Integrating Cato Data with Exabeam

Overview

Use the Exabeam integration to analyze Cato network and security data alongside data from other sources in the Exabeam New-Scale Security Operations Platform. The native integration sends data directly to a JSON Webhook Cloud Collector, so your SOC can search Cato records and use them in its monitoring and investigation workflows.

You configure the integration in the Cato Management Application (CMA). Cato sends HTTPS POST requests containing JSON arrays and authenticates with the collector's bearer token. Parsing Cato fields in Exabeam may require additional configuration.

Exabeam Data Sources

You can send Events, Flows, or both:

• Events – Records of network and security activity, such as policy matches, threats, connectivity changes, and audit activity.

• Flows – Network flow records that add application and user context and aggregated session details, such as bytes, packets, and duration.

Each record includes a data_source field with the value events or flows. Flow data can generate significantly more volume than event data, depending on your traffic.

Prerequisites

• Editor permission for Integrations in the Resources section of the CMA. For more information, see Managing Admin Roles Using RBAC.

• An Exabeam New-Scale deployment with permission to administer Cloud Collectors.

• The prerequisites described in Getting Started with Event Integrations, including any required IP allowlisting.

Use Cases

These examples assume that the relevant data sources are ingested and the fields used to correlate records are parsed consistently.

Events

Investigate a suspected compromised account by reviewing its Cato threat events alongside identity-provider sign-ins in an Exabeam Search timeline. Use matching user information and timestamps to build a sequence of activity.

Flows

Add the account's Cato flow records to the investigation to assess destinations contacted, connection duration, and transfer volume.

Creating the Exabeam Integration

Create a JSON Webhook Cloud Collector in Exabeam, then use its destination URL and authentication token to configure the integration in the CMA.

Step 1: Create the Webhook Cloud Collector in Exabeam

To create the collector:

1. Log in to Exabeam and go to Collectors > Cloud Collectors.

2. Click New Collector and select Webhook.

3. Enter a descriptive name, such as Cato Networks.

4. For Format, select JSON. This format lets Exabeam extract individual records from the JSON arrays that Cato sends.

5. (Optionally) Select a Site and Timezone.

6. Click Install. Exabeam displays the authentication token and destination URL. Copy both values and store the token securely.

7. Click Go to Overview and confirm that the collector appears.

Use the complete URL generated for your collector, including the regional hostname and /logs/json path.

Step 2: Test the Endpoint with curl

Before you configure the integration in the CMA, send a test request directly to Exabeam. This helps isolate endpoint and authentication issues from the Cato integration.

To test the endpoint:

1. Replace <api-fqdn> with the API hostname for your test endpoint. Enter the collector token at the hidden prompt. This example uses Bash syntax for newline-delimited JSON.

2. Update the sample timestamps to the current UTC time, then run the following command:

   Run the entire example in an interactive Bash shell (run bash first if needed). Enter credentials at the hidden prompts; do not insert them into the command. The example disables shell tracing and passes authentication headers through standard input using --header @-, keeping credentials out of shell history and curl command-line arguments. The temporary credential variables are discarded when the example finishes.

   (
     set +axv
     set -euo pipefail
     unset CATO_TEST_TOKEN
     IFS= read -r -s -p 'Exabeam collector token: ' CATO_TEST_TOKEN
     builtin printf '\n' >&2
     case "$CATO_TEST_TOKEN" in
       ''|*$'\r'*) builtin printf 'Enter a nonempty credential without carriage returns.\n' >&2; exit 1 ;;
     esac
   
     builtin printf '%s\n' "Authorization: Bearer ${CATO_TEST_TOKEN}" | \
       curl -q --fail --show-error --include --max-time 30 -X POST 'https://<api-fqdn>/ingest/api/v1/third_party_log/hec' \
     --header @- \
     -H "Content-Type: text/plain" \
     --data-binary $'{"timestamp": "2026-10-20T10:00:03Z", "msg": "ndjson log line 1"}\n{"timestamp": "2026-10-20T10:00:05Z", "msg": "ndjson log line 2"}\n'
   )

3. Check the HTTP response for an error. A successful request returns an HTTP 2xx status.

4. In Exabeam, search for ndjson log line 1 and ndjson log line 2, and confirm that they appear as separate records.

This test checks whether the destination accepts the sample request. Verify Cato data and parsing after configuring the integration below.

Step 3: Create the Integration in the CMA

To create the Exabeam integration:

1. From the CMA navigation menu, go to Resources > Integrations.

2. Open the Configured Integrations tab and click New.

3. Select Exabeam and the Data Export capability.

4. Enter a Name and an optional Description.

5. For Ingestion URL, paste the complete destination URL generated by Exabeam.

6. For Bearer Token, paste the collector's authentication token. Enter only the token; Cato adds the Bearer prefix.

7. Under Data sources, select Events, Flows, or both.

8. (Optionally) Configure event and flow filters to control which records are sent. See Filters.

9. Click Save.

Cato stores the token encrypted and does not display it again. Update the integration when you rotate the collector token.

Step 4: Verify Ingestion and Parsing

To verify that Cato data arrives in Exabeam:

1. In the CMA, review the integration status. Refresh the page if needed and check for authentication or destination errors.

2. In Exabeam, go to Collectors > Cloud Collectors > Overview, open the Cato collector, and confirm that it is receiving data.

3. Generate a recent Cato event or network traffic for each selected data source.

4. Use Exabeam Search to find recent Cato records by a distinctive value or the data_source field. When both sources are selected, verify records with both events and flows values.

5. Check whether Cato fields are parsed. If records remain unparsed, use Exabeam's Auto Parser Generator or Log Stream workflow to configure parsing, following Exabeam's guidance.

Filters

Use event and flow filters to limit the Cato data exported to Exabeam. This helps control ingestion volume and focus investigations on relevant activity.

Filter conditions within a group use AND logic. Separate groups use OR logic.

• Events Filter – Click Add Filter to define a condition, or Add Group to add another filter group.

• Flows Filter – Available when Flows is selected. It uses the same grouping logic as the event filter.

Filters that are too restrictive can exclude all records without reporting an error. If no data arrives, check the selected data sources and filter conditions.

Known Limitations

• Exabeam's generic Webhook Cloud Collector does not include preconfigured content support. You may need to develop a parser for Cato records.

• Exabeam limits uncompressed batch requests to 32 MB and a request duration of two minutes.

• Changes to Exabeam site metadata can take up to five minutes to appear on webhook logs.

• You cannot customize the Cato integration's request body format, content type, or authentication header.

Troubleshooting

Additional Resources

• Exabeam: Webhook Cloud Collector