Hi everyone, I've been lurking for a bit while trying to navigate a vendor selection process at my company. We're a mid-sized organization without a dedicated detection engineer or a deep security operations bench. Our team is essentially a sysadmin, a network guy, and me (coming from a general IT infrastructure background). We're finally getting a SIEM/UEBA/SOAR budget approved, and after initial RFP rounds, we're down to LogRhythm and Exabeam.
My primary evaluation criteria isn't about which one has the most advanced feature on paper—it's about which platform will actually get used and not become shelfware because it's too complex or labor-intensive for our small, stretched-thin team. We need something that works out of the box with minimal tuning, and where the playbook/SOAR component doesn't require a PhD to automate basic triage.
From our demos and POC, I've gathered some initial impressions, but I'd really appreciate real-world feedback, especially from teams of a similar size.
**LogRhythm**
* The on-prem option seemed very... *comprehensive*, but also felt like it had a lot of moving parts (AI Engine, Data Processors, etc.). The cloud-hosted "LogRhythm Axon" platform seemed more streamlined.
* Their "out-of-the-box" content, like rules and dashboards, seemed plentiful, but I'm worried about the noise floor. How much initial and ongoing pruning does it need to stay relevant?
* The playbook designer in Axon looked graphical and approachable for non-coders. Is that a fair assessment, or does building anything useful still require deep backend knowledge?
**Exabeam**
* The session-based analytics and the "timeline" view for investigations seemed incredibly intuitive. This feels like it might reduce mean time to understand (MTTU) for our team.
* Their "Security Operations Platform" bundles UEBA, SIEM, and SOAR, which seems cohesive. The focus on automated threat timelines and peer group analysis seems like it could do a lot of heavy lifting for us.
* My big question is about the SOAR piece (formerly Devo SOAR). How integrated is it really with the analytics? Is building automation as straightforward as they make it look in a sales demo, or is there a steep learning curve hidden?
My core concerns, in order of priority, are:
1. **Time-to-Value:** Which platform gets us to a state of basic, reliable alerting and investigation with the least initial configuration headache?
2. **Ongoing Maintenance:** Which one requires less dedicated "care and feeding" to keep its detection quality high? We cannot have a full-time person tweaking rules.
3. **Automation Accessibility:** For a team with zero Python/scripting expertise in security contexts, which platform's SOAR/orchestration is more accessible for creating simple auto-triage (like blocking an IP in the firewall after a certain confidence score)?
The TCO conversation is also heavily leaning towards operational overhead, not just licensing. Any insights on support experiences, documentation quality, or community resources for these two would be immensely helpful. We're trying to avoid a situation where we buy a Ferrari but only have the skills to drive a tractor.
I'm a security lead at a 250-person financial services firm, and we handle our own infra with a team of three. We've run Exabeam's cloud SaaS platform in production for about two years now.
1. **Team Fit for Generalists**: Exabeam is built for the "not a detection engineer" crowd. The default correlation rules (they call them "behavioral analytics") for common use cases like impossible travel or data exfiltration worked immediately after we connected our AD and CrowdStrike logs. LogRhythm's AI Engine felt powerful but required defining custom rule conditions that we just didn't have the expertise for.
2. **Deployment & Integration Velocity**: The Exabeam cloud deployment was functional in a week. We used their generic syslog connector and their pre-built parsers for our core apps. In contrast, the LogRhythm on-prem POC took us three weeks just to get the components stood up and talking. Their cloud-hosted Axon platform is a simpler story, but its feature parity with their classic suite was a concern.
3. **SOAR Automation (Playbooks)**: Exabeam's "Case Management" and automation for basic tasks like disabling a flagged AD account or quarantining a device are drag-and-drop, using a simple trigger/action model. It's not a full SOAR like Phantom, but that's the point - we could use it. LogRhythm's playbook builder felt like a more complex development environment we'd never have time to master.
4. **Pricing & Operational Cost**: In our tier (ingesting ~80 GB/day), Exabeam's SaaS pricing was straightforward per-GB. LogRhythm's licensing model had more variables (EPS, features, nodes) that made true cost opaque. The bigger hidden cost for us was time: we spend maybe 5 hours a week tuning Exabeam. The LogRhythm POC required nearly that daily to feel on top of it.
I'd recommend Exabeam for your exact scenario - a small team needing out-of-the-box detection and straightforward automation without deep expertise. If you're absolutely committed to an on-prem deployment or have a massive, complex log source that needs deep packet-level parsing, then LogRhythm might be necessary, but you'd need to tell us your top two compliance or architectural constraints to be sure.