- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Exabeam Nova
Seven agents with named jobs, not one assistant that claims everything — Exabeam Nova puts AI agents for threat scoring, investigation, rule creation and search inside the workflow analysts already use, on the New-Scale platform.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Delivery
Cloud-native (New-Scale)
This is the cloud half of the portfolio. If your mandate rules out SaaS, LogRhythm SIEM is the self-hosted answer from the same vendor.
What to confirm
No India storage region listed
Exabeam’s documented data-residency regions are US West, US East, Singapore, Australia, Canada, Japan, Europe, Switzerland, the UK and KSA. Confirm your region in writing.
If your obligation requires data to stay in India, settle storage and processing separately with Exabeam before a proof of concept. If it rules out cloud entirely, see LogRhythm SIEM, which answers both by definition.
Quick answer
The Exabeam platform family
This page covers Exabeam Nova — the AI agent suite. The other pillars:
Quick facts
30-second orientation- Product
- Exabeam Nova — agentic AI for the SOC
- What it is
- 7 job-scoped agents, not one chatbot
- Vendor
- Exabeam (merged with LogRhythm, July 2024)
- Platforms
- New-Scale; LogRhythm via a cloud-hybrid add-on
- Runs on
- The New-Scale cloud platform
- Licensing
- Not published — quote-only
- Prerequisite
- An Exabeam platform — not standalone
- Platform meter
- GB ingested per day (2023 list)
- Best evidence
- Analyst acceptance rate on YOUR alerts
- In India via
- TechBag — trial design, GST invoicing
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Seven AI agents scoped to named SOC jobs — threat scoring, investigation, analyst assistance, rule creation, search, advisory and visualisation — on the New-Scale platform.
A general SOC chatbot vs Exabeam Nova — the honest table
What scoping AI to named SOC jobs changes about how you can evaluate it.
| Dimension | General-purpose AI assistant | Exabeam Nova |
|---|---|---|
| Assistant design | One chatbot for everything | Seven agents, each with a named job |
| Evaluation | Judged on impressions | Each agent testable against its job |
| Evidence base | Raw alerts restated | Behavioural risk scores underneath |
| Search | Query syntax to learn first | Natural-language search agent |
| Detection engineering | Rules written by hand | Rule Creator drafts, analysts review |
| Board reporting | Built manually each quarter | Advisor maps coverage to ATT&CK |
| Honest caveat | — | Productivity unproven on your queue |
| Best fit | — | Exabeam SOCs with a triage backlog |
Job-scoped agents are the edge — if Microsoft already runs your SOC, Security Copilot may be the cheaper path (TechBag sells it too).
The five pieces behind Exabeam Nova
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
The agent layer
Nova is not a single model behind a text box. It is a set of agents, each bound to one SOC task with its own inputs, outputs and success criterion. This is the decision that makes evaluation possible at all, because you can hold one agent to one job.
The platform beneath
Nova has no data of its own. It reasons over whatever your Exabeam platform has already collected and normalised. It inherits every gap in that collection, so poor log coverage produces confident agents that are confidently wrong.
The behavioural baseline
Exabeam's long-standing strength is behavioural analytics, and Nova's threat scoring sits on top of it. The agents consume risk signals derived from learned normal behaviour rather than static rules alone. Where the baseline is thin, the scoring degrades accordingly.
The context layer
Threat scoring accepts business context, so a service account in a payments environment can be weighted differently from a laptop in marketing. This is the part most teams under-invest in and then blame the AI for. Untuned context is the commonest reason prioritisation fails to match analyst intuition.
The reporting surface
The Advisor agent points at a different audience: it maps detection coverage against MITRE ATT&CK, OWASP and compliance frameworks and turns that into board-legible reporting. Genuinely useful, and the easiest agent to over-trust, because nobody in the boardroom can audit it.
Seven agents with named jobs, reasoning over the behavioural data your Exabeam platform already holds — useful only as far as that data reaches.
Twelve capabilities. Search, score, investigate.
Exabeam Nova puts agents for search, threat scoring, investigation, rule creation and reporting inside the analyst workflow, on top of the platform’s data. Here is what sits in each layer.
Natural-language search
Query users, hosts and logs from one interface without writing platform query syntax.
Source visibility
Surfaces which log sources feed detections and where the collection gaps sit.
Business context weighting
Lets you tell the scoring engine which users, assets and accounts actually matter.
Cross-platform data
Reasons over New-Scale data; LogRhythm SIEM reaches it via the cloud-hybrid LogRhythm Intelligence add-on.
Machine-learned threat scoring
Prioritises alerts against behavioural baselines rather than static severity labels.
Behavioural anomaly detection
Flags deviation from learned normal for users, hosts and service accounts.
AI-assisted rule creation
Generates, tunes and converts correlation rules to shorten detection-engineering cycles.
ATT&CK coverage mapping
Maps existing detections to ATT&CK and compliance frameworks to expose blind spots.
Alert triage
Suppresses low-value alerts so the queue reflects what warrants human review.
Automated case summarisation
Assembles the narrative, entities and timeline so analysts start from evidence, not raw logs.
Next-step guidance
Proposes the next investigative action and the likely attack vector for the analyst to confirm.
Executive reporting
Turns coverage and SOC activity into reporting a CISO can defend outside the security team.
Watch Exabeam Nova in action
The AI-driven platform Nova runs on, and the analyst workflow it joins.
The AI-Driven Exabeam Security Operations Platform
The AI platform, explained by Exabeam.
Exabeam SIEM Overview
The platform the agents work inside.
Introducing New-Scale Analytics — Analyst Workflow
The analyst workflow the agents join.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Agents you can hold to a job.
Here’s what genuinely sets Nova apart (and where Security Copilot or Securonix’s agents may fit better).
Named jobs beat a general assistant
The most useful thing about Nova is structural, not technical. A general SOC chatbot cannot really be evaluated — ask it anything, get a plausible answer, and there is no defined standard it either met or missed. An agent scoped to a named job can be held to that job. You can ask whether the Investigation agent's case summary matched what the analyst concluded independently. You can ask whether the Rule Creator's output needed rewriting before it went live. You can count how often the Threat Scoring agent's top ten matched the ten cases your analysts would have picked. None of those questions are answerable about 'the AI'. All are answerable about a specific agent doing a specific task, and that is the difference between a product you can procure responsibly and one you buy on a demo.
It rides on a behavioural engine, not a bolted-on model
Exabeam has been doing user and entity behaviour analytics far longer than the agentic AI category has existed, and Nova's scoring sits on that substrate. This matters because the failure mode of AI in the SOC is confident output over thin evidence. An agent reasoning over a learned behavioural baseline has something underneath it; an agent reasoning over raw alerts is mostly restating them in nicer prose. The practical implication is that Nova's value tracks the maturity of your Exabeam deployment. If your log coverage is patchy and your baselines are young, the agents operate on the same weak evidence your analysts do — and no amount of AI manufactures signal that was never collected.
Self-hosted estates reach it through a hybrid
The LogRhythm merger gave Exabeam a genuine self-hosted SIEM that is still receiving development, which matters for Indian buyers whose sectoral guidance makes a cloud SIEM hard to approve. Be precise about what that means for Nova. Nova runs on the cloud-native New-Scale platform; self-hosted LogRhythm SIEM customers reach it through LogRhythm Intelligence, which Exabeam describes as using the New-Scale cloud to create a hybrid deployment. So AI on a self-hosted estate means some data travelling to Exabeam’s cloud, in one of its documented regions — none of them in India. Get agent-by-agent availability and the data flows written into the quote.
Budget the platform meter, not just the module
Nova sits on an Exabeam platform, and that platform is sized by data volume: Exabeam’s 2023 Americas list prices SIEM, Analytics and Fusion as one-year subscriptions by GB ingested per day. Exabeam does not publish how Nova itself is licensed, so the honest three-year model is platform tier, plus Nova as quoted, plus the ingest growth you expect. Filter noisy sources before they reach the meter — the agents gain nothing from logs with no detection value, and you pay for every gigabyte of them.
The honest caveat about AI claims
Every SIEM vendor is shipping AI agents in 2026, and every one of them demos beautifully. That is not evidence, because demos run on curated data where the answer is known. Vendor figures — investigations completed dramatically faster, alerts meaningfully reduced — describe someone else's environment and someone else's queue. The only test that counts is your own noisy alerts during the trial. Run the agents against real production volume, including the boring ambiguous ones, and measure the thing that matters: do your analysts accept the agents' conclusions, or do they quietly redo the work? Watch for the second behaviour specifically, because it is easy to miss. An analyst who reads the AI summary, nods, then opens the raw logs and rebuilds the timeline has told you the productivity claim is not landing — but usage metrics will still record that summary as consumed. If the redo rate is high after a fair trial with tuned context, you are paying for a module your team does not trust. Walk away, or renegotiate.
The honest positioning
Nova is a sensible implementation of an idea the entire market is chasing simultaneously, and it is strongest for organisations already committed to Exabeam. It is not standalone and cannot rescue a poorly instrumented SOC — it needs the platform beneath it, decent log coverage and tuned business context before it does anything useful. If you are not already an Exabeam customer, the real decision is the SIEM, not the agents: choose the platform on detection quality, deployment model and total cost, then treat Nova as an add-on to evaluate on its own merits. TechBag sells Exabeam's competitors too and will say plainly when one fits better. If Microsoft is already deep in your estate, Security Copilot may be the cheaper path. If you need self-hosted above all, note that Nova reaches LogRhythm SIEM only through a cloud-hybrid add-on. If your alert volume is modest and your team small, agentic AI may be solving a problem you do not yet have.
The numbers behind the platform
What your Exabeam Nova rollout looks like
Establish the platform baseline
Before Nova can be judged, confirm what your Exabeam deployment actually sees. Audit log source coverage and check how mature your behavioural baselines are. Agents reasoning over incomplete collection produce fluent, confident, wrong answers — and you will blame the AI for a data problem.
Load real business context
Threat scoring is only as good as the context you give it. Mark your crown-jewel systems, privileged accounts and regulated data stores so the agents weight them properly. Teams that skip this and then complain prioritisation does not match analyst intuition have diagnosed the symptom and missed the cause.
Trial against your own noisy queue
Run the agents on real production alerts for at least a month, including the ambiguous low-grade ones that make up most of the work. Log every case where an analyst accepted the conclusion and every case where they redid it. That ratio is your actual evidence.
Decide on measured evidence
If acceptance is high after fair tuning, embed the agents into standard procedure and define which conclusions may be acted on without human confirmation. If the redo rate stayed high, say so plainly and either renegotiate or decline. A trial that cannot produce a 'no' was never an evaluation.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The case summaries genuinely changed how our tier-one starts a shift. They open with a narrative instead of a wall of raw events, and that alone took real minutes off every ticket.”
“Threat scoring was mediocre until we spent a fortnight loading proper business context. That is on us, not the product, but nobody warned us it was a prerequisite rather than an optimisation.”
“Honest assessment after two quarters: the AI is fine, but my senior analysts still rebuild the timeline themselves before they close anything material. We are paying for a module that mostly helps the juniors, and the productivity numbers we were shown have not materialised for us.”
“Natural-language search removed a real barrier. Our newer analysts were blocked on query syntax and are now productive in weeks rather than months.”
“The Advisor reporting is what got the renewal approved, frankly. Showing the board a coverage map against ATT&CK made a conversation possible that we had been failing at for two years.”
“Rule Creator output always needs review before it goes live. It is a competent first draft and a poor final answer. Treated correctly, it still saves detection-engineering time.”
“We are self-hosted for regulatory reasons and not every capability we saw demonstrated was available to us on day one. Clarify this before you sign — we assumed parity and were wrong.”
“Advisor’s coverage map showed three sources we were paying to ingest that fed no detection at all. Cutting them paid for part of Nova.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the SIEM and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision across the SIEM field — TechBag's synthesis, not Gartner's graphic.
2025 MQ Leader, sixth time — with a real self-hosted answer.
Detection Depth × Cost of Entry
Behavioural and detection depth against how cheaply you can start — the trade every SIEM shortlist makes.
Behavioural depth; tiered by daily ingest like most of the field.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Exabeam Nova vs the field
The AI-SOC field — honest lanes. Every SIEM vendor now ships agents; Nova’s edge is job scoping over a behavioural substrate. Judge all of them on your own queue — we sell several.
| Dimension | Exabeam | Securonix | Splunk Enterprise Security | Microsoft Sentinel | Elastic Security |
|---|---|---|---|---|---|
| Position | UEBA-led SecOps, cloud AND self-hosted | The other UEBA-led vendor | The reference SIEM | SIEM for Microsoft estates | Search-engine-native SIEM |
| Pricing axis | GB ingested per day, tiered | GB/day, hybrid commitment + PAYG | Ingest or workload — historically costly | Per GB ingested per day | Subscription tier + resources |
| Behavioural analytics | The founding capability | The founding capability | Available, an add-on heritage | UEBA included | Entity risk scoring |
| Self-hosted option | LogRhythm SIEM — genuinely on-prem | Cloud-native only | Cloud, on-prem or hybrid | SaaS only, on Azure | Self-managed, even air-gapped |
| Analyst standing (SIEM MQ 2025) | Leader — sixth time | Leader, six times running | Leader | Leader | Visionary, not Leader |
| Augments a SIEM you own | New-Scale Analytics, licensed separately | UEBA available | Buy the platform | Buy the platform | Buy the platform |
| AI in the SOC | Nova — seven agents, named jobs | Sam, the AI SOC analyst | Cisco AI Assistant | Security Copilot + MCP | Elastic AI Assistant |
| Talent pool | Smaller than the incumbents | Smaller than the incumbents | SPL — the largest by far | KQL — widely known | Large for the engine, smaller for security |
| The thing to plan around | Two platforms post-merger — ask the roadmap | Cloud-only; model the GB/day | Cisco integration reshaping roadmap | Azure portal retires 31 Mar 2027 | You operate it unless you buy Cloud |
| Best fit | UEBA-led detection — cloud or on-prem | UEBA-led with Leader standing | Engineers who will build with it | Microsoft-standardised estates | Air-gapped, or existing ELK |
Does Exabeam Nova fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Exabeam if…
- ✓You want behavioural detection at the core of the SIEM, from a 2025 Gartner MQ Leader
- ✓You need behavioural analytics rather than more rules, and you want the vendor that built on it
- ✓Your mandate rules out cloud — LogRhythm SIEM is a genuine self-hosted platform, not a retrofit
- ✓You want to add analytics to a SIEM you already own rather than replace it
Choose Securonix if…
- ✓You want the other UEBA-led vendor, with six consecutive Gartner MQ Leader placements — and cloud-native suits you
Choose Splunk if…
- ✓You have engineers who will build with it, and you want the deepest content and the largest talent pool (TechBag sells it)
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 and Defender — Sentinel sits closest to that data, and TechBag sells it
Choose Elastic Security if…
- ✓You need air-gapped deployment, or your engineers already run Elasticsearch
Exabeam Nova is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
What is an accepted conclusion worth?
Nova’s value is the analyst time it returns — and only conclusions your analysts accept without redoing count. Set your daily triage volume and the acceptance rate you measure in the trial. The minutes saved per accepted conclusion and the hourly cost are our assumptions, not Exabeam figures; replace them with your own.
If acceptance stays low after you have loaded business context and tuned the scoring, this number is what you are not getting — and a reason to renegotiate or decline. Compare it with the Nova line in your quote, not with a vendor productivity claim.
Three ways to consume it
Quote-only; Exabeam does not publish how Nova is licensed, so get it itemised. Be sceptical in the useful way here: every SIEM vendor in the market is shipping agents right now and all of them demonstrate well on curated data. The structure is a good sign — agents scoped to named jobs can be evaluated against those jobs, where a general assistant can only be judged on impressions. But the only evidence that counts is what happens to your alert queue. TechBag structures the trial so that is what gets measured, and quotes in INR with GST.
Nova, on New-Scale
Best for cloud estates
- Seven agents across triage, investigation and search
- Inside the workflow analysts already use
- Quote-only — ask how it is itemised
Via LogRhythm Intelligence
For self-hosted estates
- LogRhythm SIEM reaches Nova through this add-on
- It uses Exabeam's cloud — data leaves your perimeter
- Confirm which agents you get, in writing
Evaluation
Best before you commit
- Every SIEM vendor demos AI well on curated data
- Measure whether analysts accept the conclusions
- TechBag structures the trial to test this
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every AI-SOC vendor
Take this into your next vendor call — including ours.
During the trial, what percentage of agent conclusions did analysts accept WITHOUT redoing the work themselves?
Did we test on our own noisy production alerts, or only on the vendor's curated demo data?
Can we name one measurable outcome that changed — queue depth, time to close, escalation rate — rather than an impression?
Which specific agents are available on OUR deployment model, and is that written into the quote?
Which log sources are missing, and will the agents be reasoning over those gaps?
Have we loaded real business context before judging the scoring, or are we evaluating an untuned system?
What is the three-year cost of platform plus Nova at our projected daily-ingest growth?
Which agent conclusions may be acted on without human confirmation, and who signed off on that boundary?
Questions buyers ask
Ready to evaluate Exabeam Nova?
Design a trial that can say no, check agent availability for your platform, or compare Nova with Security Copilot — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.