Exabeam Reviews

I have been using Exabeam Fusion SIEM for about a year because it is the newer cloud native based solution with user behavior analytics, a cloud native data lake, playbooks, incident response, enrichment, and investigations.

I use Exabeam Fusion SIEM to ingest all the different tool sets from our environment, aggregate and examine the logs or Syslogs, and provide enrichment through threat intelligence or geolocation. We ingest, source, and store the data. We use it for most all functions except the incident response module, which we do not have.

I find that the case management and case enrichment in Exabeam Fusion SIEM are excellent, along with the auto investigate alert feature in incident investigation. The features I appreciate allow us to ingest from all of our tools, whether they are on-premise or in the cloud, through threat intelligence or context.

I appreciate that Exabeam Fusion SIEM has so many rules built in, approximately eight hundred and fifty, and almost five hundred fifty integrations along with the behavior histograms. I also value the dashboards and LogStream, which has the ability to parse the data and normalize it.

I would appreciate seeing additional dashboards in Exabeam Fusion SIEM or perhaps more options or the ability to customize them further. While we can customize them currently, there may be additional options available.

I value the outcomes navigator because it matches the log piece to the use cases, which is helpful. The correlation rules are excellent. I am interested in whether there are additional threat intelligence feeds available that we could use, whether we can integrate our own, or if we could ingest different ones.

I have been using Exabeam Fusion SIEM for about a year because it is the newer solution.

Regarding stability, I would rate Exabeam Fusion SIEM at approximately eight to eight and a half out of ten because it is very stable. We have not had any real issues. The only incident was when our activity once got taken down, which impacted availability because of the cloud, but that was not caused by Fusion; it occurred because someone cut our connection to the Internet.

I believe Exabeam Fusion SIEM is excellent regarding scalability, and I would rate it at approximately an eight out of ten.

Every now and then, we might contact technical support for Exabeam Fusion SIEM if a new analyst joins the team. The customer success services are very good.

I would rate Exabeam Fusion SIEM support team a nine out of ten; I do not give anyone a perfect score.

We were a Splunk shop years ago, and then we moved to their ES platform, which became very cost prohibitive. That is why we considered Exabeam Fusion SIEM. When you adopt Splunk ES, they claim it is excellent, but the EPS is really where they charge you significantly.

Setting up Exabeam Fusion SIEM was quite easy. We did not have to learn a great deal, especially around the dashboards and some of the other features, which was beneficial. The learning curve was not steep. We do appreciate the advanced analytics and the features they have mapped.

It took approximately sixty to ninety days to fully deploy Exabeam Fusion SIEM.

We completed the deployment of Exabeam Fusion SIEM in-house.

I have seen a return on investment with Exabeam Fusion SIEM, and it is worth the money.

I would say the pricing for Exabeam Fusion SIEM is not cost prohibitive, but it was a little more than I initially thought. However, that is acceptable because we derive significant value from it, and the ROI is good so that I can illustrate that benefit.

I would say the pricing for Exabeam Fusion SIEM is not cost prohibitive, but it was a little more than I initially thought.

We were a Splunk shop years ago, and then we moved to their ES platform, which became very cost prohibitive. That is why we considered Exabeam Fusion SIEM. When you adopt Splunk ES, they claim it is excellent, but the EPS is really where they charge you significantly.

Overall, I would rate Exabeam Fusion SIEM team a nine out of ten, with ten being the best. I would tell others looking into using Exabeam Fusion SIEM for the first time to take a hard look at it. My overall review rating for this product is nine out of ten.

I usually work with Exabeam for buying the SIEM and the SOAR solution, and I have already sold the solution to one of my prestigious customers in Singapore.

Exabeam's typical use cases involve the SIEM solution. When a customer is unable to have visibility of their organization or is unable to analyze the logs and what is happening in and around their infrastructure, that is when I use Exabeam solution.

Exabeam's UEBA is the most valuable feature that I have found so far.

Exabeam's UEBA displays the type of description that it could show in a console regarding one particular user, the rating that it shows, and how vulnerable the user is, which is very good.

Exabeam's automation for incident response is very good. The machine learning capabilities of Exabeam are also good.

Exabeam's integration capabilities are not good, as Exabeam has a very limited number of integrations and no out-of-box integration, which is an area where Exabeam should improve.

I have noticed that Exabeam's visibility in Singapore is very low, as it needs to have more customers.

I have been working with Exabeam for two and a half years.

Overall, I think Exabeam's stability level is good.

If I were to rate its stability from one to ten, I would rate it an eight.

I have not noticed any issues with the stability, though this is what I have heard from my internal team, and I do not have any explanation for it.

Regarding Exabeam's scalability and how well it adapts to its customers' needs, I would rate it an eight.

I have never communicated with Exabeam's technical support and customer service.

What I have heard about their services is that it is good.

I also had the chance to look at the documentation, and the documentation is good.

What I have heard is that Exabeam's initial setup and deployment is not difficult; it is easier and not complex. I can only provide my response on a very high level because I am a seller.

I am not a user of this; I am in presales. I know these features exist, but I do not implement the solution, so I do not have much information.

What I have heard from my implementation team, from the internet, and from my internal team is that it is good. I am the person who sells it, not the person who uses it or implements it.

Exabeam is good compared to Splunk. Splunk is more expensive than Exabeam.

I consider Exabeam affordable, but some of my customers think that it is a bit too expensive.

Regarding Exabeam's pricing, cost, and licensing, I think it is good. I would rate this review an eight.

I use Exabeam for it's end-to-end detection and it's user event behavioural Analytics, i find it a useful SIEM for investigating unusual behaviour by clicking into an incident from the main dashboard. From here we can go into the details of the incident, which are shown by the individual risk reasons associated with the incident. We use the events time line to investigate what events happened before and after the incident, i find it useful as we can view the event logs which shows the events as they occurred in order which helps in the incident investigation outcome.

The Exabeam SIEM has a user friendly UI interface.

The Exabeam SIEM has a clear dashboard experience which helps in monitoring the incidents as they occur, Exabeam's search facility is user friendly. You need some background experience and training to get familiar with the tool initially, however once the basics are grasped the Exabeam solution is quite straightforward to use and I think most people could pick it up and use it without to much of an issue.

When events come into the system, the dashboard categorizes them by the highest risk score, not when they appear on the system. When you've got multiple ongoing incidents you can only see the highest risk score at the top of the list rather than the most recent detection.

Exabeam's reporting dashboard could have included a filtering option to filter by the most recent detection.

I have been using Exabeam for one year.

The system generates errors at times, however these errors can clear in 1 to 12 hours. 

I rate the solution’s stability an eight out of ten.

We contact the technical support team and log tickets for errors that appear, logging tickets with Exabeam is straightforward.

The solution's user behaviour analytics identifies unusual behaviour and the clear risk scores showing the level of risk associated with an event, using the Exabeam Data lake is a great log management tool. Exabeam data lake provides an easy way for your security analysts to quickly find the information they’re after, instead of spending their time visually parsing through lines of dense event logs.

I would recommend Exabeam to other users because it is a user-friendly tool compared to other SIEM products, with it's event time line 

Overall, I rate the solution a nine out of ten.

The primary use case for Exabeam was to monitor security incidents and run our SOC operation. It is a SIEM tool used in our organization to handle security incidents effectively by creating a timeline or profiling based on the log sources.

Exabeam has improved our organization by speeding up the investigation process. Providing a user's profiling page allows us to see the rules a user triggered in both past and current sessions, which helps when making forward decisions. 

It also improves the speed of the investigative process by having timelines of most events or triggered events.

The most valuable feature of Exabeam is the timeline creation based on log sources, which helps in security investigations. 

Another valuable feature is the Real Excel search, which is easy to learn and use for search hunting. Exabeam's AI capabilities, like the natural language mode, convert natural language into Exabeam queries, enhancing ease of use.

Exabeam needs to improve its documentation and provide more customization for dashboards and case management. The documentation is lacking in certain areas and should be more comprehensive. The technical support service also requires significant improvement.

I have approximately two years of experience with Exabeam.

The stability of Exabeam is generally good, although we have faced occasional issues such as the engine going down. However, these problems were not frequent, and the last six to eight months have been stable.

Exabeam is scalable. Although I do not have direct experience with the scaling process, it appears very much likely to be scalable.

The customer service and support are not satisfactory. Even with TAM support from Exabeam, many issues go unresolved, and their response time is slow compared to other technical support teams.

Neutral

Exabeam was the first SIEM choice for my organization, so there was no switching from another product.

The initial setup was relatively easy. The log onboarding process was somewhat better, and it was easier to implement Exabeam than other SIEM tools.

During the implementation process, five of us were working on it, along with two people from Exabeam's side.

I would recommend Exabeam to other organizations, especially those looking for a modern next-gen SIEM solution. It is good for small to medium organizations with two thousand to ten thousand users.

I'd rate the solution seven out of ten.

We were using Exabeam for security purposes only. We were collecting and storing security events from endpoints, cloud infrastructure, and data from various resources for analysis. 

We worked on incident detection, identifying user behavior and how users log into different applications that trigger conditional access policies and detect any external attacks. We had set up a conditional access policy using Azure to receive alerts. 

Additionally, we implemented an automated system for incident reporting that triggers notifications on our phones using PagerDuty. This setup was also extended to cloud systems, including Microsoft Azure and AWS, with certain thresholds.

Exabeam's alert triage automatically analyzes alerts and correlates them with log data and user behavior, helping us identify true and false positives. This has been important in prioritizing incidents using machine learning. 

It reduces the time security teams spend on low-risk incidents. Automated playbooks in Exabeam have been effective in common incidents such as isolating compromised devices or resetting users' credentials.

Exabeam is very easy to use, with a straightforward platform and workflow, unlike other tools that require more expertise. Its advanced analytics, including behavior analytics and machine learning, are very helpful in detecting complex threats. The automation capabilities reduce the workload significantly and help prioritize vulnerabilities based on business context, providing practical fixes.

Exabeam should be a bit faster, especially in loading and vulnerability scanning. It should be more integrated with cloud-native networks and hybrid environments. I faced issues with integration, particularly with AWS. Another area to address is the high number of false positives, which consumes a lot of time in identification.

I have been working with the Exabeam solution for around three years.

The main issue affecting stability is the processing time, which is too long. The scanning part is notably slow and could be improved.

Scalability was all good.

When I escalated issues to technical support, it initially took them fifteen to twenty minutes to respond. Eventually, the response time became longer.

Positive

We previously used Splunk and Polar Alto Cortex XOR, particularly because of integration issues with Palo Alto. We moved to Exabeam from Splunk.

The initial setup required deploying Exabeam possibly using Postgres and Java on the servers. I was heavily involved in preparing the infrastructure, like setting up servers, opening specific ports, and implementing firewall rules for communication. Integration with Active Directory was also part of the setup.

Overall performance was very good. That said, I am not informed about the pricing and budget components.

I do not have much information about the pricing. However, I am aware that Exabeam is cheaper than Palo Alto based on discussions in meetings.

We have experience with Splunk, IBM Resilient, and Polar Alto Cortex XR.

Exabeam is suitable for medium-sized organizations, as it is pretty fast for that scale. However, there are performance lags when used by larger organizations. Exabeam needs improvements in increased performance and detection efficiency for large organizations.

I'd rate the solution nine out of ten.

We use the product for security information and event management, user entity and behavior analytics, compliance, and anomaly detection.

The platform's most beneficial features include the correlation engine, behavior analytics, and integration capabilities.

One area for the solution's improvement is integration capabilities, particularly out-of-the-box integration which sometimes requires additional professional services.

I would like to see more capabilities in the Security Orchestration Automation and Response (SOAR) aspect. 

We have been using Exabeam for almost a year. We are using the cloud version, specifically as a SaaS solution.

I rate the product stability a nine. 

We have more than 2,000 end users working with Exabeam. We plan to expand the number of users and devices. I rate the scalability a nine.

The technical support team is helpful. 

Positive

We previously used SolarWinds and IBM products, including QRadar. We switched to Exabeam because it offers inbuilt capabilities like threat intelligence and case management. 

The deployment was relatively straightforward due to our prior knowledge of similar solutions, though only partially with challenges. It took between two weeks and one month to complete.

We handle maintenance ourselves, as it is managed through the cloud with automatic updates.

Exabeam has helped reduce costs by consolidating monitoring tools, potentially leading to a 15-20% reduction in operational expenses.

The platform is not extremely expensive compared to its direct competitors; I would rate its pricing around six out of ten.

The product's integration with other vendors' solutions is better than some alternatives but not the best overall.

Its AI capabilities enhance threat intelligence and analytics, providing better visibility and correlation of incidents.

I recommend it to others and rate it an eight out of ten. 

We use Exabeam as a SIEM tool. The solution's automation capabilities are great.

The solution's reporting and dashboarding could be improved.

I have been using Exabeam for one year.

The solution’s stability has been good so far.

I rate the solution’s stability an eight out of ten.

Since Exabeam is a SaaS solution, we don't have any scaling issues. In our organization, around 10 to 12 people use the solution, but mainly, two people use it daily.

The solution’s technical support is good.

Positive

We used to have Splunk as a solution, but we moved away from Splunk and used Exabeam because of UEBA (user and entity behavior analytics) and AA (Advanced Analytics). Splunk is a great tool, but we are a small team that has to do a lot of work. Exabeam sounds like an out-of-the-box solution for many of our specific use cases.

The solution's initial setup was straightforward, but it took a while to learn because it was new for us. We used professional services from Exabeam. However, it would have been difficult if we had to do it ourselves. The solution’s deployment took a week’s time.

Exabeam is not a cheap solution.

On a scale from one to ten, where one is cheap and ten is expensive, I rate the solution's pricing a six to seven out of ten.

Exabeam is a SaaS solution. The solution has contributed to our overall security costs and helped our incident management efficiency. We have seamlessly integrated Exabeam with other solutions like Azure, AWS, Google Cloud Platform (GCP), Google Workspace, and Microsoft Defender.

The solution's AI capabilities help us with behavior analytics. It's pretty good for understanding normal behavior versus abnormal behavior regarding access patterns and volumes of abnormal data transfer. It also has a great in-built risk scoring system. I would recommend the solution to other users because it's easy to set up and expand.

Overall, I rate the solution an eight out of ten.

So my use of Exabeam was primarily focused on ingesting logs from multiple web services. The current product is designed for our organization, which involves managing multiple web services and microservices deployed on different servers. Previously, before utilizing Exabeam, we had to manually log into each server and search for the existing logs. Tracking all the logs for various web services, whether in production or in other environments like pre-production, was a challenging task. 

To address this, we incorporated Exabeam agents, both collector agents for Windows servers and Linux servers. This allowed us to collect all the logs on a single platform. If we needed specific logs for a particular service, we could directly access them on the Exabeam Cloud. 

The problem I was facing was with the user interface (UI) when trying to identify the exact services and server names.

The problem I was facing was with the UI when trying to identify the exact services and server names. The UI's left panel was not as informative as I expected. Often, when we needed to retrieve specific information or details, the UI provided a lot of information along with filter criteria. Without the filter criteria, we had to make certain changes in the Exabeam UI. For example, there were three options available to display logs: raw, execution, and view. When selecting "raw," we obtained comprehensive information, but some details were repetitive, such as the server name, service name, method, and agent activities at different times. Although we could access this information, it took time to identify the exact log statement, especially in the case of exception-related log statements. Determining the timestamp at which a particular log was ingested posed a challenge.

This improvement will assist our developers in precisely identifying their logs. Even though you have provided a bar to create a customized dashboard for verifying logs of any service, there is still a problem. If a log is generated on the production server, let's say at 8:30 PM IST or at the present time, it takes a few seconds to be ingested into Exabeam Cloud. However, in the company, Exabeam always shows repetitive logs if my log file hasn't been generated. For example, if nothing has been logged or no action has been performed on the application for the past two hours, my log file will be empty. But still, by default, the agent collectors will check the specific location we configured for log ingestion. If that location doesn't contain anything, the logs are displayed on the screen by default. This is why we need to filter and search through numerous timestamps to find the exact location of our logs.

I have used Exabeam Fusion SIEM for over a year and a half. 

The stability of the product is best. I would rate it a nine out of ten. 

I would rate the scalability a seven out of ten. So there's room for improvement in terms of scalability as well.

The application is also scalable without any issues. However, when you add more and more filtering criteria, the application tends to slow down.

Previously, there were almost 100 users using this solution. 

Exabeam provided great support and helped us overcome any problems and obstacles we faced, especially when we had issues with the agent collector installation on a server. I'm happy with the support provided.

The setup is not difficult. It was easy. The documentation provided on the Exabeam documentation website was already there, so that was perfect. I didn't face any issues with that. The only challenge I had was figuring out how to find or filter the criteria to locate my exact log, as sometimes there are keywords or messages that are forwarded.

So, if I mention a forwarder with a specific IP address or server address, it gives me a whole bunch of logs that are already there. It would be great if I could access my latest or earliest logs.

There are many filter criteria available. I can retrieve logs from one hour, two hours, seven days, or twenty-four hours ago. But having logs in real-time would be very helpful. Real-time logs would be beneficial.

The reason I mention real-time is that, in ELK or Splunk, we don't face any issues when it comes to finding the exact log. They create a separate area where you can directly search for logs using keywords. 

However, in Exabeam's filter criteria, we need to use key-value pairs to match specific logs or services. For example, if I want to create a filtering criteria based on my service name, I need to specify the key as "service name," followed by a colon and the service name in double quotation marks. Similarly, with "forwarder: server address" I can locate logs for a specific service deployed on that server address.

The platform is perfect. There are no drawbacks or major issues. However, enhancing the UI with minimal filtering criteria would be really helpful. We should focus on improving the UI screens where all the logs are displayed.

I would recommend using the solution. The reason is when I approved the use of Exabeam; my client was facing issues managing logs deployed on different servers. So I suggested migrating all the logs to a single platform. They agreed, and we started exploring options, eventually choosing Exabeam. Now, my client exclusively uses Exabeam for log management.

But the only problem is that the UI is not very impressive. The UI lacks the ability to easily access all the necessary information. For example, when searching for specific keywords related to my service name or service address, the search results take some time to provide an exact match. It can be frustrating when the response time is slow.

Overall, I would rate the solution a nine out of ten. 

We struggled a bit with Exabeam initially, particularly with data ingestion, since it was at the early stage of our project. We experienced some downtime with the Data Lake when it was integrated with Exabeam.

Regarding IOC searches, which involve looking for malicious files or IP addresses, Data Lake provided good results when it was operational. Several instances of downtime affected our ability to perform these searches effectively.

It is user-friendly and quite simple to use.

Exabeam lacks customizable dashboards, which might be a limitation if visualization is a key requirement.

I have been using Exabeam for one and a half years. We implemented it as a SaaS tool in one of our clients.

We work with a Fortune 500 client, and the volume of data we handle is very large. The data ingestion is substantial, with a huge amount of data being processed daily. This heavy load sometimes causes issues with Exabeam, leading to downtime and other problems. As for the Data Lake, downtime has been less frequent, occurring only a few times, but it still affects our operations when it happens.

I rate the solution’s stability a seven-point five out of ten.

Splunk provides quick results, often within minutes, even for extensive searches. In contrast, QRadar can sometimes take an hour or more to deliver results, making Splunk more efficient. The Exabeam Data Lake also provides quick results, similar to Splunk, within minutes.

The initial setup is not easy. It takes some time. During the setup, we faced a few issues that could have been related to our environment rather than Exabeam itself.

One of Exabeam's competitors, like Splunk, has shown much better reliability with almost no downtime. In my two and a half years of experience, I've only encountered downtime with Splunk once or twice. I suggest Splunk is better than Exabeam because it is seamless and user-friendly. 

Exabeam can be a good option for medium-scale companies, especially if the pricing is lower than Splunk. However, if they need advanced visualizations and additional functionalities, Splunk would be a better choice. Exabeam lacks customizable dashboards, which might be a limitation if visualization is a key requirement.

Overall, I rate the solution as seven out of ten.