What it is
Exabeam Agentic SOC plugin, an agentic SOC analyst for Exabeam New-Scale, as a plugin for Claude Code and OpenAI Codex. It does the work, not just the chat: hand it an alert or a case and it pulls the events, pivots on the entities, baselines them against what is normal for them, tests the benign explanation and writes the verdict, then acts in the SIEM: opens and annotates the case, updates it, dismisses the alert, closes the case, so you don't have to.
You stay in control: dismiss and close always ask you first, containment is recommended and never executed, and every call is on an audit trail. Three skills over one guarded Exabeam MCP connection: soc-investigate takes one alert or case from first look to verdict and outcome; triage-cases sweeps the open queue into a ranked “start here” list; rule-tuning finds the detection rules wasting analyst attention and proposes the fix.
Built for hostile data: SIEM content is evidence, never instructions, hidden-character smuggling is screened out of what it reads, active content and secrets are neutralized in what it writes back, and the human-in-the-loop gate ships on, enforced by the host, not the model. Red-teamed and behavior-scanned before every release.
What it does
- Investigates on the real Exabeam read surface, events, alerts, cases, threat timelines, rule details, MITRE coverage, context tables.
- Decides against a disciplined bar, a false-positive close requires a positive benign explanation, never merely "I found nothing"; in doubt it escalates rather than silently suppressing.
- Prioritizes the queue so the urgent cases are impossible to miss.
- Tunes the source of the noise so the fix lands on the detection instead of on the analyst.
- Acts opens or updates a case, writes notes, dismisses true false positives (gated), and recommends containment for you to perform in EDR or IAM. It never executes containment.
- Stops where it should dismiss and close sit behind a host-enforced gate that ships on, on all three hosts. No settings to edit.
- Treats telemetry as hostile hidden-character smuggling is stripped from what it reads; formulas and links are disarmed and secrets and structured identifiers masked in what it writes.
- Logs what it did a structured, local, privacy-preserving audit record, on by default.
3 skills
soc-investigateOne alert or case, first look to written verdict: gathers the evidence itself, pivots on the entities, weighs a benign explanation against a malicious one, and acts, opens or updates a case, writes notes, escalates. Asks you before any dismiss or close.
Ask: “investigate” · “triage this alert/case” · “work this alert”
triage-casesThe open queue rather than one case: clusters by attack shape, ranks by corroborated signal, hands back a short "start here" list. Read-only across the sweep.
Ask: “triage the queue” · “what should I look at” · “what needs attention”
rule-tuningFinds rules that are noisy, not merely loud, and proposes the specific change mapped to real Exabeam mechanics. Propose-only: the skill never calls a rule-write tool, and the host gate refuses them on every host.
Ask: “find noisy rules” · “what's generating false positives” · “tune detections”
Get started
- Install: - Claude Code,
claude plugin marketplace add Exabeam-Labs/pluginsthenclaude plugin install soc@exabeam- Codex,codex plugin marketplace add Exabeam-Labs/pluginsthencodex plugin add soc@exabeam- Antigravity,agy plugin install https://github.com/Exabeam-Labs/plugins/tree/main/soc - Add your Exabeam API key and secret to
~/.exabeam-mcp.env. - Run
preflight.shfrom the installed plugin to check the connection and the gate. - Say "investigate alert
<id>".
claude plugin marketplace add Exabeam-Labs/plugins # once
claude plugin install soc@exabeamcodex plugin marketplace add Exabeam-Labs/plugins # once
codex plugin add soc@exabeamagy plugin install https://github.com/Exabeam-Labs/plugins/tree/main/soc