- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Exabeam New-Scale SIEM
The cloud SIEM built around behaviour — Exabeam New-Scale SIEM pairs correlation rules with behavioural baselines and Smart Timelines, from a vendor named a 2025 Gartner MQ Leader for the sixth time.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Delivery
Cloud-native (New-Scale)
This is the cloud half of the portfolio. If your mandate rules out SaaS, LogRhythm SIEM is the self-hosted answer from the same vendor.
What to confirm
No India storage region listed
Exabeam’s documented data-residency regions are US West, US East, Singapore, Australia, Canada, Japan, Europe, Switzerland, the UK and KSA. Confirm your region in writing.
If your obligation requires data to stay in India, settle storage and processing separately with Exabeam before a proof of concept. If it rules out cloud entirely, see LogRhythm SIEM, which answers both by definition.
Quick answer
The Exabeam platform family
This page covers Exabeam New-Scale SIEM — the cloud SIEM. The other pillars:
Quick facts
30-second orientation- Product
- Exabeam New-Scale SIEM
- Vendor
- Exabeam (Thoma Bravo-backed)
- Category
- Cloud-native SIEM + log management
- Priced on
- GB ingested per day, in tiers
- Gartner MQ 2025
- Leader — Exabeam’s sixth time
- The merger
- The cloud platform Axon was retired for
- Analytics
- New-Scale Analytics ships alongside
- Deployment
- Cloud-native (LogRhythm SIEM is the on-prem half)
- Published pricing
- 2023 Americas list only; India is quoted
- In India via
- TechBag — user-count modelling, GST invoicing
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Exabeam’s cloud-native SIEM — the platform the LogRhythm merger standardised on. Collection, correlation and cases, with behavioural analytics built in rather than bolted on.
A rules-only SIEM vs Exabeam New-Scale SIEM — the honest table
What building the SIEM around behavioural analytics changes, dimension by dimension.
| Dimension | Rules-only SIEM | Exabeam New-Scale SIEM |
|---|---|---|
| Detection basis | Rules you wrote in advance | Rules plus behavioural baselines |
| Stolen credentials | Nothing malformed to match | Behaviour is wrong, so it scores |
| Investigation | Analyst queries for the timeline | Smart Timelines assembled for them |
| Pricing axis | GB/day, often with overage | GB/day tiers — filter before the meter |
| Deployment | Cloud-only, or on-prem-only | Cloud here; LogRhythm SIEM for on-prem |
| AI assistance | A generic chatbot, if any | Nova agents scoped to SOC jobs |
| Honest caveat | — | Two platforms post-merger — ask the roadmap |
| Best fit | — | UEBA-led detection in the cloud |
Behavioural detection is the edge — for the deepest content library and talent pool, Splunk still leads (TechBag sells both).
The five pieces of New-Scale SIEM
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Cloud collection
Log collection from cloud, on-premises and SaaS sources into Exabeam’s cloud platform. Licences are sized by GB per day, so decide which noisy sources earn their ingest before they reach the meter.
Correlation & detection
Standard correlation and detection content, with the behavioural layer alongside rather than bolted on — so a detection can reference an entity's risk score, not only the event in front of it.
New-Scale Analytics
Behavioural baselines for every user and machine, with dynamic risk scoring. This is the capability Exabeam is known for and the reason the SIEM's detections behave differently from a purely rule-based one.
Smart Timelines
The chronological reconstruction of an entity's activity, assembled automatically rather than queried for. The measurable saving is analyst minutes per investigation, which is the thing that actually scales a SOC.
Exabeam Nova
Seven AI agents scoped to named SOC jobs — threat scoring, investigation, analyst assistance, rule creation, search, advisory and visualisation — running on the New-Scale platform.
Cloud collection, rules and behavioural baselines on one platform — with Smart Timelines doing the reconstruction analysts used to do by hand.
Twelve capabilities. Collect, detect, respond.
New-Scale SIEM collects logs into Exabeam’s cloud, detects with rules and behavioural baselines together, and hands analysts an assembled timeline. Here is what sits in each layer.
Cloud log collection
Sources across cloud, on-premises and SaaS, into the cloud platform.
Ingest you choose
Licences follow daily ingest, so decide which noisy sources earn their place.
Prebuilt source content
Parsing and normalisation for common security and infrastructure sources.
Cloud retention tiers
Retention configured per your mandate rather than fixed by the licence.
Detection rules
Standard correlation content, referencing entity risk as well as events.
Behavioural baselines
What each user and machine normally does — and scored deviation from it.
Dynamic risk accumulation
Small signals accumulate on an entity until the sequence is alarming.
Smart Timelines
Entity activity reconstructed automatically, not queried for.
Investigation search
Query across collected data during an investigation.
Case management
Investigations, evidence and workflow in the platform.
Response actions
Automated and analyst-triggered response across integrations.
AI agents in the workflow
Seven agents scoped to named SOC jobs, inside the analyst workflow.
Watch Exabeam New-Scale SIEM in action
The SIEM, the platform around it, and the behavioural layer it ships with.
Exabeam SIEM Overview
The SIEM, explained by Exabeam.
The AI-Driven Exabeam Security Operations Platform
Where the SIEM sits in the platform.
Introducing New-Scale Analytics — Analyst Workflow
The behavioural layer it ships with.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Detections built on behaviour, not just rules.
Here’s what genuinely sets New-Scale SIEM apart (and where Splunk or Securonix may fit better).
A 2025 Gartner Leader, built around behaviour
Exabeam was named a Leader in the 2025 Gartner Magic Quadrant for SIEM — its sixth Leader placement, after 2018, 2020, 2021, 2022 and 2024 — and LogRhythm had been a Leader nine times before the merger. That record matters less as a badge than as evidence the combined company kept executing while integrating two products. What distinguishes New-Scale SIEM inside that quadrant is where it starts: behavioural baselines ship with the SIEM, so a detection can reference an entity’s risk rather than only the event in front of it. Cite the placement precisely — year and quadrant — and judge the detections on your own data.
Behavioural analytics as the product, not an add-on
Exabeam built on UEBA before the category had a name, and New-Scale Analytics ships as part of this platform rather than as a module you discover you need later. The practical consequence is what happens with a stolen credential. A rule-based SIEM has nothing to match: the login is valid, the source is plausible, the actions are permitted. Nothing is malformed, so nothing fires. A behavioural system has a baseline of what that identity normally does — hours, systems, volumes, sequences — and scores the deviation. Given that credential abuse is now the dominant initial-access route, that difference is not academic. It also changes what your analysts spend time on: instead of tuning rules to suppress noise, they are working a ranked risk list.
Smart Timelines, and the minutes that actually scale a SOC
The unglamorous truth about security operations is that most analyst time goes on reconstruction — what did this account do, in what order, across which systems, over what period. Analysts do it by querying, repeatedly, and it is slow. Exabeam assembles that timeline automatically for the entity in question. The saving is minutes per investigation, and minutes per investigation is precisely the number that determines how many incidents a given team can actually work. Capability comparisons rarely capture this because it is not a feature you can tick; it shows up as throughput. When you evaluate, time a real investigation on your own data rather than reading the feature list.
Two platforms — and the on-premises one is real
The July 2024 LogRhythm merger left Exabeam with a genuinely unusual position: New-Scale for cloud, LogRhythm SIEM for self-hosted, with Axon retired to avoid overlap. Most vendors serve one deployment model well and treat the other as an afterthought, and several claim on-premises capability that turns out to mean a hosted appliance with cloud dependencies. LogRhythm SIEM is a mature product with over 1,100 prebuilt correlation rules and a long record in regulated and government estates. So if your mandate rules out cloud, you are not being handed a compromise — and for Indian buyers under DPDP or RBI, SEBI and IRDAI expectations, self-hosted answers both the storage and processing residency questions by definition. See the LogRhythm SIEM page for that side.
The honest caveat — smaller talent pool, and a fair roadmap question
Being straight, and TechBag sells the alternatives: the pool of people who already know Exabeam is materially smaller than for Splunk or Microsoft Sentinel. SPL and KQL are on a great many CVs; Exabeam experience is on fewer, which affects hiring, contractor availability and how quickly a new analyst becomes productive. Second, any two-platform portfolio after a merger invites a question about where investment goes, and Axon's retirement demonstrates this company will consolidate where products overlap. New-Scale and LogRhythm SIEM do not overlap — they serve different deployment models — but ask for the roadmap commitment in writing anyway, for whichever one you are buying. A vendor confident in its plan will provide it, and the request costs you nothing.
The honest positioning
Exabeam New-Scale SIEM is the right choice when you want behavioural detection as the product rather than rules you maintain, when cloud is acceptable, and when a genuine on-premises sibling in the same portfolio matters. It is volume-metered like most of the field, so the cost question is how much you ingest — filter hard before the meter. It is the wrong choice when you need the largest talent pool and deepest content library, which is Splunk, or when you are standardised on Microsoft and Sentinel’s proximity to your data wins. TechBag sells Splunk, Microsoft Sentinel, Securonix and Elastic as well, quoted in INR with GST.
The numbers behind the platform
What your Exabeam New-Scale SIEM rollout looks like
Measure your real daily ingest
The quote turns on GB ingested per day. Measure it per source, then decide which noisy feeds earn their tier before onboarding. TechBag does this sizing free.
Connect sources and baseline
Onboard log sources, then let the behavioural baselines establish. Analytics needs a period of normal activity before deviation means anything.
Tune risk, not rules
The work here is calibrating what risk score warrants attention, rather than writing and suppressing rules. Different discipline from a rule-based SIEM.
Measure investigation minutes
Time real investigations before and after. Smart Timelines' value shows up as throughput, and throughput is what decides how many incidents your team can work.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We filtered two chatty firewall feeds before onboarding and dropped a whole ingest tier. Nobody told us to; the quote made it obvious.”
“The behavioural scoring caught an account doing entirely permitted things at an entirely wrong hour. No rule we would have written would have fired on that.”
“Smart Timelines is the feature that does not demo well and matters most. Reconstruction used to be most of an investigation; now it is the starting point.”
“Honest warning: hiring is harder. Everyone has SPL on their CV. We trained internally and budgeted for the ramp.”
“We asked the roadmap question about two platforms after the merger and got a straight answer in writing. That mattered more to our board than any feature.”
“Being able to add the analytics layer to what we already ran, rather than replacing the SIEM, made the business case survivable.”
“We priced New-Scale against two rivals at the same GB per day. The price gap was smaller than the detection gap, and that decided it.”
“As an Indian enterprise, having both a cloud option and a real on-prem one from the same vendor kept our options open while the mandate was being settled.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the SIEM and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision across the SIEM field — TechBag's synthesis, not Gartner's graphic.
2025 MQ Leader, sixth time — with a real self-hosted answer.
Detection Depth × Cost of Entry
Behavioural and detection depth against how cheaply you can start — the trade every SIEM shortlist makes.
Behavioural depth; tiered by daily ingest like most of the field.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Exabeam New-Scale SIEM vs the field
The SIEM field — honest lanes. Exabeam and Securonix lead on behavioural detection, Splunk on content and talent, Sentinel on Microsoft estates. We sell all of them.
| Dimension | Exabeam | Securonix | Splunk Enterprise Security | Microsoft Sentinel | Elastic Security |
|---|---|---|---|---|---|
| Position | UEBA-led SecOps, cloud AND self-hosted | The other UEBA-led vendor | The reference SIEM | SIEM for Microsoft estates | Search-engine-native SIEM |
| Pricing axis | GB ingested per day, tiered | GB/day, hybrid commitment + PAYG | Ingest or workload — historically costly | Per GB ingested per day | Subscription tier + resources |
| Behavioural analytics | The founding capability | The founding capability | Available, an add-on heritage | UEBA included | Entity risk scoring |
| Self-hosted option | LogRhythm SIEM — genuinely on-prem | Cloud-native only | Cloud, on-prem or hybrid | SaaS only, on Azure | Self-managed, even air-gapped |
| Analyst standing (SIEM MQ 2025) | Leader — sixth time | Leader, six times running | Leader | Leader | Visionary, not Leader |
| Augments a SIEM you own | New-Scale Analytics, licensed separately | UEBA available | Buy the platform | Buy the platform | Buy the platform |
| AI in the SOC | Nova — seven agents, named jobs | Sam, the AI SOC analyst | Cisco AI Assistant | Security Copilot + MCP | Elastic AI Assistant |
| Talent pool | Smaller than the incumbents | Smaller than the incumbents | SPL — the largest by far | KQL — widely known | Large for the engine, smaller for security |
| The thing to plan around | Two platforms post-merger — ask the roadmap | Cloud-only; model the GB/day | Cisco integration reshaping roadmap | Azure portal retires 31 Mar 2027 | You operate it unless you buy Cloud |
| Best fit | UEBA-led detection — cloud or on-prem | UEBA-led with Leader standing | Engineers who will build with it | Microsoft-standardised estates | Air-gapped, or existing ELK |
Does Exabeam New-Scale SIEM fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Exabeam if…
- ✓You want behavioural detection at the core of the SIEM, from a 2025 Gartner MQ Leader
- ✓You need behavioural analytics rather than more rules, and you want the vendor that built on it
- ✓Your mandate rules out cloud — LogRhythm SIEM is a genuine self-hosted platform, not a retrofit
- ✓You want to add analytics to a SIEM you already own rather than replace it
Choose Securonix if…
- ✓You want the other UEBA-led vendor, with six consecutive Gartner MQ Leader placements — and cloud-native suits you
Choose Splunk if…
- ✓You have engineers who will build with it, and you want the deepest content and the largest talent pool (TechBag sells it)
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 and Defender — Sentinel sits closest to that data, and TechBag sells it
Choose Elastic Security if…
- ✓You need air-gapped deployment, or your engineers already run Elasticsearch
Exabeam New-Scale SIEM is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What does your daily ingest cost — and what does growth add?
Exabeam’s own Americas price list (effective 1 August 2023) sells the SIEM as one-year subscriptions sized by GB ingested per day. Set today’s volume and your expected growth to see the list price at your tier, and what growth adds by year three. A dated US list converted to rupees — not an India quote.
Log volume grows on its own — new SaaS, chattier applications, richer endpoint telemetry. The lever you control is what reaches the meter: filter sources with no detection value before onboarding them, and ask what happens if you outgrow a tier mid-term. Converted at ₹84/US$, before any discount; TechBag models the real India quote.
Three ways to consume it
Exabeam does not publish an India price. Its own Americas list (effective 1 August 2023) sells the SIEM as one-year subscriptions sized by GB ingested per day — US$36,000 a year up to 50 GB/day, before discount. So the number that decides your quote is daily ingest: measure it per source and filter what has no detection value. TechBag sizes it and quotes in INR with GST.
New-Scale SIEM
Best for cloud-capable estates
- 2023 US list: $36,000/yr up to 50 GB/day
- Log management, correlation, search and cases
- The cloud platform the LogRhythm merger standardised on
New-Scale Fusion
Best when you want UEBA too
- 2023 US list: $51,000/yr up to 50 GB/day
- Behavioural baselines and dynamic risk scoring
- Analytics can also be bought alone for another SIEM
+ Exabeam Nova
Best for stretched analysts
- Seven agents scoped to named SOC jobs
- Runs on the New-Scale platform
- Test it on your own alert queue, not a demo
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every cloud SIEM vendor
Take this into your next vendor call — including ours.
What is our real GB/day per source — and which sources would we filter before the meter?
What happens if we outgrow our GB/day tier mid-term — overage, true-up or a forced upgrade?
Cloud or on-premises? That decides New-Scale versus LogRhythm SIEM before any feature comparison.
If your log platform is fine and its alerts are not trusted, New-Scale Analytics on your existing SIEM is a much smaller purchase.
Two platforms after a merger — ask where investment goes for the one you are buying, in writing.
Who will run it? The Exabeam talent pool is smaller than Splunk's or Microsoft's — budget the ramp honestly.
Behavioural analytics needs normal activity before deviation is meaningful. Plan the evaluation long enough to see that.
Quote-only with no published list — have you modelled it in INR with GST?
Questions buyers ask
Ready to evaluate Exabeam New-Scale SIEM?
Size your daily ingest honestly, decide cloud or self-hosted, or get an honest Exabeam-vs-Securonix comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.