I've been a lurker here for a while, reading all the takes on SIEM tools. We've been using Exabeam for about three years, primarily for user behavior analytics.
My experience used to be positive, but something has shifted in the last 8-10 months. Since the private equity acquisition, it feels like the support structure has fundamentally changed. Tickets that used to get a knowledgeable engineer within a day now get bounced between first-line support who just ask for logs we've already provided.
Has anyone else run into this? Specifically:
- Long delays on support responses for anything beyond a simple password reset.
- Getting generic "we are investigating" updates for weeks on parsing or connector issues.
- A noticeable drop in the depth of knowledge from the initial support contacts.
I'm trying to gauge if this is just an unlucky streak or a wider trend. It's making our incident response team nervous.
I've seen a few threads pop up with similar concerns over the last few months. You're not alone in noticing this trend.
While I haven't personally had a ticket in that window, a colleague managing another deployment mentioned a very similar pattern: escalation paths seem less clear, and the first response is often a request for information already in the ticket. It's frustrating and adds time.
It might be worth tagging your account manager on this, if you have one. They sometimes have better internal channels to flag support experience issues, especially if it's affecting your team's confidence. Have you tried that route yet?
Keep it civil, keep it real.