- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
LogRhythm SIEM
The on-premises half of the portfolio — LogRhythm SIEM is now exclusively self-hosted, with over 1,100 prebuilt correlation rules and a long record in regulated and government estates.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — answered by definition
Self-hosted
Stored AND processed by you
Runs entirely on infrastructure you own and operate. Both questions answered by definition — the data never leaves your perimeter, unless you add the cloud-hybrid LogRhythm Intelligence.
What that rules in
Mandates the cloud SIEMs cannot meet
Sentinel, Google SecOps and Cortex XSIAM are SaaS-only. Where SaaS is prohibited, they are not candidates at any price.
For Indian buyers under the DPDP Act, or subject to RBI, SEBI or IRDAI expectations, self-hosted sidesteps the storage-versus-processing distinction entirely — there is no processing location to confirm because there is no third party. See the SIEM guide for the other products that can do this.
Quick answer
The Exabeam platform family
This page covers LogRhythm SIEM — the self-hosted SIEM. The other pillars:
Quick facts
30-second orientation- Product
- LogRhythm SIEM — self-hosted
- Vendor
- Exabeam (merged with LogRhythm, July 2024)
- Owner
- Thoma Bravo · CEO Pete Harteveld (Oct 2025)
- Deployment
- On-premises or self-managed private cloud
- Cloud option
- None — New-Scale is the cloud platform
- Correlation rules
- 1,100+ prebuilt, MITRE ATT&CK mapped
- Compliance
- ISO 27001, PCI DSS, HIPAA, SOX, NIST, CIS
- Analytics add-on
- LogRhythm Intelligence — cloud-hybrid UEBA + Nova
- Residency
- Stays with you — unless you add cloud analytics
- Pricing
- Subscription or perpetual; you run the iron
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
The self-hosted SIEM — exclusively on-premises since the merger, with 1,100+ prebuilt correlation rules and a long record in regulated and government estates.
A cloud-only SIEM vs LogRhythm SIEM — the honest table
What running the SIEM entirely inside your own boundary changes.
| Dimension | Cloud-only SIEM | LogRhythm SIEM |
|---|---|---|
| Where it runs | The vendor’s cloud | Your data centre or private cloud |
| Residency | Region promise, processing elsewhere | Storage and processing stay with you |
| Content | Build detections from scratch | 1,100+ prebuilt, ATT&CK-mapped rules |
| Response | Manual containment | SmartResponse actions, approval-gated |
| Licensing | GB/day tiers | Subscription or perpetual, unlimited-data model |
| Infrastructure | The vendor’s problem | Yours to size, patch and run |
| Honest caveat | — | New features lead on New-Scale — get the roadmap |
| Best fit | — | Mandates that rule out SaaS |
Self-hosting is the edge — if SaaS is allowed for you, New-Scale or a cloud SIEM will usually give more analytics per rupee (TechBag sells both).
The five pieces of LogRhythm SIEM
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Data Indexer
The indexer holds collected and structured log data on storage you own and size. Retention is a function of your disk, not a vendor tier — the point for buyers who must keep years of audit trail without a per-GB meter running. It is also the component most often under-provisioned in year one.
Platform Manager
Runs correlation, holds the rule set, manages alarms and drives workflow. This is where the 1,100+ prebuilt rules execute and where your tuning lives. Everything an auditor wants to see about how a detection was defined and who changed it is anchored here.
Data Processor
Takes raw events, parses them into a common schema, enriches them and applies risk-based prioritisation. This turns a firewall's terse syslog and an identity provider's JSON into something one correlation rule can reason about across both — and it happens inside your estate.
System Monitor Agents
Agents on hosts and collectors for network, cloud, identity, email and collaboration sources feed the pipeline. Agent-based collection picks up host artefacts that log forwarding alone misses, such as process and file-integrity data.
LogRhythm Intelligence
Adds Exabeam’s UEBA and Nova AI by connecting LogRhythm SIEM to the cloud-native New-Scale platform — a hybrid deployment, so that data leaves your boundary. A sync service aligns cases, risk scores and ATT&CK data. NetMon adds traffic analysis.
Collectors, processor, platform manager and indexer all inside your boundary — with cloud-hybrid analytics only if you choose to add it.
Twelve capabilities. Collect, correlate, contain.
LogRhythm SIEM collects and parses logs on infrastructure you own, correlates them with 1,100+ prebuilt rules and runs response actions from inside your perimeter. Here is what sits in each layer.
Broad source coverage
Collectors and agents pull from firewalls, endpoints, servers, identity, cloud, email and collaboration platforms.
Host-level monitors
Capture what forwarded syslog cannot: process activity, file integrity and local authentication detail.
Common schema
Every source parsed into one structure so a single rule reasons across a Cisco device and an Okta tenant.
Storage you own
Archive and retention live on your disk, so multi-year retention is a storage purchase, not a licence tier.
1,100+ correlations
Ships mapped to ATT&CK and compliance mandates, so a new deployment alarms meaningfully in weeks.
Framework coverage
Rules carry ATT&CK mapping, turning 'what are we covered for' from an opinion into a grid.
LogRhythm Intelligence
Cloud-hybrid behavioural analytics score users against their baselines — it runs on Exabeam's cloud.
Risk-based prioritisation
Events carry scores driven by asset criticality and behaviour, so a small team triages in a defensible order.
NetMon traffic analysis
Visibility into traffic that never generates a log line — lateral movement, unexpected egress, protocol anomalies.
Investigation workflow
Evidence, timeline and assignment in one place. The July 2026 release focused specifically here.
Automated actions
Execute containment from an alarm — disable an account, block an address, isolate a host — gated by approval where policy demands.
Mandate reporting
Prebuilt modules for ISO 27001, PCI DSS, HIPAA, SOX, NIST and CIS — the evidence requests that otherwise consume an analyst quarterly.
Watch LogRhythm SIEM in action
The self-hosted SIEM’s dashboards, and where it sits in Exabeam’s portfolio.
New LogRhythm SIEM Dashboards
The self-hosted SIEM, from Exabeam.
Exabeam SIEM Overview
Where LogRhythm sits after the merger.
The AI-Driven Exabeam Security Operations Platform
The wider platform it belongs to.
Want a live, India-context walkthrough for your environment?
Book a guided demo →The SIEM that stays inside your perimeter.
Here’s what genuinely sets LogRhythm SIEM apart (and where New-Scale or Elastic may fit better).
It qualifies where cloud-only SIEMs are disqualified before price
Microsoft Sentinel runs as SaaS in Azure. Google SecOps runs as SaaS on Google Cloud. Palo Alto Cortex XSIAM is SaaS. Each is capable, and TechBag will sell you any of them. But if your regulator, your contract with a client, or your own board has ruled out SaaS for security telemetry, none is a candidate at any discount — the architecture is the disqualifier, not the quote. LogRhythm SIEM sits on the much shorter list that clears that gate at all. This is the single most useful thing to understand about the product: its advantage is structural rather than featural. On a like-for-like comparison of analytics sophistication against a well-funded cloud-native SIEM, it will not win every row. On a shortlist where SaaS is prohibited, it does not need to — it is competing against a handful of peers rather than the whole market.
Mature on-prem, not a cloud product bent into an on-prem shape
Several vendors say they support on-premises deployment. Read the fine print, because the word covers at least three different things: a genuinely self-contained installation, a hosted appliance that still phones home for detection content or licensing, and a cloud product with an on-prem collector in front of it. Only the first survives a serious air-gap or sovereignty requirement. LogRhythm SIEM has been self-hosted for over twenty years — the on-premises path is the original design, not a retrofit, and the components run inside your boundary rather than proxying to someone else's. That heritage shows in the unglamorous places that decide whether a deployment succeeds: an installation model that assumes your hardware, upgrade paths that assume your change windows, and a support organisation used to customers who cannot simply hand over a cloud tenant for diagnosis.
Data residency and processing residency in one stroke
Cloud SIEM residency conversations get complicated fast, because there are two questions and vendors often answer only the first. Where is the data stored, and where is it processed? A vendor may hold your logs in an Indian region while performing analytics, support access or model inference elsewhere. Establishing exactly what happens where takes a documentation exercise, contractual commitments and usually a legal review. Self-hosting collapses both into one answer: the data never leaves your estate, so storage and processing are wherever your racks are. Under the DPDP Act, and against RBI, SEBI and IRDAI expectations about where regulated data lives and is handled, that is a materially shorter conversation with your compliance function and your auditor. It is also more durable — a cloud vendor's residency posture can change with a regional consolidation; your own data centre's cannot change without your say-so. Keep that in mind before adding LogRhythm Intelligence, which runs on Exabeam's cloud.
Detection content that arrives populated, with compliance evidence beside it
A SIEM with no content is a database with a query language. Over 1,100 prebuilt correlation rules, mapped to MITRE ATT&CK and to specific compliance mandates, mean the platform produces meaningful alarms early rather than after a long authoring project. For a lean security team — and most are leaner than the estate they defend — that difference decides whether the deployment delivers value in the first quarter or becomes an expensive log archive. The compliance modules matter for the same reason: ISO 27001, PCI DSS, HIPAA, SOX, NIST and CIS reporting is prebuilt, so the quarterly evidence request stops consuming an analyst for a week. Treat the rule library as a strong starting position rather than a finished strategy — it still needs tuning against your estate, and any vendor claiming otherwise is selling you noise.
The honest caveat — two platforms, one roadmap, and iron you must run
Exabeam now maintains two SIEM platforms. New-Scale is cloud-native with the louder growth story; LogRhythm SIEM is self-hosted with the longer history. That is a fair position, and LogRhythm SIEM is demonstrably still shipping — January, April and July 2026 all added real capability. But the merger's own record is instructive: where products overlapped, Exabeam consolidated, retiring Axon in favour of New-Scale. The platforms do not overlap today, because one is self-hosted and one is not. Still, ask for the roadmap in writing before you sign, with named release commitments and a support horizon, as a contractual attachment rather than a slide. Separately, price the second half of the deal honestly: self-hosted means you buy, run, patch and capacity-plan the infrastructure, and you own the upgrade windows and storage growth. That is often cheaper than a per-GB cloud meter at scale, and sometimes it is not. Model it over three years, not one.
The honest positioning
Buy LogRhythm SIEM when self-hosting is a requirement rather than a preference — because a regulator, a client contract, a sovereignty rule or a board decision has ruled out SaaS for your security telemetry, or because you operate genuinely disconnected environments. In that situation it is one of a small number of serious candidates, with two decades of on-premises heritage and detection and compliance content already populated. If SaaS is permitted, the calculus changes and you should look hard at Exabeam's own New-Scale, at Microsoft Sentinel if you are already deep in Azure, and at Google SecOps and Cortex XSIAM — you will likely get more analytics per rupee and no infrastructure to run. And if self-hosting IS required, still compare honestly against Elastic Security, ManageEngine Log360, Fortinet FortiSIEM, Kaspersky KUMA, Splunk and Wazuh. TechBag sells across that field, and we would rather place you on the platform your constraints actually point to than defend the wrong one at renewal.
The numbers behind the platform
What your LogRhythm SIEM rollout looks like
Qualify the constraint
Establish in writing WHY self-hosting is required: the regulation, contract clause, board decision or air-gap reality. Get compliance to state it precisely — 'data must not leave India' and 'data must not be processed by a third party' lead to different shortlists.
Size the estate and the iron
Inventory log sources and measure actual ingest, then add the sources you will onboard in years two and three. Size indexer storage against your real retention obligation, not current practice. This phase produces the number that decides the business case.
Deploy, onboard and tune
Stand up the platform, connect high-value sources, and let the prebuilt rules run before you touch them. Then tune against your own environment and map coverage against ATT&CK honestly. Bring in LogRhythm Intelligence once baseline data is meaningful.
Operate and review
Run it as a production system with change control on rule definitions, tracked upgrade windows and monitored storage growth. Review coverage quarterly. Re-confirm the roadmap annually at renewal — and revisit the self-hosting constraint itself every couple of years.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our regulator's position on SaaS for security logs made the shortlist for us. Three of the platforms we liked most simply were not eligible. LogRhythm was, and it works.”
“The 1,100 rules are real and they are useful. They are also not tuned for your environment, and nobody tells you that clearly enough at the start. Budget a proper tuning project.”
“Support understands customers who cannot just hand over a cloud tenant. That sounds minor until you have argued with a vendor who cannot debug anything without remote access to your data.”
“Investigation workflow has genuinely improved this year. The case handling in the recent releases is a step up from where we started.”
“Honestly, the infrastructure is the hard part, not the software. We under-sized storage in year one and paid for it in year two when retention requirements went up.”
“Compliance reporting saves us about a week a quarter. That was the line item that got the renewal signed, not the detections.”
“We asked directly about the roadmap versus New-Scale before signing. We got a straight answer and put it in the contract. I would advise anyone to do the same.”
“Behavioural analytics through LogRhythm Intelligence found a credential-misuse pattern our correlation rules had no way of catching. That justified the add-on on its own.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the self-hosted and cloud SIEM market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid
Execution strength vs product vision across the SIEM field — TechBag's synthesis, not Gartner's graphic.
2025 MQ Leader, sixth time — with a real self-hosted answer.
Detection Depth × Cost of Entry
Behavioural and detection depth against how cheaply you can start — the trade every SIEM shortlist makes.
Behavioural depth; tiered by daily ingest like most of the field.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
LogRhythm SIEM vs the field
The self-hosted SIEM field — honest lanes. Elastic suits teams with engineers, Log360 the mid-market, FortiSIEM Fortinet shops. LogRhythm’s edge is mature content inside your boundary. We sell across it.
| Dimension | Exabeam | Securonix | Splunk Enterprise Security | Microsoft Sentinel | Elastic Security |
|---|---|---|---|---|---|
| Position | UEBA-led SecOps, cloud AND self-hosted | The other UEBA-led vendor | The reference SIEM | SIEM for Microsoft estates | Search-engine-native SIEM |
| Pricing axis | GB ingested per day, tiered | GB/day, hybrid commitment + PAYG | Ingest or workload — historically costly | Per GB ingested per day | Subscription tier + resources |
| Behavioural analytics | The founding capability | The founding capability | Available, an add-on heritage | UEBA included | Entity risk scoring |
| Self-hosted option | LogRhythm SIEM — genuinely on-prem | Cloud-native only | Cloud, on-prem or hybrid | SaaS only, on Azure | Self-managed, even air-gapped |
| Analyst standing (SIEM MQ 2025) | Leader — sixth time | Leader, six times running | Leader | Leader | Visionary, not Leader |
| Augments a SIEM you own | New-Scale Analytics, licensed separately | UEBA available | Buy the platform | Buy the platform | Buy the platform |
| AI in the SOC | Nova — seven agents, named jobs | Sam, the AI SOC analyst | Cisco AI Assistant | Security Copilot + MCP | Elastic AI Assistant |
| Talent pool | Smaller than the incumbents | Smaller than the incumbents | SPL — the largest by far | KQL — widely known | Large for the engine, smaller for security |
| The thing to plan around | Two platforms post-merger — ask the roadmap | Cloud-only; model the GB/day | Cisco integration reshaping roadmap | Azure portal retires 31 Mar 2027 | You operate it unless you buy Cloud |
| Best fit | UEBA-led detection — cloud or on-prem | UEBA-led with Leader standing | Engineers who will build with it | Microsoft-standardised estates | Air-gapped, or existing ELK |
Does LogRhythm SIEM fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Exabeam if…
- ✓You want behavioural detection at the core of the SIEM, from a 2025 Gartner MQ Leader
- ✓You need behavioural analytics rather than more rules, and you want the vendor that built on it
- ✓Your mandate rules out cloud — LogRhythm SIEM is a genuine self-hosted platform, not a retrofit
- ✓You want to add analytics to a SIEM you already own rather than replace it
Choose Securonix if…
- ✓You want the other UEBA-led vendor, with six consecutive Gartner MQ Leader placements — and cloud-native suits you
Choose Splunk if…
- ✓You have engineers who will build with it, and you want the deepest content and the largest talent pool (TechBag sells it)
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 and Defender — Sentinel sits closest to that data, and TechBag sells it
Choose Elastic Security if…
- ✓You need air-gapped deployment, or your engineers already run Elasticsearch
LogRhythm SIEM is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
How much storage will you actually buy?
Self-hosted means the licence is only half the bill — the other half is disk. Set your daily log volume and the retention your regulator or auditor expects, and see the raw volume you must hold today and after two years of growth. Under-sizing storage in year one is the regret we hear most.
Raw volume only — compression, indexing overhead and archive tiers change the real figure, so ask Exabeam for the sizing ratio for your version. CERT-In’s Directions expect 180 days of ICT logs; sectoral rules can ask for more.
Three ways to consume it
Subscription or perpetual licensing on an unlimited-data model, quote-only, and you supply and run the infrastructure. The reason this page exists separately is that after the July 2024 merger LogRhythm SIEM is exclusively on-premises — LogRhythm's own cloud product, Axon, was retired in favour of New-Scale. So if your mandate rules out SaaS, this is a mature product rather than a cloud product bent into an on-prem shape. Do ask about roadmap investment relative to New-Scale, in writing. TechBag scopes and quotes in INR with GST.
LogRhythm SIEM
Best when cloud is ruled out
- On-premises only — you supply the infrastructure
- 1,100+ prebuilt correlation rules
- Residency answered by definition: data never leaves
+ LogRhythm Intelligence
Best for detection depth
- UEBA and Nova AI for LogRhythm SIEM
- Cloud-hybrid — runs on Exabeam's New-Scale cloud
- Check it against your residency mandate first
+ NetMon
Best for network visibility
- Network monitoring alongside the SIEM
- Available on self-hosted and cloud
- Scoped as an add-on, not bundled
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 8 questions to ask every self-hosted SIEM vendor
Take this into your next vendor call — including ours.
Is self-hosting an actual requirement in writing — regulation, contract or board decision — or an inherited preference nobody has re-tested?
Does your obligation cover PROCESSING as well as storage, and have you asked every cloud vendor about both separately?
For each competitor claiming on-premises support, does it run fully inside your boundary, or depend on a vendor cloud for content or licensing?
Have you sized storage against your real retention obligation plus three years of ingest growth, and costed the hardware and staffing?
Have you obtained a WRITTEN commitment on release roadmap and support horizon relative to New-Scale, as a contract attachment?
Who owns rule tuning after go-live, and is there a named person with budgeted days in the first six months?
Do the prebuilt modules map to the mandates your auditor tests — and have you shown a sample report to that auditor before signing?
Have you compared against Elastic Security, Log360, FortiSIEM, KUMA, Splunk and Wazuh on the same self-hosted criteria?
Questions buyers ask
Ready to evaluate LogRhythm SIEM?
Test whether self-hosting is really required, size the storage honestly, or compare LogRhythm with Elastic — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.