raw against parsed events, checking custom parser field mappings, and verifying message format after vendor upgrades to restore correct normalization.
- Ingestion volume budget
- The licensed or provisioned capacity measured in GB per day or events per second; exceeding it causes drops or throttling and must be monitored continuously.
- Session assembly
- Grouping related events for a user or entity into a time-bounded session using correlation logic, producing the unit analysts review during investigation.
- UEBA baseline
- A learned profile of normal behavior per entity over a training window; deviations from it generate anomaly scores that feed risk-based alerting.
- Agent Behavior Analytics
- Behavioral modeling applied to machine and automation identities such as service accounts, detecting anomalous process execution, logon timing, and machine-to-machine traffic.
- Peer group
- The comparison population used for anomaly detection; an incorrectly defined peer group distorts the baseline and produces false positives.
- Watchlist
- A curated group of entities such as privileged users or critical servers used to weight risk and scope which detections apply.
- Risk score aggregation
- Combining deterministic rule risk and behavioral anomaly risk per entity, with scores aging or decaying over time so stale activity stops dominating prioritization.
- Learning mode noise
- Elevated false positives expected while new entities establish baselines; suppression or down-weighting is applied until the model has sufficient history.
- Investigation timeline
- Chronological rendering of all events for an entity with risk reasons annotated, serving as the primary surface for evidence review and pivoting.
- Pivot rule
- From a suspicious user move to hosts, IPs, and processes; from a suspicious host move to users and network peers, expanding the session graph each step.
- Risk reason
- The explanation attached to a detection stating why it fired, such as unusual time, rare process, or peer-group deviation, supporting triage decisions.
- AI agent workflow
- Automated investigation sequence that gathers evidence, enriches entities, and summarizes findings while routing irreversible response actions to analyst approval.
- TDIR lifecycle
- Detect, triage, investigate, respond, and close with documented outcome; metrics are computed from first event time rather than alert creation time.
- Narrow suppression rule
- An exclusion scoped to a specific entity or exact pattern with documented justification, avoiding broad mutes that would hide genuine malicious activity.
- Playbook trigger types
- Events that start a SOAR playbook: an alert firing, a case being created, a manual analyst launch, or a scheduled run.
- Approval gate
- A playbook step pausing for human confirmation before destructive actions such as account disablement or host isolation, preserving analyst control.
- Playbook idempotency
- Design property ensuring repeated triggers or retries do not duplicate actions, supported by state checks and fallback branches on API failure.
- Connector service account
- A scoped non-human identity used by SOAR integrations for API access, rotated on schedule and never tied to a personal administrator credential.
- Outcomes Navigator
- Capability mapping deployed data sources and detection content to security outcomes and control frameworks, exposing coverage gaps instead of raw rule counts.
- Detection coverage metric
- Percentage of relevant MITRE ATT&CK techniques or framework controls for which required log sources are ingested and a working detection exists.
- Role-based access control
- Assigning the least-privilege role such as analyst, responder, administrator, or read-only auditor, governing which data is visible and which actions are permitted.
- Support diagnostics bundle
- Evidence gathered before opening a support case: component logs, timestamps, affected entities, and reproduction steps, reducing resolution time.