- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Exabeam New-Scale Analytics
The layer that catches a valid credential in the wrong hands — Exabeam New-Scale Analytics baselines every user and machine and scores the deviation, and it can run on a SIEM you already own.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Delivery
Cloud-native (New-Scale)
This is the cloud half of the portfolio. If your mandate rules out SaaS, LogRhythm SIEM is the self-hosted answer from the same vendor.
What to confirm
No India storage region listed
Exabeam’s documented data-residency regions are US West, US East, Singapore, Australia, Canada, Japan, Europe, Switzerland, the UK and KSA. Confirm your region in writing.
If your obligation requires data to stay in India, settle storage and processing separately with Exabeam before a proof of concept. If it rules out cloud entirely, see LogRhythm SIEM, which answers both by definition.
Quick answer
The Exabeam platform family
This page covers Exabeam New-Scale Analytics — the UEBA engine. The other pillars:
Quick facts
30-second orientation- Product
- Exabeam New-Scale Analytics (UEBA)
- Vendor
- Exabeam (merged with LogRhythm, July 2024)
- Ownership
- Thoma Bravo · CEO Pete Harteveld
- The key option
- Can augment a SIEM you already own
- Augments
- Splunk, Sentinel, QRadar, OpenText ESM
- Priced on
- GB ingested per day, in tiers
- Gartner MQ 2025
- Exabeam a Leader — sixth time
- Published pricing
- 2023 Americas list only; India is quoted
- Prerequisite
- Clean identity data — AD and HR feeds
- In India via
- TechBag — scoping, GST invoicing
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
The behavioural analytics engine — baselines for every user and machine, and dynamic risk scoring on deviation. The capability Exabeam is actually known for.
A rules-only SIEM vs Exabeam New-Scale Analytics — the honest table
What adding behavioural analytics changes, whether on New-Scale or on the SIEM you already own.
| Dimension | Rule-based detection alone | Exabeam New-Scale Analytics |
|---|---|---|
| Detection basis | Rules you wrote in advance | Baselines per user, host and service account |
| Stolen credentials | Nothing malformed to match | Deviation accumulates into a risk score |
| Existing SIEM | Rip and replace to get UEBA | Feed Splunk, Sentinel or QRadar data across |
| Alert volume | Every anomaly fires on its own | Weak signals surface only when they add up |
| Investigation | Pivot across consoles | Smart Timelines assembled automatically |
| Pricing axis | Bundled into the SIEM price | Daily-ingest tiers, alone or in Fusion |
| Honest caveat | — | Weeks of baselining; overlay adds to SIEM spend |
| Best fit | — | SIEMs that work, alerts nobody trusts |
Analytics on the SIEM you keep is the edge — if the log platform itself is failing, fix that first (TechBag sells replacements too).
The five pieces of New-Scale Analytics
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Data ingestion
Logs arrive from Exabeam's collectors or from the SIEM you already run, parsed into a common schema. In augmentation mode you do not restructure your existing pipeline — data is fed across without reconfiguring what feeds your current SIEM.
Entity resolution
Disparate identifiers — AD account, email, VPN username, cloud IAM principal, hostname — stitched into one entity. The least visible and most decisive component: behavioural analytics on unresolved identities produces confident nonsense.
Behavioural models
Statistical and ML models profile normal for each user, peer group, host and service account across hundreds of dimensions — logon times, geographies, data volumes, privilege use. Models retrain as behaviour legitimately drifts.
Dynamic risk scoring
Individual anomalies rarely justify an investigation; accumulated ones do. Weighted risk aggregates per entity, adjusted by business context — a domain admin's anomaly should outrank a contractor's identical one.
Threat Center
When an entity crosses a threshold, evidence is collected, correlated and enriched into a Smart Timeline the analyst reads top to bottom, rather than reconstructing across consoles.
Entity resolution, baselines and risk scoring over data from New-Scale or your existing SIEM — ending in a timeline an analyst reads, not rebuilds.
Twelve capabilities. Resolve, baseline, score.
New-Scale Analytics resolves identities, learns normal behaviour for each one, and accumulates risk until an entity is worth an analyst’s time. Here is what sits in each layer.
Bring your own SIEM
Feeds from Splunk, Sentinel, QRadar and OpenText ESM (formerly ArcSight) without rebuilding your pipeline.
Common schema parsing
Heterogeneous sources parsed into one schema so behaviour is comparable across systems.
Entity resolution
Accounts, hostnames, emails and cloud principals stitched into single resolved identities.
Business enrichment
HR, asset criticality and org data layered on so scoring reflects real business risk.
Behavioural profiling
Learns normal per user, peer group, host and service account across hundreds of dimensions.
Dynamic risk scoring
Weighted risk accumulates per entity so weak signals surface only once they collectively matter.
Insider threat detection
Credential misuse, data staging and privilege abuse that rule-based detection routinely misses.
Lateral movement
Anomalous authentication chains across hosts, exposing movement after initial compromise.
Agent Behavior Analytics
Behavioural baselining applied to AI agent activity — tool use and data egress.
Smart Timelines
A readable chronological session narrative, so analysts stop pivoting between consoles.
AI agent assistance
Agents handle case summaries, natural-language search and dashboards.
Coverage reporting
Detection coverage mapped to MITRE ATT&CK, with gaps stated in language a board follows.
Watch Exabeam New-Scale Analytics in action
Behavioural analytics in the analyst workflow, and the platform around it.
Introducing New-Scale Analytics — Analyst Workflow
Behavioural analytics in the analyst workflow.
The AI-Driven Exabeam Security Operations Platform
Where analytics sits in the platform.
Exabeam SIEM Overview
The SIEM it can run inside — or beside.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Better detections without a SIEM migration.
Here’s what genuinely sets New-Scale Analytics apart (and where Securonix or Sentinel’s own UEBA may fit better).
It buys detection quality without a SIEM migration
The most useful thing about New-Scale Analytics is that you can license it against a SIEM you already own. Most organisations unhappy with their SIEM are not unhappy with its log storage — they are unhappy that it only catches what someone wrote a rule for. Replacing a SIEM is a multi-quarter project: re-onboarding every log source, rewriting detections, retraining analysts, renegotiating a large contract. Augmenting one is a fraction of that. You keep Splunk or Sentinel or QRadar doing the unglamorous work it does adequately, and add a behavioural layer that finds what rules structurally cannot. For an enterprise three years into a Splunk deployment, with a CISO who wants better insider-threat coverage and a CFO who will not fund a rip-and-replace, this is the version of the project that actually gets approved. It is also a materially smaller commercial commitment, which changes who has to sign.
Risk scoring attacks alert volume at the right end
Most alert-fatigue solutions are triage — sorting a flood after it arrives. Behavioural risk scoring works earlier. Individual anomalies are usually meaningless: people travel, projects change, someone genuinely does need the customer database on a Friday night. A rule-based system fires on each and drowns the analyst. Risk scoring accumulates weighted deviation against an entity and surfaces it only when the total crosses a threshold, so the analyst sees one enriched entity worth investigating rather than forty events to dismiss. Multi-layer scoring with business context means a domain administrator's anomaly outranks a contractor's identical one. Exabeam publishes alert-volume reductions up to 60 percent; treat that as a vendor figure, because the real reduction depends entirely on how noisy your baseline is and how much tuning you invest. The mechanism, though, is the correct one.
Smart Timelines change what tier-one analysts actually do
The dominant cost in a SOC is not detection, it is investigation. An analyst receiving an alert pivots across the SIEM, the EDR console, the identity provider, the DLP tool and a spreadsheet of asset owners to assemble what happened. That reconstruction is repetitive, slow, and where most analyst hours vanish. Smart Timelines do it automatically — the session arrives as a chronological narrative with evidence already correlated and enriched. The analyst reads rather than assembles. For teams running follow-the-sun SOCs or MSSP arrangements where tier-one turnover is high, this materially lowers the skill floor for useful triage. It also fixes handover: a timeline is a document a new analyst can pick up, where a half-finished pivot across six tools is not.
Overlay pricing follows what you send it
Security Analytics is sold in daily-ingest tiers — Exabeam’s 2023 Americas list starts at US$31,000 a year for up to 50 GB/day. That shapes an overlay deployment usefully: you do not have to send everything your SIEM holds. Identity, authentication, VPN, endpoint and cloud-control-plane logs carry most of the behavioural signal; bulky firewall and debug logs mostly do not. Scope the feed to the sources that describe people and machines, and the analytics bill tracks detection value rather than total log volume. It still adds to your SIEM spend rather than replacing it, and we would be misleading you to imply otherwise.
The honest caveats — where this will frustrate you
Five things worth knowing before you commit. Baselining takes time: UEBA cannot score deviation until it knows normal, so expect weeks before output is trustworthy, and treat any promise of immediate value as a warning about the salesperson. Tuning is ongoing work, not a phase — every real environment produces benign anomalies, and suppressing them without suppressing real threats needs a named owner; deployments that disappoint almost always disappoint here. Identity data quality is a prerequisite you must meet yourself: stale AD accounts and unreliable HR feeds degrade entity resolution, and the models inherit that. In augmentation mode you pay for both products — this adds to your SIEM spend rather than displacing it. And Exabeam is still integrating the LogRhythm merger, so ask for written roadmap commitments for whichever line you buy.
The honest positioning
Choose New-Scale Analytics when your detection gap is behavioural — insider threat, credential misuse, lateral movement, accounts that look legitimate because the credentials are — and especially when you own a SIEM you are not ready to replace. The augmentation licence is the strongest reason to shortlist it. Do not choose it if what you need is a SIEM: this is a detection layer and something must still collect and retain. Do not choose it if you need value inside a quarter. Be cautious if your identity data is in poor shape, because that is a prerequisite rather than something the product fixes. If you want a single cloud-native platform with no self-hosted legacy line, Securonix is the more direct comparison and a legitimate winner — TechBag sells it and will say so. If your SOC is small and Microsoft-centric, Sentinel's own UEBA may be sufficient and cheaper.
The numbers behind the platform
What your Exabeam New-Scale Analytics rollout looks like
Decide augment or replace
Establish whether your gap is detection quality or log management — that determines which licence you buy. Audit what your SIEM catches and what it structurally cannot. Inventory identity data quality honestly.
Connect the data
Feed from your existing SIEM or Exabeam collectors, confirm parsing across sources, and validate entity resolution against known users. In augmentation mode you should not be rebuilding pipelines.
Let the models learn
Behavioural models need observation before scoring means anything. Resist acting on early scores. Use the window to layer business context — asset criticality, HR attributes, privileged groups.
Make it trustworthy
Suppress benign anomalies, calibrate thresholds, build workflows around Smart Timelines. Assign a named platform owner. This phase does not end — it becomes routine operational work.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We kept Splunk and bought Analytics on top. That was the only version of this project our board would have approved — a SIEM replacement was never getting funded.”
“Smart Timelines cut our tier-one investigation time by more than half. Analysts read a narrative instead of assembling one across five consoles.”
“The risk scoring genuinely surfaces things our rules never would. An account doing six mildly odd things is invisible to a rule engine and obvious here.”
“We sent only identity, VPN and endpoint logs across from Splunk. That kept the analytics tier small and still covered what we cared about.”
“Good product, but nobody told us how much tuning it needs. The first two months were noisy and we nearly gave up before it settled. Budget a dedicated owner or do not start.”
“Nova's investigation summaries are useful for shift handovers. Not magic, but it saves each analyst real time every day.”
“Insider threat was our driver. We found two cases of data staging in the first quarter that our previous stack had no mechanism to catch.”
“Our AD hygiene was worse than we admitted and entity resolution exposed it immediately. Painful, but the cleanup was overdue and the models improved sharply afterwards.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the UEBA and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision across the SIEM field — TechBag's synthesis, not Gartner's graphic.
2025 MQ Leader, sixth time — with a real self-hosted answer.
Detection Depth × Cost of Entry
Behavioural and detection depth against how cheaply you can start — the trade every SIEM shortlist makes.
Behavioural depth; tiered by daily ingest like most of the field.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Exabeam New-Scale Analytics vs the field
The UEBA field — honest lanes. Securonix is the closest rival, and Sentinel’s bundled UEBA may be enough for Microsoft shops. Exabeam’s edge is overlaying the SIEM you keep. We sell all three.
| Dimension | Exabeam | Securonix | Splunk Enterprise Security | Microsoft Sentinel | Elastic Security |
|---|---|---|---|---|---|
| Position | UEBA-led SecOps, cloud AND self-hosted | The other UEBA-led vendor | The reference SIEM | SIEM for Microsoft estates | Search-engine-native SIEM |
| Pricing axis | GB ingested per day, tiered | GB/day, hybrid commitment + PAYG | Ingest or workload — historically costly | Per GB ingested per day | Subscription tier + resources |
| Behavioural analytics | The founding capability | The founding capability | Available, an add-on heritage | UEBA included | Entity risk scoring |
| Self-hosted option | LogRhythm SIEM — genuinely on-prem | Cloud-native only | Cloud, on-prem or hybrid | SaaS only, on Azure | Self-managed, even air-gapped |
| Analyst standing (SIEM MQ 2025) | Leader — sixth time | Leader, six times running | Leader | Leader | Visionary, not Leader |
| Augments a SIEM you own | New-Scale Analytics, licensed separately | UEBA available | Buy the platform | Buy the platform | Buy the platform |
| AI in the SOC | Nova — seven agents, named jobs | Sam, the AI SOC analyst | Cisco AI Assistant | Security Copilot + MCP | Elastic AI Assistant |
| Talent pool | Smaller than the incumbents | Smaller than the incumbents | SPL — the largest by far | KQL — widely known | Large for the engine, smaller for security |
| The thing to plan around | Two platforms post-merger — ask the roadmap | Cloud-only; model the GB/day | Cisco integration reshaping roadmap | Azure portal retires 31 Mar 2027 | You operate it unless you buy Cloud |
| Best fit | UEBA-led detection — cloud or on-prem | UEBA-led with Leader standing | Engineers who will build with it | Microsoft-standardised estates | Air-gapped, or existing ELK |
Does Exabeam New-Scale Analytics fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Exabeam if…
- ✓You want behavioural detection at the core of the SIEM, from a 2025 Gartner MQ Leader
- ✓You need behavioural analytics rather than more rules, and you want the vendor that built on it
- ✓Your mandate rules out cloud — LogRhythm SIEM is a genuine self-hosted platform, not a retrofit
- ✓You want to add analytics to a SIEM you already own rather than replace it
Choose Securonix if…
- ✓You want the other UEBA-led vendor, with six consecutive Gartner MQ Leader placements — and cloud-native suits you
Choose Splunk if…
- ✓You have engineers who will build with it, and you want the deepest content and the largest talent pool (TechBag sells it)
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 and Defender — Sentinel sits closest to that data, and TechBag sells it
Choose Elastic Security if…
- ✓You need air-gapped deployment, or your engineers already run Elasticsearch
Exabeam New-Scale Analytics is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What does your daily ingest cost — and what does growth add?
Exabeam’s own Americas price list (effective 1 August 2023) sells Security Analytics as one-year subscriptions sized by GB ingested per day. In overlay mode you choose what to send, so set the volume of identity, VPN, endpoint and cloud logs you would feed it. A dated US list converted to rupees — not an India quote.
Log volume grows on its own — new SaaS, chattier applications, richer endpoint telemetry. The lever you control is what reaches the meter: filter sources with no detection value before onboarding them, and ask what happens if you outgrow a tier mid-term. Converted at ₹84/US$, before any discount; TechBag models the real India quote.
Three ways to consume it
Sold in daily-ingest tiers like the rest of the portfolio — Exabeam’s 2023 Americas list starts Security Analytics at US$31,000 a year for up to 50 GB/day. The commercially important option here is that Analytics can be licensed to augment a SIEM you already run rather than only as part of New-Scale — if your log platform works and the problem is that nobody trusts its alerts, that is a much smaller and cheaper purchase than replacing it. TechBag scopes which of the two you actually need, in INR with GST.
Augment your SIEM
Best if your log platform is fine
- Adds behavioural analytics without replacing your SIEM
- A far smaller decision than a migration
- The option vendors rarely volunteer
Inside New-Scale
Best if you are replacing anyway
- Analytics and SIEM on one platform, one contract
- Dynamic risk scoring across the estate
- Smart Timelines assembled automatically
+ Nova agents
Best for triage load
- AI agents over the scored risk
- Threat scoring and investigation agents
- Prove it on your own alerts first
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every UEBA vendor
Take this into your next vendor call — including ours.
Can I license Analytics against my existing SIEM, and what does that quote include versus Fusion?
Which daily-ingest tier fits the sources we would send across, and what happens if we outgrow it?
Has my specific SIEM and log-source mix been deployed in augmentation mode before? Can I speak to that customer?
How long until risk scores are trustworthy at my size, and what will the vendor commit to in writing?
How much FTE time do comparable customers spend tuning in months one to six, and then steady-state?
What entity-resolution accuracy should I expect given the state of my AD and HR feeds?
Given the LogRhythm merger, what is the committed roadmap for the line I am buying?
If I augment now and replace my SIEM in two years, what carries over and what restarts?
Questions buyers ask
Ready to evaluate Exabeam New-Scale Analytics?
Decide augment or replace, check your identity data, or get an honest Exabeam-vs-Securonix UEBA comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.