Having recently completed a proof-of-concept for a comprehensive SIEM and UEBA refresh, my team and I conducted a detailed evaluation of both Exabeam and Darktrace, with a specific focus on their capabilities for internal network threat detection. While they are often mentioned in the same conversations, their architectural philosophies and operational overhead differ significantly. Our primary test case involved the detection of lateral movement and data exfiltration patterns within a segmented AWS VPC and on-premises VMware environment.
The core distinction lies in Exabeam's foundation as a **Session-based Analytics** engine versus Darktrace's **Probabilistic Bayesian Network** approach. Exabeam constructs "sessionized" timelines of user and entity behavior, applying statistical models to identify deviations from learned baselines. Darktrace, in contrast, uses an unsupervised, neural network-inspired model to calculate an "AI score" for every network interaction, claiming to identify novel threats without prior training.
From a performance and scalability perspective, we benchmarked both solutions against identical synthetic workload, simulating 25,000 EPS of parsed network flow data (NetFlow V9) enriched with Active Directory logs.
**Exabeam (New-SaaS Platform)**
* **Ingestion & Processing:** The sessionization process for our test dataset introduced a 2-4 minute latency from log ingestion to alert appearance in the Security Analytics dashboard. This was consistent but must be factored into response workflows.
* **Resource Utilization:** The Exabeam Data Lake (built on OpenSearch) required significant scaling for hot storage to maintain query performance under continuous load. Our cost projection for data retention exceeded initial estimates by ~40%.
* **Detection Tuning:** The out-of-the-box "Threat Hunter" rules for lateral movement (e.g., "Suspicious SMB Connection Followed by Spike in Data Transfer") were effective but generated numerous false positives that required tuning of risk scores and threshold parameters. Example of a custom rule condition we had to adjust:
```javascript
// Example condition for anomalous data transfer post SMB
session.asset.high_risk = true &&
session.event_type = "network_flow" &&
session.bytes_sent > threshold_percentile(95, over=7d) &&
exists(session.previous.event_type = "smb_access")
```
**Darktrace (Enterprise Immune System)**
* **Ingestion & Processing:** Network traffic analysis was near real-time (sub-30 second latency). However, the system's "black box" nature made it difficult to validate its model's logic. Alerts for "Suspicious SMB/Winexe Activity" or "Devices Using Unusual Ports" were triggered, but the "why" was often buried in a dynamic probability graph, not a discrete rule.
* **Resource Utilization:** As a primarily network-sensor-based appliance (virtual or physical), its resource footprint was predictable but required dedicated, non-cloud infrastructure at each monitored network segment, increasing operational complexity.
* **Detection Tuning:** Tuning is not rule-based but involves adjusting the overall "sensitivity" of models and modifying the "expected pattern of life" for devices. This is more art than science and requires deep familiarity with the network's normal "chatter."
**Key Finding:** Exabeam excelled in providing auditable, forensic timelines that were invaluable for post-incident investigation and meeting compliance requirements for user accountability. Darktrace was faster at highlighting anomalous network connections that had never been seen before, but correlating those anomalies to a specific user or process often required integration with another data source like a SIEM.
For our use case, which demanded tight integration with existing ticketing and SOAR platforms and clear narrative-building for incidents, Exabeam's session-based approach proved more actionable. However, for a team focused purely on network intrusion detection with a "set and forget" mentality, Darktrace's autonomous detection has merit. I am interested in hearing from others who have operated both at scale, particularly regarding long-term tuning stability and the true total cost of ownership beyond the first year.
-ck