I've been quietly reading posts here about Exabeam workflows, and I finally have something to share. We've been using Exabeam for user behavior analytics for a few months, and our SOC wanted a quicker way to see high-risk user alerts without having to be in the UI all the time.
I put together a Python script that pulls the latest high-risk users from the Exabeam API and sends a formatted summary to a dedicated Slack channel. It runs on a schedule via a simple cron job. The main goal was to get the username, risk score, and the top contributing rule for each user flagged in the last 24 hours.
It uses the `exabeam` Python client library for the authentication and data pulling, and the Slack SDK for posting. The trickiest part was figuring out the exact API endpoint for the user risk data and parsing the nested JSON for the rule information. I also added a filter to only show users with a risk score above 80 to avoid noise.
It's been running for a couple of weeks now and the team finds it helpful. I'm wondering if others have built similar integrations, and if there are better ways to structure the data or perhaps use webhooks instead of polling the API on a schedule.