Skip to content
downpipes docs

Pull the downpipes audit trail into Exabeam

Exabeam collects the downpipes audit trail by polling, not by receiving a push. You configure Exabeam’s generic REST API Cloud Collector to poll the audit feed at /support/audit-feed with a bearer token, advancing by sequence number. Exabeam’s own collector parses the JSON, so there is no separate parser to build on your side.

Because this is a pull, the Cloudflare Access perimeter matters here in a way it does not for a push. If Access fronts your console hostname, it turns the collector’s poll away before the engine answers, returning an HTML login redirect where JSON was expected. The credential mint, the Access exemption and the continuity checks are on Wiring the audit feed into your SIEM; this page is the Exabeam-specific setup.

What you need

  • An Exabeam role that can add and configure a REST API Cloud Collector.
  • An Owner in the downpipes console to mint an audit-feed credential, plus (if Cloudflare Access fronts your console hostname) an Access service token or a narrow path exemption for the collector.

Set it up

  1. As an Owner in the downpipes console, mint an audit-feed credential. It is shown once, stored as a hash, and revocable at any time. The exact screen and the Cloudflare Access handling are on the audit feed page.
  2. In Exabeam, add a generic REST API Cloud Collector pointed at https://<your-console-host>/support/audit-feed, and set the credential as the bearer, sent as the Authorization header value Bearer <secret>.
  3. Configure the collector to page by the afterSeq query parameter and to persist nextAfterSeq from each response as the next cursor. Batches are bounded by limit, which clamps to 1000.
  4. If Cloudflare Access fronts your console hostname, give the collector an Access service token (the two CF-Access-* headers) or a narrow Bypass on the feed path, as described on the audit feed page. Without one, the poll gets an HTML redirect rather than JSON.
  5. Run one collection and confirm events arrive in ascending seq order. Exabeam then polls on its own schedule.

What each poll returns

The collector sends a bearer and a cursor:

GET /support/audit-feed?afterSeq=4096&limit=500 HTTP/1.1
Host: console.example.com
Authorization: Bearer dpc_AbCdEfGhI.dps_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The response carries the batch and the chain head as { "kind": "downpipe-audit-feed", "afterSeq": ..., "nextAfterSeq": ..., "headSeq": ..., "headHash": ..., "count": ..., "events": [ ... ] }. Each event holds seq, actorEmail, sourceIp, action, outcome, target, prevHash and hash. The full field meanings and the continuity checks are on the audit feed page.

Good to know

  • The cursor is a sequence number, not a timestamp. Persist nextAfterSeq after each batch and send it as the next afterSeq; sequences are gap-free and monotonic, so a restart resumes exactly where it stopped. When count is zero you are caught up and the cursor does not move.
  • The feed carries operator identity (member emails, source IPs, roles and approver emails) and no backup data or secret values, so apply your Exabeam data-handling rules to it as you would any access log. For the credential mint, the Access exemption and continuity verification, see Wiring the audit feed into your SIEM.

Last updated .