Summary

• Adds comprehensive Exabeam New-Scale platform integration with three output types
• Implements EQL query generation with proper syntax validation
• Provides Analytics and Correlation rule export in JSON format compatible with New-Scale import
• Includes CTI support for IOC-based threat hunting queries

Implementation Details

• EQL Search Query: Generates copy-paste ready search strings using proper EQL syntax (AND/OR/NOT operators, RGX() for regex)
• Analytics Rule: JSON export with MITRE ATT&CK mapping, rule family classification, and fact feature configuration
• Correlation Rule: JSON export with multi-condition support and technique extraction
• CTI Support: IOC translation for IPs, hashes, domains, URLs, and file names

Technical Features

• CIM2 field mapping from Sigma to Exabeam fields (60+ mappings)
• Dynamic MITRE technique extraction from rule metadata
• Proper string quoting and character escaping for EQL syntax
• Rule family inference based on MITRE techniques
• Compatible JSON format for seamless New-Scale import

Testing

• Validated EQL syntax against New-Scale UI requirements
• Confirmed Analytics and Correlation rule JSON import functionality
• Verified field mapping accuracy with Windows process creation events
• Tested with various Sigma rule types including process creation and network events

Files added:

• Platform implementation:uncoder-core/app/translator/platforms/exabeam/
• Field mappings:uncoder-core/app/translator/mappings/platforms/exabeam/
• Platform registration inplatform_details.py

All changes follow Uncoder architecture patterns and comply with contribution guidelines.