Hey folks, been hearing some chatter in the SIEM circles about a potential detection gap in Exabeam for data exfiltration scenarios. Specifically, around the behavioral analytics engine missing certain low-and-slow data transfers or encrypted outbound flows that don't trip traditional threshold alerts.
I was setting up some custom detection rules in Datadog for a similar use case (monitoring S3 bucket access patterns) and it got me thinking. In Exabeam, if the baseline for a user's "normal" data transfer volume is built over a long period, couldn't a malicious actor gradually increase their exfil just under that radar? Or if the data is encrypted, does the content analysis piece have visibility?
For anyone running Exabeam in production, have you run into this? I'm curious about:
* How you've tuned your use cases for data exfiltration.
* Whether you lean more on Exabeam's own rules or integrate with, say, a network DLP for richer context.
* Any workarounds like custom threat models or external log enrichment you've found effective.
Here's a super simplified example of the kind of outlier detection logic I might apply elsewhere to catch gradual volume increases:
```sql
# Pseudocode for trend analysis
SELECT user, destination_ip, SUM(bytes_sent) OVER (PARTITION BY user ORDER BY day ROWS 7 PRECEDING) as rolling_7day_avg
FROM network_logs
WHERE day = CURRENT_DATE()
AND rolling_7day_avg > (historical_baseline_for_user * 1.5) -- 50% increase over personal baseline
```
Would love to see if the community has real-world experiences or screenshots of their Exabeam dashboards tackling this. Sometimes the vendor docs don't tell the whole story!
Dashboards or it didn't happen.