Exabeam
The UEBA-led security operations vendor — cloud-native New-Scale for SIEM and behavioural analytics, self-hosted LogRhythm SIEM for mandates that rule out SaaS, and Nova’s AI agents on top. A 2025 Gartner MQ Leader. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Four intel pages. Two platforms, one behavioural core.
The Exabeam portfolio on TechBag — every linked card is a full intel page, from the cloud SIEM to the self-hosted one.
Exabeam New-Scale SIEM
The cloud platform the merger standardised on.
Cloud-native SIEM with search, correlation and case management; the platform the LogRhythm merger standardised on, sized by GB/day.
Exabeam New-Scale Analytics
The reason people buy Exabeam.
Behavioural baselines and risk scores for every user and machine, sold to augment a SIEM you already run, not only within New-Scale.
Exabeam Nova
Seven agents with named SOC jobs.
AI agents for threat scoring, investigation, rule creation, search and more, on New-Scale; LogRhythm customers reach it via an add-on.
LogRhythm SIEM
The on-premises half of the portfolio.
The self-hosted SIEM, on-premises only since the merger, with 1,100+ prebuilt correlation rules and a long record in regulated estates.
Agent Behavior Analytics
Platform & engineBehavioural monitoring for AI agents and non-human identities
NetMon
Platform & engineNetwork monitoring, on cloud and self-hosted
Exabeam sells across 4 of the products TechBag carries in security. The Security guide shows how the category splits and which part is yours. →
Why “behaviour, not signatures” is the whole story
A rule only catches what somebody thought to write down. A stolen credential does nothing malformed — it signs in correctly, from a plausible place, and does permitted things. Exabeam bet on baselining every user and machine and scoring the deviation— and after the 2024 LogRhythm merger it offers that in the cloud on New-Scale and, through a hybrid add-on, to self-hosted LogRhythm SIEM estates.
Behaviour, not signatures
A rule catches what you predicted; a baseline catches what you didn’t. Exabeam scores deviation from normal per user and machine, so a stolen-but-valid credential surfaces.
Two platforms, deliberately
After the LogRhythm merger, New-Scale is the cloud platform and LogRhythm SIEM the self-hosted one, with Axon retired — a mature product for each deployment model.
A 2025 Gartner Leader
Named a Leader for the sixth time in Gartner’s 2025 SIEM quadrant; LogRhythm had been a Leader nine times before the merger. Judge detections on your own data.
Analytics you can buy separately
New-Scale Analytics can sit on a SIEM you already own, adding the behavioural layer without a migration when the problem is untrusted alerts, not the log platform.
The roadmap question is fair
Two platforms after a merger raise the question of where investment goes, and Axon’s retirement shows Exabeam consolidates overlaps. Get the roadmap in writing.
Start with the deployment question — New-Scale in the cloud or LogRhythm SIEM on your own infrastructure — then add behavioural analytics and Nova where they earn their place.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
Leader, 2025
Exabeam’s sixth Leader placement
Google Cloud Partner of the Year 2026
Security: Analytics & Operations — third such award
July 2024
Completed under Thoma Bravo; a pure-play SecOps vendor
UEBA heritage
The behavioural-analytics name for a decade
1,100+ correlation rules
Prebuilt content in LogRhythm SIEM
Recorded Future partnership
Threat intelligence embedded into New-Scale
Two deployment answers
Cloud-native AND genuinely self-hosted
Thoma Bravo backing
Private-equity owned, security-focused
The company in six figures
See the platform, hear the pitch
The AI-Driven Exabeam Security Operations Platform Overview
The platform, explained by Exabeam.
Exabeam SIEM Overview
The SIEM side of the portfolio.
Introducing New-Scale Analytics — Analyst Workflow
What behavioural analytics looks like in the workflow.
Where Exabeam sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Exabeam Across Its Platform
Each dot is an Exabeam product: competitive position vs category momentum.
The cloud platform the merger standardised on.
The Detection × Deployment Map
Detection and analytics depth against whether you can run it in the cloud AND on your own infrastructure.
The UEBA name, with a genuine self-hosted answer alongside the cloud one.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Exabeam?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is the most pressing problem?
2. What does your deployment mandate allow?
3. What do you most need from the next purchase?
What is UEBA, and why does it matter?
Rules catch what you predicted. Baselines catch what you did not — including a valid credential in the wrong hands.
Read →Two platforms after a merger — which is yours?
New-Scale is cloud, LogRhythm SIEM is self-hosted. The choice is your deployment mandate, not a feature comparison.
Read →Sizing a SIEM by daily ingest
Exabeam’s list prices its cloud SIEM by GB per day — why filtering sources before the meter is the lever that matters.
Read →Adding analytics to a SIEM you already own
New-Scale Analytics can augment an existing SIEM — a much smaller decision than replacing one.
Read →What agentic AI actually does in a SOC
Seven agents scoped to specific jobs, rather than one assistant that claims everything.
Read →Exabeam vs Securonix vs Splunk
The honest matrix — two UEBA-led vendors against the content incumbent.
Read →The acronym decoder
Every term on these pages, in one place- UEBA
- User and Entity Behaviour Analytics: baselining normal user and machine activity and scoring deviation, not rules.
- New-Scale
- Exabeam’s cloud-native platform, the cloud standard after the LogRhythm merger.
- New-Scale Analytics
- The behavioural analytics and risk-scoring engine, inside New-Scale or added to a SIEM you run.
- LogRhythm SIEM
- The self-hosted SIEM, now exclusively on-premises following the merger, with 1,100+ prebuilt correlation rules.
- Axon
- LogRhythm’s cloud SIEM, retired after the merger for New-Scale; mentions of it predate the change.
- Exabeam Nova
- The agentic AI suite: threat scoring, investigation, analyst assistant, rule creation and search agents.
- Dynamic risk scoring
- Adding up small signals on one entity so a sequence of unremarkable events becomes alarming.
- GB/day tier
- The daily ingest volume an Exabeam cloud subscription covers, per its 2023 Americas price list.
- Smart Timelines
- An entity’s activity rebuilt in time order, assembled automatically by Exabeam instead of queried by an analyst.
- Thoma Bravo
- The private-equity firm backing Exabeam, and the owner that brought the LogRhythm merger about.
- Agent Behavior Analytics
- Behavioural monitoring for AI agents and non-human identities, an emerging need as agents get credentials.
- Pure-play SecOps
- How the merged company positions itself: security operations only, rather than a security portfolio with a SIEM in it.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Settle deployment before anything else
Cloud or on-premises decides which half of the portfolio you are buying, and it is not a preference — it is usually a mandate. Everything after this depends on it.
Measure daily ingest, source by source
Exabeam’s 2023 Americas list sizes cloud subscriptions by GB/day. Measure volume per source and filter low-value logs before the meter; that sets your tier.
Decide whether you are replacing or augmenting
New-Scale Analytics can sit on your existing SIEM. If the log platform is fine and detections are the problem, that beats a migration.
Ask the roadmap question directly
Ask where investment goes for the platform you are buying, and get it in writing. Axon’s retirement shows they consolidate where products overlap.
Test the AI on your own alerts
Nova’s agents are scoped to real SOC jobs, a good sign. Still, run them on your own noisy alerts during evaluation, not a curated demo.
Get it quoted in INR with GST
Pricing is quote-only. TechBag scopes the platform fit and the ingest tier, and quotes locally with GST-compliant invoicing.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| New-Scale SIEM | One-year subscription sized by GB ingested per day | 2023 US list: $36,000/yr up to 50 GB/day | Cloud-capable estates |
| New-Scale Analytics | GB per day; can augment a third-party SIEM | 2023 US list: $31,000/yr up to 50 GB/day | SIEMs whose alerts nobody trusts |
| Exabeam Nova | Licensing not published — quote-only | On New-Scale; LogRhythm via cloud-hybrid add-on | Triage backlogs, proven in a trial |
| LogRhythm SIEM | Subscription or perpetual, unlimited-data model | You supply and run the infrastructure | Mandates that rule out SaaS |
Cloud subscriptions are sized by GB ingested per day on Exabeam’s 2023 Americas list; LogRhythm SIEM is subscription or perpetual on an unlimited-data model. India pricing is quote-based. TechBag sizes your ingest source by source and quotes in INR with GST.
Five pitfalls that cost buyers quarters
Reading a pre-2024 comparison
Anything before the July 2024 merger describes two separate companies, and any mention of LogRhythm Axon describes a retired product. Much of it still ranks well, so check the date.
Trusting per-user pricing write-ups
Older material cites per-user licensing, but Exabeam’s 2023 Americas price list sizes cloud SIEM by GB ingested per day. Bring a per-source ingest measurement, not a headcount.
Assuming on-prem means second-class
LogRhythm SIEM is a mature product with 1,100+ prebuilt rules, not a hosted product retrofitted for on-premises. The fair question is roadmap investment, not capability today.
Buying the platform when you needed the layer
If your SIEM works and its detections do not, New-Scale Analytics on top of what you have is the smaller, cheaper and faster answer. Vendors rarely volunteer the smaller sale.
Taking AI productivity claims on trust
Agentic AI in the SOC is the whole market's current claim. Nova's agents being scoped to named jobs is a good sign, but the only evidence that counts is what they do to your alert queue during the trial.
The evaluation kit
Each product page carries an 8-question vendor checklist and a cost model:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Growth rates are TechBag’s reading of public analyst forecasts, not audited figures. SOC automation is the fastest-growing line — the market Exabeam Nova competes in.
Agentic AI in the SOC
Every SIEM vendor is now shipping agents.
What it means for you
Track whether agents are scoped to named jobs or sold as general intelligence.
UEBA as the differentiator again
As detection content commoditises, vendors compete on behavioural analytics, suiting the two built on it.
What it means for you
Compare SIEMs on UEBA depth, not on detection-rule counts.
Post-merger consolidation
Axon's retirement is the pattern: overlapping products get consolidated and the survivor gets the investment.
What it means for you
Expect more of this across the category.
Non-human identity monitoring
AI agents are getting credentials, and nobody has baselines for them.
What it means for you
Agent Behavior Analytics is an early move at a problem that is about to be large.
On-prem demand is not going away
Regulated buyers in India and elsewhere still cannot use SaaS, while credible self-hosted SIEM vendors keep dwindling.
What it means for you
If SaaS is ruled out for you, shortlist the self-hosted options early.
Ingest filtering as cost control
Every volume-metered SIEM rewards dropping low-value logs before they reach the meter.
What it means for you
Expect pipeline and filtering decisions to become part of the SIEM purchase itself.
Questions buyers ask about Exabeam
Ready to shortlist Exabeam?
Open any of the four product pages for the deep dive, or let a TechBag advisor build the case with you — platform fit, ingest sizing, honest comparisons, rollout, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.