Exabeam New-Scale SIEM
The cloud SIEM built around behaviour — Exabeam New-Scale SIEM pairs correlation rules with behavioural baselines and Smart Timelines, from a vendor named a 2025 Gartner MQ Leader for the sixth time.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Delivery
Cloud-native (New-Scale)
This is the cloud half of the portfolio. If your mandate rules out SaaS, LogRhythm SIEM is the self-hosted answer from the same vendor.
What to confirm
No India storage region listed
Exabeam’s documented data-residency regions are US West, US East, Singapore, Australia, Canada, Japan, Europe, Switzerland, the UK and KSA. Confirm your region in writing.
If your obligation requires data to stay in India, settle storage and processing separately with Exabeam before a proof of concept. If it rules out cloud entirely, see LogRhythm SIEM, which answers both by definition.
Quick answer
The Exabeam platform family
This page covers Exabeam New-Scale SIEM — the cloud SIEM. The other pillars:
Quick facts
30-second orientation- Product
- Exabeam New-Scale SIEM
- Vendor
- Exabeam (Thoma Bravo-backed)
- Category
- Cloud-native SIEM + log management
- Priced on
- GB ingested per day, in tiers
- Gartner MQ 2025
- Leader — Exabeam’s sixth time
- The merger
- The cloud platform Axon was retired for
- Analytics
- New-Scale Analytics ships alongside
- Deployment
- Cloud-native (LogRhythm SIEM is the on-prem half)
- Published pricing
- 2023 Americas list only; India is quoted
- In India via
- TechBag — user-count modelling, GST invoicing
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Exabeam’s cloud-native SIEM — the platform the LogRhythm merger standardised on. Collection, correlation and cases, with behavioural analytics built in rather than bolted on.
A rules-only SIEM vs Exabeam New-Scale SIEM — the honest table
What building the SIEM around behavioural analytics changes, dimension by dimension.
| Dimension | Rules-only SIEM | Exabeam New-Scale SIEM |
|---|---|---|
| Detection basis | Rules you wrote in advance | Rules plus behavioural baselines |
| Stolen credentials | Nothing malformed to match | Behaviour is wrong, so it scores |
| Investigation | Analyst queries for the timeline | Smart Timelines assembled for them |
| Pricing axis | GB/day, often with overage | GB/day tiers — filter before the meter |
| Deployment | Cloud-only, or on-prem-only | Cloud here; LogRhythm SIEM for on-prem |
| AI assistance | A generic chatbot, if any | Nova agents scoped to SOC jobs |
| Honest caveat | — | Two platforms post-merger — ask the roadmap |
| Best fit | — | UEBA-led detection in the cloud |
Behavioural detection is the edge — for the deepest content library and talent pool, Splunk still leads (TechBag sells both).
The five pieces of New-Scale SIEM
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Cloud collection
Logs from cloud, on-premises and SaaS sources flow into Exabeam’s cloud platform; licences are sized by GB per day, so filter noisy sources first.
Correlation & detection
Standard correlation and detection content, with the behavioural layer alongside rather than bolted on — so a detection can reference an entity's risk score, not only the event in front of it.
New-Scale Analytics
Behavioural baselines and dynamic risk scoring for every user and machine make detections behave differently from a purely rule-based SIEM.
Smart Timelines
An entity’s activity is reconstructed chronologically and automatically, saving analyst minutes per investigation, which scales a SOC.
Exabeam Nova
Seven AI agents scoped to named SOC jobs — threat scoring, investigation, analyst assistance, rule creation, search, advisory and visualisation — running on the New-Scale platform.
Cloud collection, rules and behavioural baselines on one platform — with Smart Timelines doing the reconstruction analysts used to do by hand.
Twelve capabilities. Collect, detect, respond.
New-Scale SIEM collects logs into Exabeam’s cloud, detects with rules and behavioural baselines together, and hands analysts an assembled timeline. Here is what sits in each layer.
Cloud log collection
Sources across cloud, on-premises and SaaS, into the cloud platform.
Ingest you choose
Licences follow daily ingest, so decide which noisy sources earn their place.
Prebuilt source content
Parsing and normalisation for common security and infrastructure sources.
Cloud retention tiers
Retention configured per your mandate rather than fixed by the licence.
Detection rules
Standard correlation content, referencing entity risk as well as events.
Behavioural baselines
What each user and machine normally does — and scored deviation from it.
Dynamic risk accumulation
Small signals accumulate on an entity until the sequence is alarming.
Smart Timelines
Entity activity reconstructed automatically, not queried for.
Investigation search
Query across collected data during an investigation.
Case management
Investigations, evidence and workflow in the platform.
Response actions
Automated and analyst-triggered response across integrations.
AI agents in the workflow
Seven agents scoped to named SOC jobs, inside the analyst workflow.
Watch Exabeam New-Scale SIEM in action
The SIEM, the platform around it, and the behavioural layer it ships with.
Exabeam SIEM Overview
The SIEM, explained by Exabeam.
The AI-Driven Exabeam Security Operations Platform
Where the SIEM sits in the platform.
Introducing New-Scale Analytics — Analyst Workflow
The behavioural layer it ships with.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Detections built on behaviour, not just rules.
Here’s what genuinely sets New-Scale SIEM apart (and where Splunk or Securonix may fit better).
A 2025 Gartner Leader, built around behaviour
Exabeam was named a Leader in the 2025 Gartner Magic Quadrant for SIEM, its sixth Leader placement, and LogRhythm had been a Leader nine times before the merger. What sets New-Scale SIEM apart is that behavioural baselines ship with it, so detections can reference an entity’s risk, not just the event.
Behavioural analytics as the product, not an add-on
New-Scale Analytics ships with the platform. With a stolen credential, a rule-based SIEM has nothing to match — the login is valid and the actions permitted. A behavioural system knows what that identity normally does and scores the deviation, so analysts work a ranked risk list instead of tuning rules.
Smart Timelines, and the minutes that actually scale a SOC
Most analyst time goes on reconstruction — what an account did, in what order, across which systems. Exabeam assembles that timeline automatically, saving minutes per investigation, which sets how many incidents a team can work. When you evaluate, time a real investigation on your own data.
Two platforms — and the on-premises one is real
The July 2024 LogRhythm merger left Exabeam with New-Scale for cloud and LogRhythm SIEM for self-hosted, with Axon retired. LogRhythm SIEM is mature, with over 1,100 prebuilt correlation rules, and self-hosting answers Indian residency questions under DPDP or RBI, SEBI and IRDAI by definition.
The honest caveat — smaller talent pool, and a fair roadmap question
Fewer people know Exabeam than Splunk or Microsoft Sentinel, which affects hiring, contractors and analyst ramp-up. Axon’s retirement also shows the company consolidates overlapping products. New-Scale and LogRhythm SIEM don’t overlap, but ask for the roadmap commitment in writing for whichever you buy.
The honest positioning
Choose New-Scale SIEM for behavioural detection as the product, with cloud acceptable and an on-premises sibling available. It is volume-metered, so filter before the meter. For the largest talent pool and content library, Splunk; for Microsoft estates, Sentinel. TechBag also sells Securonix and Elastic, in INR with GST.
The numbers behind the platform
What your Exabeam New-Scale SIEM rollout looks like
Measure your real daily ingest
The quote turns on GB per day, so measure ingest per source and decide which noisy feeds earn their tier; TechBag sizes it free.
Connect sources and baseline
Onboard log sources, then let the behavioural baselines establish. Analytics needs a period of normal activity before deviation means anything.
Tune risk, not rules
The work is calibrating which risk scores warrant attention, not writing and suppressing rules as in a rule-based SIEM.
Measure investigation minutes
Time real investigations before and after; Smart Timelines pay off as throughput, which sets how many incidents you can work.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We filtered two chatty firewall feeds before onboarding and dropped a whole ingest tier. Nobody told us to; the quote made it obvious.”
“Behavioural scoring caught an account doing permitted things at entirely the wrong hour. No rule we’d have written would fire.”
“Smart Timelines demos poorly and matters most: reconstruction used to be most of an investigation, and now it’s the starting point.”
“Honest warning: hiring is harder. Everyone has SPL on their CV. We trained internally and budgeted for the ramp.”
“We asked about the two post-merger platforms’ roadmap and got a straight answer in writing, which mattered more to our board.”
“Being able to add the analytics layer to what we already ran, rather than replacing the SIEM, made the business case survivable.”
“We priced New-Scale against two rivals at the same GB per day. The price gap was smaller than the detection gap, and that decided it.”
“As an Indian enterprise, a cloud option and a real on-prem one from the same vendor kept our options open while the mandate settled.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the SIEM and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision across the SIEM field — TechBag's synthesis, not Gartner's graphic.
2025 MQ Leader, sixth time — with a real self-hosted answer.
Detection Depth × Cost of Entry
Behavioural and detection depth against how cheaply you can start — the trade every SIEM shortlist makes.
Behavioural depth; tiered by daily ingest like most of the field.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Exabeam New-Scale SIEM vs the field
The SIEM field — honest lanes. Exabeam and Securonix lead on behavioural detection, Splunk on content and talent, Sentinel on Microsoft estates. We sell all of them.
| Dimension | Exabeam | Securonix | Splunk Enterprise Security | Microsoft Sentinel | Elastic Security |
|---|---|---|---|---|---|
| Position | UEBA-led SecOps, cloud AND self-hosted | The other UEBA-led vendor | The reference SIEM | SIEM for Microsoft estates | Search-engine-native SIEM |
| Pricing axis | GB ingested per day, tiered | GB/day, hybrid commitment + PAYG | Ingest or workload — historically costly | Per GB ingested per day | Subscription tier + resources |
| Behavioural analytics | The founding capability | The founding capability | Available, an add-on heritage | UEBA included | Entity risk scoring |
| Self-hosted option | LogRhythm SIEM — genuinely on-prem | Cloud-native only | Cloud, on-prem or hybrid | SaaS only, on Azure | Self-managed, even air-gapped |
| Analyst standing (SIEM MQ 2025) | Leader — sixth time | Leader, six times running | Leader | Leader | Visionary, not Leader |
| Augments a SIEM you own | New-Scale Analytics, licensed separately | UEBA available | Buy the platform | Buy the platform | Buy the platform |
| AI in the SOC | Nova — seven agents, named jobs | Sam, the AI SOC analyst | Cisco AI Assistant | Security Copilot + MCP | Elastic AI Assistant |
| Talent pool | Smaller than the incumbents | Smaller than the incumbents | SPL — the largest by far | KQL — widely known | Large for the engine, smaller for security |
| The thing to plan around | Two platforms post-merger — ask the roadmap | Cloud-only; model the GB/day | Cisco integration reshaping roadmap | Azure portal retires 31 Mar 2027 | You operate it unless you buy Cloud |
| Best fit | UEBA-led detection — cloud or on-prem | UEBA-led with Leader standing | Engineers who will build with it | Microsoft-standardised estates | Air-gapped, or existing ELK |
Does Exabeam New-Scale SIEM fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Exabeam if…
- ✓You want behavioural detection at the core of the SIEM, from a 2025 Gartner MQ Leader
- ✓You need behavioural analytics rather than more rules, and you want the vendor that built on it
- ✓Your mandate rules out cloud — LogRhythm SIEM is a genuine self-hosted platform, not a retrofit
- ✓You want to add analytics to a SIEM you already own rather than replace it
Choose Securonix if…
- ✓You want the other UEBA-led vendor, with six consecutive Gartner MQ Leader placements — and cloud-native suits you
Choose Splunk if…
- ✓You have engineers who will build with it, and you want the deepest content and the largest talent pool (TechBag sells it)
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 and Defender — Sentinel sits closest to that data, and TechBag sells it
Choose Elastic Security if…
- ✓You need air-gapped deployment, or your engineers already run Elasticsearch
Exabeam New-Scale SIEM is one of 36 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What does your daily ingest cost — and what does growth add?
Exabeam’s own Americas price list (effective 1 August 2023) sells the SIEM as one-year subscriptions sized by GB ingested per day. Set today’s volume and your expected growth to see the list price at your tier, and what growth adds by year three. A dated US list converted to rupees — not an India quote.
Log volume grows on its own — new SaaS, chattier applications, richer endpoint telemetry. The lever you control is what reaches the meter: filter sources with no detection value before onboarding them, and ask what happens if you outgrow a tier mid-term. Converted at ₹84/US$, before any discount; TechBag models the real India quote.
Three ways to consume it
Exabeam does not publish an India price. Its own Americas list (effective 1 August 2023) sells the SIEM as one-year subscriptions sized by GB ingested per day — US$36,000 a year up to 50 GB/day, before discount. So the number that decides your quote is daily ingest: measure it per source and filter what has no detection value. TechBag sizes it and quotes in INR with GST.
New-Scale SIEM
Best for cloud-capable estates
- 2023 US list: $36,000/yr up to 50 GB/day
- Log management, correlation, search and cases
- The cloud platform the LogRhythm merger standardised on
New-Scale Fusion
Best when you want UEBA too
- 2023 US list: $51,000/yr up to 50 GB/day
- Behavioural baselines and dynamic risk scoring
- Analytics can also be bought alone for another SIEM
+ Exabeam Nova
Best for stretched analysts
- Seven agents scoped to named SOC jobs
- Runs on the New-Scale platform
- Test it on your own alert queue, not a demo
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every cloud SIEM vendor
Take this into your next vendor call — including ours.
What is our real GB/day per source — and which sources would we filter before the meter?
What happens if we outgrow our GB/day tier mid-term — overage, true-up or a forced upgrade?
Cloud or on-premises? That decides New-Scale versus LogRhythm SIEM before any feature comparison.
If your log platform is fine and its alerts are not trusted, New-Scale Analytics on your existing SIEM is a much smaller purchase.
Two platforms after a merger — ask where investment goes for the one you are buying, in writing.
Who will run it? The Exabeam talent pool is smaller than Splunk's or Microsoft's — budget the ramp honestly.
Behavioural analytics needs normal activity before deviation is meaningful. Plan the evaluation long enough to see that.
Quote-only with no published list — have you modelled it in INR with GST?
Questions buyers ask
Ready to evaluate Exabeam New-Scale SIEM?
Size your daily ingest honestly, decide cloud or self-hosted, or get an honest Exabeam-vs-Securonix comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.