Process and route critical security logs to Exabeam with Observability Pipelines

Datadog Observability Pipelines Exabeam Packs are preconfigured, source-specific filters designed to reduce the volume and cost of security logs sent to Exabeam SIEM while preserving the raw payloads and detection-relevant fields required by its parsers, UEBA models, and threat rules. The Packs apply dropping, deduplication, and sampling to routine activity from network, endpoint, web, identity, and collaboration sources, retaining higher-value events such as denied connections, VPN activity, security alerts, suspicious processes, Sysmon and PowerShell events, and blocked web traffic. Supported sources include Cisco ASA, Fortinet FortiGate, Palo Alto, CrowdStrike Falcon, SentinelOne, Windows, and Zscaler, with additional destination-agnostic coverage for Active Directory, Okta, Microsoft 365, and Abnormal.ai. Organizations can validate filtering through Live Capture, retain complete copies of logs in cloud archives such as Amazon S3, generate metrics from filtered events, and replay selected archived data into Exabeam for audits or investigations. The approach aims to provide a lower-noise SIEM stream without losing long-term visibility, and it can also route data to other destinations, including Datadog Cloud SIEM.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.