Exabeam
UEBA-first SIEM that auto-builds the incident timeline
Overview
A cloud-native SIEM whose calling card is user and entity behavior analytics and machine-built incident timelines. Aimed at mid-to-large SOCs and MSSPs replacing legacy log tools.
What you can produce with Exabeam
- User and entity behavior analytics (UEBA)
- Smart Timelines that auto-reconstruct incident event chains
- New-Scale cloud-native SIEM
- LogRhythm on-prem / private-cloud SIEM (post-merger)
- Threat detection, investigation and response (TDIR) workflows
- SOAR-style automated response
- Hundreds of prebuilt log-source integrations
- User/device-based pricing (not log-volume metered)
ASEAN Perspective
Exabeam in Southeast Asia
ASEAN-region availability and pricing notes coming soon. Drop the editorial team a note via /contact/ if you can supply local context (Singapore/Malaysia/Indonesia/Thailand/Vietnam).
Exabeam's edge has always been behavior analytics and its Smart Timelines, which stitch scattered log events into one readable incident story so an analyst isn't manually piecing together who did what. The 2024 all-stock merger with LogRhythm turned it into a pure-play SIEM outfit: New-Scale is the cloud future, LogRhythm's on-prem SIEM stays for regulated shops that can't go cloud, and the overlapping Axon product is being retired. Gartner still names Exabeam a Leader for SIEM. This is a product for teams with real SOC staff and budget, not a small business. Pricing is quote-based on users and devices rather than log volume, which some find kinder than volume-metered rivals, but it's still expensive and setup can feel heavy. If you're weighing it against Splunk or Microsoft Sentinel and you value UEBA, it belongs on the shortlist. If you want cheap and simple, look elsewhere.
What people say
Exabeam has been around since 2013 and pioneered UEBA more than a decade ago. Its market position shifted hard in 2024 when it and LogRhythm announced an all-stock merger in May and closed it in July, forming a combined SIEM pure-play under the Exabeam brand. The plan: standardize on Exabeam's New-Scale cloud SIEM (which had traction since its October 2022 debut), keep LogRhythm's on-prem/private-cloud SIEM for buyers who need it, and retire LogRhythm's competing Axon platform.
Reviewers rate it solidly. Exabeam New-Scale Fusion carries 4.4 stars across 258 Gartner Peer Insights reviews; LogRhythm SIEM sits at 4.3 stars over 723 reviews. On PeerSpot the average is 7.8 out of 10. Gartner's SIEM Magic Quadrant named Exabeam a Leader and LogRhythm a Niche Player, and Exabeam ranks near the top of UEBA-specific solution lists.
What users praise most is the timeline work. Smart Timelines automatically reconstruct the events underlying an incident, and reviewers repeatedly call timeline creation from log sources the most valuable feature for investigations. The interface gets described as surprisingly user-friendly for a SIEM.
The common gripes are setup and cost. Several buyers find the initial deployment overwhelming, and pricing is a recurring concern for smaller organizations. Exabeam's pitch on price is that it doesn't meter on log volume the way most SIEM vendors do; instead pricing is based on the number of users and/or devices, which it argues makes budgeting more predictable. It's still generally viewed as a mid-to-high expense, with most raters putting cost around six to seven out of ten.
Net: a credible Splunk/Sentinel alternative for mature SOCs and MSSPs, particularly ones that want behavior analytics baked in rather than bolted on. The merger also matters for existing LogRhythm customers, who get a migration path to New-Scale rather than a stranded product, though the Axon wind-down means some near-term roadmap uncertainty. Regional buyers should confirm hosting and data-residency specifics per deployment, as those aren't published.
Summary of public user & expert reviews, compiled by RECATOOLS.
About this listing
This entry was compiled from publicly available data including Exabeam's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Exabeam unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Exabeam directly →
Spotted something out of date? Suggest an update →
More in Security & Safety
