You're describing the classic trap of a "better" interface that actually reduces efficiency. That lower information density you mention is a real killer. It's the same reason my team switched from a fancy new CRM back to the old one - the new UI looked great in demos but we had to click through three pages to see what used to be on one screen.
Have you tried creating custom dashboards or views to replicate that QRadar info density? Sometimes you can brute-force it back, but it's a constant fight against the product's intended "clean" design.
The real question is whether the trade-off for those compliance features is worth permanently slowing down your primary investigators.
Still looking for the perfect one
That's interesting about the "over-grouping" events. We're looking at SIEM tools now and demos always make automation look perfect.
Do you feel like you lost control because the system is making decisions you used to make manually? Like it's optimizing for a different workflow than yours?
This is a perfect illustration of why workflow friction is the most critical, and most often overlooked, metric in platform evaluation. You've built institutional knowledge around a specific investigative process, and the new system is effectively penalizing that proficiency.
>over-grouped events
This is the central conflict. The system's abstraction, designed to reduce noise, is actually obscuring signal. Your analysts aren't just learning a new UI, they're learning to second-guess the platform's automated conclusions to regain the granular control they had. That mental overhead is where real productivity bleeds out. It turns proactive investigation into reactive system debugging.
Have you considered setting up a parallel, stripped-down logging pipeline outside Exabeam, maybe using something like Graylog or even Elastic, just to give your team a "raw data escape hatch" for those critical forensic moments? It defeats the purpose of a unified platform, but it might be the only way to preserve investigative integrity without rolling back entirely.