- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Gurucul Open XDR
Detection across the tools you already bought — Gurucul Open XDR ingests telemetry from your existing endpoint, network, cloud and identity products and layers identity and behavioural analytics on top. Test the connector depth on your own stack: every XDR vendor claims openness.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Where data lives
Yours, if you self-host
Gartner’s own 2025 MQ text confirms the platform runs SaaS, cloud OR self-hosted. Self-hosted puts collection scope and physical storage under your control — on-premises or your own cloud account, in India if you choose — which is how you hold 180 days of logs in Indian jurisdiction and evidence it.
Two things we could NOT verify
Air-gap, and any India region
A genuine air gap is marketed but we could not confirm it independently, and self-hosted is not the same thing — air-gap affects licence activation, threat-intel updates and support access. We also found no evidence of a vendor-run India data region. Get both in writing before you commit.
Be exact about the obligation that actually applies, since the strict interpretation is oversold as a matter of routine — on-premises vendors do it too, so allow for our incentive. Under CERT-In’s April 2022 Directions, ICT logs must be retained for a rolling 180 days “within the Indian jurisdiction”; CERT-In’s May 2022 FAQ (Q35), though, lets them sit outside India if they remain producible within a reasonable time — the strict in-India duty applies to financial-transaction records. Sector rules are what make it clear-cut: IRDAI’s 2023 audit annexure puts a yes/no question to insurers — are ICT infrastructure logs stored in India? — and the answer has to be yes. If that is you, self-hosting stops being a preference. Remember, too, that an India team is not India-resident data — the engineering centre in Pune is genuine, but an engineering centre is no data region.
Quick answer
The Gurucul platform family
This page covers Gurucul Open XDR — the XDR. The other pillars:
Quick facts
30-second orientation- Product
- Gurucul Open XDR — on the REVEAL platform
- Vendor
- Gurucul — founder-CEO Saryu Nayyar, still in post
- Premise
- Detection across tools you already own, not a replacement
- The differentiator
- Identity and behavioural analytics layered on top
- Test this
- Integration DEPTH per connector, not the length of the list
- Deployment
- Follows the platform: SaaS, cloud or self-hosted
- Sold as
- Listed as its own product on REVEAL — confirm packaging
- Data residency
- Yours if self-hosted; no vendor India region found
- Data processing
- One platform with the SIEM and UEBA — no second copy
- Buy in India via
- TechBag — connector-depth testing in the PoC, INR, GST
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Detection and response across the security tools you already own — endpoint, network, cloud and identity telemetry ingested into one platform, with identity and behavioural analytics layered on top.
Six consoles vs Gurucul Open XDR — the honest table
What one identity-aware detection layer over your existing tools changes.
| Dimension | Separate tool consoles | Open XDR |
|---|---|---|
| Telemetry | Each tool keeps its own | Ingested and normalised on one platform |
| Correlation | Analyst pivots between consoles | Cross-tool correlation on one data model |
| Identity context | Rarely attached to alerts | Identity and behavioural analytics on top |
| Existing tools | Replace them to get XDR | Keeps the EDR, firewall and IdP you own |
| Storage | A second data lake beside the SIEM | Same store as Gurucul’s SIEM, if you run it |
| Response | Per-tool actions, by hand | Playbooks back through integrated tools |
| Honest caveat | — | Connector depth varies — test it |
| Best fit | — | Mixed estates you cannot consolidate |
Vendor-neutral ingestion is the edge — in a single-vendor estate, that vendor’s native XDR goes deeper (TechBag sells those too).
The six pieces behind Gurucul Open XDR
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Integration fabric
Gurucul describes a data-processing fabric with thousands of integrations that ingest, enrich, normalise and filter telemetry. Judge it by depth on your own top three tools, not by the count.
Normalisation
EDR, firewall, identity-provider and cloud events land in a common schema with asset and identity context attached, so one detection can reason across products that never shared a format.
Big-data analytics layer
Gurucul positions Open XDR as cloud-native on a big-data architecture that federates analytics across dispersed cloud and hybrid estates. Deployment options follow the REVEAL platform.
Identity & behaviour analytics
Behavioural and identity analytics run over the combined telemetry, so an identity-based attack that looks normal in each tool surfaces as one abnormal pattern across them.
Risk-scored cases
Related detections from different tools are linked and risk-scored into one case, so analysts work a ranked queue rather than six consoles’ worth of alerts.
Response
Response runs back through integrated products — isolate via the EDR, block at the firewall, disable in the IdP. Test each action on your stack; not every connector can act.
Telemetry from the tools you already own, normalised once and read through identity — detection without a rip-and-replace.
Ten capabilities. Ingest, correlate, respond.
Gurucul Open XDR ingests telemetry from your existing endpoint, network, cloud and identity tools, correlates it on one data model and scores it through identity context. Here is what sits in each layer.
Existing-tool ingestion
Pulls telemetry from the EDR, firewall, identity and cloud tools you already run.
Common data model
Events from different vendors mapped to one schema so a single rule reads them all.
Asset and identity context
Every event tagged with who and what it concerns before detection runs.
Cross-tool correlation
Links weak signals across products that each look benign on their own.
Identity-based attack detection
Catches credential misuse that shows up as ordinary logins in every individual tool.
Behavioural baselines
Scores deviation per user and entity across the combined telemetry.
Risk-ranked cases
Related alerts grouped and ranked so the queue reflects real exposure.
Search across sources
Analysts query all ingested telemetry from one place rather than console by console.
Cross-tool response
Containment pushed back through integrated products, with approval gates.
One investigation surface
Evidence from every tool assembled on a single case timeline.
Watch Gurucul Open XDR in action
The vendor-neutral ingestion story, and the platform underneath.
REVEAL Demo: Open and Flexible
The vendor-neutral ingestion story.
Gurucul REVEAL — Platform Overview
The platform it runs on.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Detection across tools you already paid for.
Here’s what genuinely sets Gurucul Open XDR apart (and where a single-vendor XDR may fit better).
It works with the tools you already bought
Most organisations do not get to start clean. You have an EDR chosen three years ago, a firewall estate from a different decision, an identity provider nobody will migrate off, and a cloud platform your developers picked. An XDR that requires its own agent everywhere is asking you to re-run all of those decisions at once, which is why so many XDR deployments stall at the pilot. Open XDR's premise is to take telemetry from what you have. For an Indian mid-market buyer with a heterogeneous estate assembled over a decade, that is often the difference between a project that ships and one that becomes a migration programme nobody funds.
Identity is the layer that makes it more than aggregation
Collecting alerts from six tools into one console is not detection, it is a queue. What makes this worth more than aggregation is what runs on top: behavioural and identity analytics that ask whether this activity is normal for this user and whether the access being used should even exist. Identity-based attacks are the specific case where this matters, because there is nothing anomalous to see in any individual tool — the login succeeded, the file access was permitted, the cloud API call was authorised. Only correlating them against a behavioural baseline and an entitlement model surfaces the pattern.
One platform, not a second data lake
Because Open XDR runs on REVEAL alongside the SIEM and UEBA, the telemetry it ingests is the same telemetry the SIEM reasons over — one data model, one store, one query surface. The alternative pattern, which is common, is an XDR that maintains its own copy of your data next to your SIEM's copy, so you pay to store everything twice and analysts learn two query languages to answer one question. Avoiding that is a real operational saving, and it compounds as data volume grows.
The honest caveat: test the openness rather than believing it
We are going to be direct about this because it is the thing most likely to disappoint you. Every XDR vendor claims openness. The claim is almost never false and almost never means what a buyer assumes. The meaningful question is depth: does the connector for your EDR pull rich process, authentication and file telemetry that analytics can reason over, or does it receive that product's finished alerts and forward them? Both are legitimately called an integration. Only one supports investigation. Pick the two or three tools you most depend on, and during the proof of concept check exactly what arrives for each. If a connector turns out to be alert-forwarding for a tool that carries half your detection value, that changes the product's value to you substantially — and it is far better learned in a PoC than in an incident.
What it is not
Open XDR is not a managed service. Nobody at Gurucul is watching your alerts or responding on your behalf, and buyers conflate XDR with MDR routinely enough that it is worth stating. It is also not a replacement for your EDR — it consumes endpoint telemetry, it does not provide endpoint prevention, so you still need whatever is doing the blocking. And it runs on the REVEAL platform, so ask how it is packaged against any Gurucul SIEM entitlement you already hold. If what you actually need is somebody watching your environment around the clock, that is a different purchase and we can point you at it.
The honest positioning
Choose Open XDR when you have real telemetry spread across tools you cannot or will not replace, and you want identity-aware detection over all of it rather than six consoles nobody has time to watch. It is strongest for exactly the estate that makes pure-play XDR awkward — heterogeneous, accumulated, politically difficult to consolidate. Look elsewhere if you are standardised on a single vendor's stack already, because CrowdStrike or Microsoft will give you deeper native integration within their own estate than any open platform will across it. And look elsewhere if you need someone else to operate it, because this is a product, not a service.
The numbers behind the platform
What your Gurucul Open XDR rollout looks like
Inventory the tools you will keep
List the EDR, firewall, identity provider, email and cloud tools that stay. Open XDR’s value is proportional to how much of that estate it reads deeply, so this list is the scope.
Test connector depth first
For your three most important tools, check what actually arrives: process, auth and file telemetry, or only finished alerts. Rank connectors by depth before signing.
Onboard by detection value
Connect identity and endpoint telemetry first, then network and cloud. Validate normalisation on each source with a known test event before adding the next.
Tune cross-tool correlation
Review which linked cases were real and which were coincidental overlaps. Adjust correlation windows and identity weighting rather than muting whole sources.
Prove each response action
Enable automated actions one integration at a time, with approval gates, and re-test after tool upgrades — a vendor API change can silently break a playbook.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“We had four detection tools and nobody watching all of them. Open XDR gave us one queue without ripping out the EDR we had just renewed.”
“Test the connectors on your own stack. One of ours sent full process telemetry; another only forwarded finished alerts, which changed what we could investigate.”
“The identity layer is what made it more than a SIEM rename. A contractor account touching three tools in an hour showed up as one case.”
“It is a product, not a service. XDR changed what our analysts looked at, not whether someone still had to be on shift to look.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the XDR and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid — Standing × Deployment Freedom
Analyst standing against where the platform is allowed to run — the pair that decides a regulated Indian shortlist.
2025 MQ Leader — and the only Leader we sell that self-hosts.
The Convergence × Effort Map
How much of SIEM, UEBA and response share one data model, against how much of the platform you must run yourself.
One data model — SIEM, UEBA, identity and NTA.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Gurucul Open XDR vs the field
The XDR field — honest lanes. Native XDR goes deepest inside one vendor’s stack; Gurucul’s edge is breadth across mixed tools, read through identity. We sell both kinds.
| Dimension | Gurucul | Securonix | Exabeam | Microsoft Sentinel | Splunk ES |
|---|---|---|---|---|---|
| 2025 Gartner MQ | Leader — first year, after 3 as Visionary | Leader, 6 consecutive years | Leader, 6th time | Leader | Leader, 11th consecutive |
| Self-hosted / on-premises | YES — SaaS, cloud or self-hosted per Gartner | No — control plane is always their cloud | Via LogRhythm, a second platform | Cloud-only on Azure | Yes, and priced accordingly |
| Pricing axis | Per asset / per user, OR data volume / EPS | GB/day in tiered bands | GB ingested per day (2023 list) | Per GB ingested per day | Ingest or workload — the priciest here |
| Behavioural analytics | The founding capability, built 2010 | The founding capability | The founding capability | UEBA included | Available, add-on heritage |
| India data residency | Self-hosted: yours. No vendor India region found | BYO-AWS/Snowflake can hold data in India | Self-hosted via LogRhythm | Azure India regions available | Self-hosted: yours to place |
| Vendor scale | Bootstrapped boutique — no war chest | VC-backed, ~450 engineers in India | Post-merger with LogRhythm | Microsoft | Cisco-owned |
| Analyst breadth | Gartner-specific — absent from 2025 Forrester Wave | In both Gartner and Forrester | In both | In both | In both |
| The thing to plan around | Air-gap unverified; confirm the pricing axis | No air-gap at all; 120% default overage | Two platforms post-merger | Azure portal retires 31 Mar 2027 | Untuned, it is the costliest log archive there is |
| Best fit | On-premises mandates needing an analyst-recognised product | Cloud-accepting estates wanting retention solved | UEBA-led SOC, or on-prem via LogRhythm | Microsoft estates with E5 | Engineers who will build with it |
Does Gurucul Open XDR fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Gurucul Open XDR if…
- ✓You have real telemetry spread across tools you cannot or will not replace
- ✓You want identity-aware detection over all of it rather than six consoles
- ✓You will actually test connector DEPTH during the proof of concept
- ✓You accept this is a product, not a managed service — nobody watches it for you
Choose Securonix if…
- ✓Cloud is acceptable and you want the larger vendor with a six-year Leader run
- ✓365 days of hot searchable data as standard matters to your investigations
- ✓You accept there is no air-gapped or on-premises option in any configuration
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 with E5 — first-party logs ingest free
- ✓Azure India regions answer your residency question directly
- ✓You accept cloud-only on Azure, and the portal migration by 31 Mar 2027
Choose Elastic or Wazuh if…
- ✓You need a genuine air gap and have platform engineers to operate it
- ✓You would rather trade analyst standing for deployment freedom and cost control
- ✓Wazuh’s core is free under GPLv2; Elastic self-manages at the Basic tier
Gurucul Open XDR is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
Assets or gigabytes — which meter suits you?
Gurucul can meter per asset or per user as an alternative to per-gigabyte ingest. That is the comparison worth modelling, because it is the one that changes behaviour: on an ingest-priced SIEM every improvement in logging coverage raises the invoice, so teams quietly stop collecting the sources that would have caught the intrusion. Drag each slider — one for the assets you’d put under licence, one for the per-day ingest an ingest-metered SIEM would invoice. The point is not the exact number, since Gurucul is quote-only. It is the shape: asset counts change slowly, log volume only ever goes up. Indicative Indian-market rates.
If the saving reads zero, the ingest-priced SIEM is genuinely cheaper at your ratio and you should say so internally rather than force the comparison. And remember the precision that matters here: Gurucul offers per-asset pricing as an alternative to per-GB, not instead of it — data-volume and EPS options exist on the same list. Which axis you land on is negotiated, so make it a clause rather than an assumption.
Three ways to consume it
Open XDR is quote-only and runs on Gurucul’s REVEAL platform; confirm in writing whether your quote treats it as a standalone licence or a module on a platform entitlement. The evaluation question is different and more important: connector depth. Every XDR vendor claims openness, and the claim is almost never false and almost never means what a buyer assumes — rich normalised telemetry and forwarded alerts are both called integrations, and only one supports an investigation. Test it on your own stack. TechBag quotes in INR with GST.
On REVEAL
No second data lake
- Shares one store with Gurucul's SIEM if you run it
- One query surface, one data model
- Get standalone-vs-module in writing
What to test in the PoC
The thing that decides its value
- Rich telemetry, or just forwarded alerts?
- Check your two or three most depended-on tools
- This is far cheaper to learn in a PoC than an incident
What it is not
Scope limits
- Not MDR — nobody watches your alerts for you
- Not an EDR — it consumes endpoint telemetry, does not prevent
- Not a SIEM — retention and compliance sit elsewhere
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every XDR vendor
Take this into your next vendor call — including ours.
Which of our existing tools will Open XDR ingest in depth, and which will it only forward alerts from?
For our top three tools, which exact fields arrive — process, authentication, file, network?
Which connectors can act back into the tool, and which are read-only?
Which identity providers feed the analytics, and how are accounts resolved across tools?
Does the telemetry land in the same store as our SIEM, or create a second copy we pay for?
Who maintains a connector when a tool vendor changes its API?
Who watches the queue around the clock? Open XDR is a product, not MDR.
Is Open XDR quoted standalone or as a module on a REVEAL entitlement?
Where is telemetry stored, and is that region documented in writing?
Would the native XDR from our main EDR vendor cover enough to make this unnecessary?
Questions buyers ask
Ready to evaluate Gurucul Open XDR?
Map the tools you already own, test connector depth on your stack, or get an honest open-vs-native XDR comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.