Exabeam Agentic SOC plugin
Triage Exabeam New-Scale alerts and cases end to end — evidence, verdict, and a guarded write path.
Exabeam Agentic SOC plugin — an agentic SOC analyst for Exabeam New-Scale, as a plugin for Claude Code and OpenAI Codex. It does the work, not just the chat: hand it an alert or a case and it pulls the events, pivots on the entities, baselines them against what is normal for them, tests the benign explanation and writes the verdict — then acts in the SIEM: opens and annotates the case, updates it, dismisses the alert, closes the case, so you don't have to. You stay in control: dismiss and close always ask you first, containment is recommended and never executed, and every call is on an audit trail. Three skills over one guarded Exabeam MCP connection: soc-investigate takes one alert or case from first look to verdict and outcome; triage-cases sweeps the open queue into a ranked “start here” list; rule-tuning finds the detection rules wasting analyst attention and proposes the fix. Built for hostile data: SIEM content is evidence, never instructions — hidden-character smuggling is screened out of what it reads, active content and secrets are neutralized in what it writes back, and the human-in-the-loop gate ships on, enforced by the host, not the model. Red-teamed and behavior-scanned before every release.
soc-investigateInvestigate and triage a security alert or case in Exabeam New-Scale, end to end.
triage-casesPrioritize a queue of open Exabeam New-Scale cases — decide what needs a human's attention first.
rule-tuningFind NOISY detection rules in Exabeam New-Scale — noisy, not merely loud — and propose specific, actionable tuning.
Claude Code
claude plugin marketplace add Exabeam-Labs/plugins # once
claude plugin install soc@exabeamOpenAI Codex
codex plugin marketplace add Exabeam-Labs/plugins # once
codex plugin add soc@exabeam