---
url: https://docs.realmsec.info/integration/exabeam.md
---

# Exabeam Integration

![Exabeam Architecture](../images/exabeam.png)

## 1. Configure a Webhook Cloud Collector in Exabeam

1. Log in to the Exabeam New-Scale Security Operations Platform as an administrator
2. Navigate to **Collectors > Cloud Collectors**
3. Click **New Collector** and select **Webhook**
4. Enter a **Collector Name** (e.g., `Realm.Security`)
5. Select the **Data Format**: `JSON` or `RAW`
6. Save the collector — Exabeam will generate a **Webhook URL** and **Authentication Token**
7. Copy both the **Webhook URL** and **Token** — you will need them in the next section

For more information, see the [Exabeam Webhook Cloud Collector Setup Documentation](https://docs.exabeam.com/en/collectors/all/cloud-collectors-administration-guide/onboard-cloud-collectors/webhook-cloud-collectors/webhook-cloud-collector.html).

***

## 2. Configure an Exabeam Output Feed in Realm

1. Navigate to the **Destinations** page and select an existing destination or create a new one for Exabeam.

2. Add a new **Output Feed** and select **Exabeam** as the output type.

3. Set the **Name**

4. Optionally add a **Description**

5. Select **Exabeam** as the method

6. Enter the **Webhook URL** from the previous section

   Example:

   ```text
   https://api2.<REGION>.exabeam.cloud/cloud-collectors/v1/logs/json
   ```

7. Paste the **Token** from the previous section — Realm will send this as a Bearer token in the `Authorization` header

8. Choose the **Format**: `JSON` or `RAW` — this must match the Data Format selected when creating the Exabeam collector

> **Note:** Each Exabeam Webhook Cloud Collector only accepts data from a single source. As a result, each Exabeam Output Feed in Realm must be a 1:1 mapping between a source and a destination. If you need to send data from multiple sources to Exabeam, create a separate Webhook Cloud Collector in Exabeam and a corresponding Output Feed in Realm for each source.