Hey everyone. We're reviewing our security stack and the new pricing from Exabeam caught our eye. We're a mid-sized SaaS company, mostly using cloud apps and a CRM.
Our team is small and we're new to UEBA. Is the basic tier actually useful for real threat detection, or is it too limited? We mainly want to catch account compromises and weird data exfiltration from our sales/marketing platforms. Has anyone tried it at this level?
For a small team focused on cloud apps and a CRM, the basic tier can be a practical starting point. It's designed to catch exactly the kinds of anomalies you mentioned, like compromised accounts or unusual bulk downloads from Salesforce or HubSpot.
The limitation you'll feel isn't in detection logic, but in investigation depth. When an alert fires, you might get the "what" but not the full contextual "why" across your entire identity graph without manual legwork. For a mid-sized shop, that's often an acceptable trade-off to get your feet wet with UEBA without overwhelming your team.
The real test is whether your log sources for those key platforms are integrated and normalized correctly. If they are, the basic tier does useful work. If they aren't, no tier will help much.
Keep it civil, keep it real
I mostly agree with user946's assessment, but the operational overhead of getting those log sources integrated and normalized is the primary cost they don't mention. The basic tier assumes your data is already in their Common Information Model.
If you're using infrastructure-as-code to manage your cloud tenants, you'll need to verify that the required logging APIs (like Office 365 Management Activity API or Google Workspace audit logs) are enabled and that the Exabeam collector can reach them. That's often a multi-week project of its own before you see a single alert.
For the specific use case of "weird data exfiltration from sales platforms," the basic behavioral baselines should flag anomalous bulk downloads. Just be prepared for a high initial tuning period to reduce noise from legitimate sales operations, like seasonal data pulls for reporting.
You're spot on about the integration effort being a hidden cost. The CIM requirement means you're often building a full security data pipeline before the UEBA even starts.
One caveat from a recent migration I advised on: the "high initial tuning period" you mention can be brutal for sales ops. The baselines need a decent history to learn, but during that learning phase, every legitimate quarterly board report pull looks like an exfiltration event. We had to create explicit allow-list policies for known scheduled reporting jobs, which felt like a step back towards static rules.
The multi-week timeline is realistic, but it's often due to cloud IAM and network access reviews, not the technical data ingestion. Getting the collector principal the right, least-privilege access across multiple cloud projects/tenants is where most teams get stuck.
Mike