How to Export Exabeam Logs

On the New-Scale Security Operations Platform, get an access token with your API key, then call the event search API with a filter, a time range and the fields you want. You get JSON back, one row per event. The Search app can also export results from the UI. Older on-premises Exabeam Data Lake deployments work differently; see the FAQ.

Exabeam collects logs for behavior analytics and SIEM, and since its merger with LogRhythm it covers a big share of the market. Prime Core has 15,635 detection rules for Exabeam, mapped to 542 MITRE ATT&CK techniques. Below is how to get events out, sanitize them, and investigate them for free in LogTotal.

Get Started For Free

Before you start

An API key. Create a client ID and secret in the platform’s API key settings, with permission to search events.

Your regional API host. It follows the pattern api.<region>.exabeam.cloud, for example api.us-west.exabeam.cloud or api.us-east.exabeam.cloud.

Query syntax. The event search uses Lucene-style filters, the same ones you type in the Search app. Test there first.

Export with the Search API

BASE="https://api.us-west.exabeam.cloud"

# 1. access token
TOKEN=$(curl -sS -X POST "$BASE/auth/v1/token" -H 'Content-Type: application/json' \
  -d "{\"client_id\": \"$EXA_ID\", \"client_secret\": \"$EXA_SECRET\", \"grant_type\": \"client_credentials\"}" \
  | jq -r '.access_token')

# 2. event search
curl -sS -X POST "$BASE/search/v2/events" \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{
    "filter": "host:\"web-03\"",
    "startTime": "2026-10-19T00:00:00Z",
    "endTime": "2026-10-20T00:00:00Z",
    "fields": ["*"],
    "limit": 10000
  }' > exabeam_web03_1019.json

jq -c '.rows[]' exabeam_web03_1019.json > exabeam_web03_1019.jsonl

Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the .jsonl file.
2. Sanitize.
3. Review. 

When it goes wrong