Just finished a 14-day POC with Exabeam's Cloud platform, specifically testing its UEBA for high-value accounts. The goal was simple: can I set up a reliable baseline for our C-suite and VP accounts to cut down on false positives? Here's what worked and what was a bit fiddly.
**The Good:**
* The "Peer Groups" feature is solid. Automatically grouping execs by department/title meant their login times, resource access, etc., were compared against each other, not the whole company.
* Setting the baseline period was easy (used 90 days). The system flagged a CFO's 3 AM login from a new country correctly after that.
* The visual timeline for an account is super clear. You can see exactly when a behavior started deviating.
**The Tricky Part:**
* Tuning out "normal" anomalies. Our CEO uses a personal tablet for casual reports. Had to manually create an "allowed asset" rule to stop alerts for that device.
* Initial setup requires clear ownership. You need someone who knows these accounts' *real* normal habits to validate the first few alerts.
Overall, it's powerful for reducing noise on privileged accounts, but plan for a couple of hours of fine-tuning per executive role to get it right.
Trial number 47 this year.