Exabeam Admin key terms

Exabeam's cloud-native security operations architecture that combines SIEM, UEBA, and automation in a single tenant, replacing the older on-premises deployment model with elastic cloud compute and storage.

A hosting model where the platform runs in the vendor's cloud environment, so the customer consumes services over the internet while the provider manages infrastructure, scaling, and upgrades.

A hosting model where the customer installs and operates platform components in their own data center or private cloud, retaining responsibility for hardware sizing, patching, and availability.

A lightweight on-premises service that receives log data from local sources, compresses and encrypts it, then forwards it to the cloud platform so internal devices need not expose inbound ports.

A configured representation of a system, application, or device that sends events into the platform, carrying the parsing rules, credentials, and metadata needed to normalize its data.

A definition that extracts fields from raw log text and maps them to the platform's common information model so events from different vendors become comparable and searchable.

The process of translating vendor-specific log fields into a shared schema, enabling correlation, search, and detection rules to work consistently across heterogeneous data sources.

The platform's standardized field dictionary that defines canonical names, types, and meanings for event attributes such as user, host, source address, and action.

The ordered set of stages raw events pass through, from receipt and decoding to parsing, enrichment, indexing, and storage, with monitoring at each stage for failures and lag.

Augmenting events during ingestion with context such as asset criticality, user identity, geolocation, or threat intelligence, so detections and investigations carry more meaning.

The delay between an event occurring at the source and becoming searchable in the platform, a key health metric used to detect collector backlogs or pipeline bottlenecks.

The configured period for which raw events and derived data remain queryable, balancing investigative and compliance needs against storage cost and licensing volume.

The scalable storage layer holding normalized events and enrichment data for long-term search, supporting retrospective hunting and analytics beyond short-term hot storage.

A chronological reconstruction of all activity associated with a user, host, or session, assembled automatically from correlated events to support investigation and triage.

A grouped sequence of related events attributed to one user on one device within a time window, forming the basic unit that behavior models and timelines analyze.

A statistical profile of what is normal for a user, peer group, or entity, learned over a training period and used to measure how far new activity deviates.

A numeric value expressing how unusual an event or session is relative to learned baselines, with higher values indicating activity that deviates more strongly from expected patterns.

An aggregated measure combining anomaly scores, rule matches, and contextual weighting to rank users, hosts, or sessions by investigative priority.

A set of comparable users or entities, such as a department or job role, whose collective behavior provides a reference for judging whether an individual's activity is unusual.

Monitoring of automated agents, service accounts, and machine identities, modeling their normal task patterns to detect misuse, credential theft, or anomalous automation activity.

A non-human identity used by applications or scripts to perform automated tasks, which requires its own behavioral baseline because its activity patterns differ from human users.

Logic that evaluates sequences or combinations of events across sources to raise a detection when a defined pattern, threshold, or condition is satisfied.

A configured condition, whether behavioral model, correlation logic, or match list, that produces an alert or risk contribution when its criteria are met.

The iterative adjustment of detection thresholds, exclusions, and baselines to reduce false positives while preserving coverage of genuine threats.

An alert raised for activity that is benign, consuming analyst time and eroding trust in detections when it occurs at high volume.

The first-pass review of an alert to decide whether it warrants investigation, escalation, or closure, typically guided by severity, context, and timeline evidence.

A tracked case created when an alert or group of related alerts requires coordinated investigation, documenting evidence, status, ownership, and response actions.

A defined automation workflow that runs a sequence of steps, such as enrichment, notification, or containment, in response to an alert or on analyst demand.

Execution of response or investigation steps by the platform without manual analyst action, reducing response time and enforcing consistent handling of repetitive tasks.

A connector that lets the platform exchange data and actions with an external system, such as an endpoint tool, identity provider, or ticketing service.

The structured tracking of investigations through stages, assignments, notes, and evidence, providing an auditable record of how each incident was handled.

A capability that maps deployed detections and controls to recognized security frameworks, showing which outcomes are covered and where gaps remain.

A missing detection or control relative to a framework, threat model, or required outcome, identified through mapping and prioritized for remediation.

A defined security scenario, such as impossible travel or brute force, that groups the detections, data sources, and response steps needed to address it.

An access model granting permissions through assigned roles rather than per-user settings, simplifying administration and enforcing least privilege across the platform.

The principle of granting each identity only the access needed for its function, limiting the blast radius of credential compromise or insider misuse.

An identity with elevated administrative rights over systems or the platform itself, warranting stricter monitoring, review, and behavioral baselining.

A record of administrative and user actions within the platform, used to demonstrate compliance, investigate misuse, and verify that changes were authorized.

Generation of evidence and reports showing that monitoring, retention, and access controls meet regulatory or framework requirements for auditors and stakeholders.