We used Exabeam as a log aggregation platform. We had a SIEM platform, Exabeam, that was ingesting logs from various vendors hosting EDR solutions on behalf of our clients. Exabeam allowed us to parse logs from sources like CrowdStrike, Palo Alto, or Windows logs, all into one platform.
The UI was very clean. Its identity and access management were robust. We had many colleagues interacting with it, and when I was adding parsing rules or configuring other changes, I could propagate those changes in real-time very fast.
One area that needs improvement is interacting with Exabeam's API. There was a headache regarding the API; the documentation wasn't clear, and the syntax wasn't very precise. This situation arose when we needed to retrieve a list of public IPs to block, and it required interacting with Exabeam's API on the cloud platform.
I worked with Exabeam for about three months during an internship engagement at Grant Thornton. The last time I used it was more than a year ago.
The solution is stable.
There was a fair bit of latency when accessing it via a web browser. The platform seems to be very application intensive, which led to some pet peeves regarding latency.
The customer support was quite good. They had a solid customer support platform, and their responses were always very instantaneous. Early in my internship, we needed access to the platform to start learning, and Exabeam’s customer support quickly provided us with accounts with lower privileges.
In my own setup, I use the Elk Stack: Elasticsearch, Logstash, and Kibana, which I am more accustomed to.
I'd rate the solution six out of ten.
