Connect Q-Feeds to Exabeam

Available indicator lists (CSV)

• Malware IPs: feed_type=malware_ip&type=csv
• Malware domains: feed_type=malware_domains&type=csv
• Phishing URLs: feed_type=phishing_urls&type=csv

URL parameters: feed_type, optional limit, api_token, and type=csv. Example:

https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN&limit=130000&type=csv

Test with:

curl -v -u api_token:YOUR_TOKEN "https://api.qfeeds.com/api?feed_type=malware_ip&limit=1000&type=csv"

Create a context table

1. Go to Context Management and select New table.
2. Choose Add Custom, set a name, and choose table type Other.
3. Select Add attributes → Add Custom Attribute (for example bad_ips, bad_domains or bad_urls).
4. Assign that attribute as the key attribute.

Create an Exabeam API key

1. Open admin settings → API keys and create a new key.
2. Grant the manage context permission.
3. Use the three-dot menu on the new key → Generate and copy token. Store the token securely.

Get context table metadata

1. Open the Exabeam developers reference for listing tables (GET /context-management/v1/tables).
2. Paste your Exabeam access token, select the correct regional base URL, and try the request.
3. Find your custom table in the response and copy the table ID and the attribute ID for the key attribute. You need both in the next step.

Add records from CSV

1. Use the Exabeam API POST …/tables/{id}/addRecordsFromCsv.
2. Set the path/table ID to your context table ID.
3. Set sourceAttributes to IP, domain or url depending on the feed.
4. Set targetAttributeIds to the attribute ID from the metadata.
5. Set operation to replace.
6. Upload the CSV body from Q-Feeds (pipe or download with type=csv).

Exabeam’s API explorer can generate client snippets in several languages. Schedule the same call every 20 minutes to keep the table current.

Example: shell

curl --request POST \
  --url "https://api.eu.exabeam.cloud/context-management/v1/tables/<your-table-id>/addRecordsFromCsv" \
  --header 'accept: application/json' \
  --header 'authorization: Bearer <your-exabeam-token>' \
  --header 'content-type: multipart/form-data' \
  --form 'sourceAttributes=IP' \
  --form 'targetAttributeIds=<your-attribute-id>' \
  --form operation=replace \
  --form file=@<(curl "https://api.qfeeds.com/api.php?feed_type=malware_ip&api_token=<yourtoken>&type=csv")

Adjust the regional Exabeam base URL and placeholders for your tenant.

Example: Python

import io
import requests

qfeed_url = "https://api.qfeeds.com/api.php?feed_type=malware_ip&api_token=<yourtoken>&type=csv"
qfeed_csv = requests.get(qfeed_url).content

url = "https://api.eu.exabeam.cloud/context-management/v1/tables/<your-table-id>/addRecordsFromCsv"
payload = {
    "sourceAttributes": "IP",  # or domain / url
    "targetAttributeIds": "<your-attribute-id>",
    "operation": "replace",
}
files = {"file": ("feed.csv", io.BytesIO(qfeed_csv), "text/csv")}
headers = {
    "accept": "application/json",
    "authorization": "Bearer <your-exabeam-token>",
}
print(requests.post(url, data=payload, files=files, headers=headers).text)

Download the PDF manual