Global Tool Radar

Security & Privacy / Security Information and Event Management (SIEM) Software

Exabeam New-Scale SIEM Review, Pricing, Pros & Cons

Exabeam New-Scale SIEM is a cloud-native security information and event management product for collecting, normalizing, searching, detecting, investigating, and responding across enterprise security data.

Research by Global Tool Radar Research SystemEvidence checked: Sep 23, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • You need to collect and normalize security data from cloud, on-premises, and third-party sources: New-Scale SIEM supports collectors, Log Stream, Context Management, and CIM normalization at ingestion.
  • Your SOC needs high-performance search, correlation-rule detections, centralized investigations, and case workflows: The product page describes terabyte-scale investigation search, while the licensing matrix includes correlation rules, Search, Threat Center, and Automation Management for New-Scale SIEM.
More buying conditions
  • You need a cloud-delivered SIEM with selectable hosting regions and hybrid data collection: Exabeam states that New-Scale SIEM is delivered from Google Cloud Platform, customers select a hosting region at purchase, and collectors can run behind the firewall.
Not for
  • You require a self-hosted SIEM deployment: New-Scale SIEM is delivered from Google Cloud Platform; its on-premises component is collector deployment rather than self-hosting the SIEM platform.
  • You require Analytics rules or Attack Surface Insights in the base SIEM license: The official licensing matrix explicitly marks both capabilities as unsupported in New-Scale SIEM.
Pricing
  • Sales-assisted cloud-delivered term subscription. Current official product and licensing pages identify the New-Scale SIEM license and its add-ons but do not publish a numeric list price.
  • Paid amounts unverified — check official pricing
Free or trial access
  • No permanent free plan or time-limited free trial is stated on the reviewed official product and licensing pages. The product page offers expert contact and demo requests.

Product scope

Product functionality and purchase scope

This profile evaluates the cloud-delivered New-Scale SIEM license for collecting and normalizing security data, correlation-based detection, search, Threat Center investigations, case workflows, and Automation Management.

Product checked: Sep 23, 2026

Functionality reviewed
  • New-Scale SIEM term-subscription license
  • Collectors, Log Stream, and Context Management
  • Correlation rules, Search, Threat Center, dashboards, and Automation Management
  • Documented New-Scale SIEM optional add-ons for long-term capacity and Advanced Automation
Non-target functionality excluded from scoring
  • New-Scale Analytics behavioral-analytics license
  • New-Scale Fusion combined SIEM and Analytics license
  • LogRhythm SIEM self-hosted platform
  • Managed detection and response services
  • Professional services, training, and customer-specific entitlement terms
Purchase paths

Pricing checked: Sep 23, 2026

  • New-Scale Fusion: A separate combined license that adds New-Scale Analytics capabilities to the New-Scale SIEM capability set.

Buying attributes

Comparable purchase facts

Structured facts selected for this software category and supported by the linked public evidence.

Data collection
Hybrid enterprise ingestion

Collection uses cloud, site, and context collectors; on-premises collection is performed through collectors rather than self-hosting the SIEM.

View source
Normalization and enrichment
Normalized security schema

CIM normalization is established; the reviewed exact-product evidence does not establish the full asset-and-identity enrichment tier.

View source
Detection and correlation
Multi source correlation

This value reflects included correlation rules; Analytics rules are excluded from the base New-Scale SIEM license.

View source
Investigation and hunting
Advanced query and hunting

The published capability establishes advanced query modes, natural-language search, timelines, and Threat Center investigation workflows.

View source
Response and automation
Workflow and ticketing

Automation Management is included; custom services and advanced playbook design are available through the separate Advanced Automation add-on.

View source
Retention and search economics
Tiered retention and archive

Long-term searchable and storage-only capacity are documented as paid add-ons; included retention durations and quantities are not publicly stated.

View source
Deployment and scale
Cloud with hybrid collectors

The SIEM service is delivered from Google Cloud Platform; collectors can be deployed as virtual machines behind the customer firewall.

View source
Integrations and detection content
Detection content library

The reviewed evidence establishes prebuilt parsers, correlation-rule templates, threat-feed support, and broad ingestion methods, but not a marketplace-specific entitlement.

View source

Pricing plans

Exabeam New-Scale SIEM pricing table

Pricing checked: Sep 23, 2026

Official factConfidence 91%2 linked sources

New-Scale SIEM is one of three term-subscription product licenses in the New-Scale Security Operations Portfolio. Buyers contact Exabeam for commercial terms. Long-term search capacity, long-term storage capacity, and Advanced Automation are documented as add-ons rather than included base-license pricing.

Pricing cautions
  • No public numeric price or pricing unit: Buyers need a sales quote to establish the subscription amount, metering basis, included capacity, and any minimum purchase.
  • Optional capacity and automation purchases: Long-term search capacity, long-term storage capacity, and Advanced Automation are listed as add-ons, so buyers should confirm inclusion, quantity, retention scope, and pricing in the order documents.
  • Entitlement details can constrain published capabilities: The licensing guide notes that supported features can have additional limitations and that the Product Entitlement Document prevails in the event of a conflict.
PlanPriceKey differencesBest for
New-Scale SIEMSupporting pricing evidenceAmount unverified — check official pricing
  • Analytics rules: Not included.
  • Attack Surface Insights: Not included.
  • License model: Term subscription; Exact subscription duration and renewal terms are not publicly stated.
Security operations teams that need a cloud-delivered SIEM for high-volume security-data collection, normalization, correlation rules, search, case investigation, and workflow automation.

Plan upgrade triggers

Verified plan boundaries that can change the required edition.

New-Scale SIEM New-Scale Fusion

The organization needs Analytics rules or Attack Surface Insights, which the official licensing table excludes from the base New-Scale SIEM license and includes with Fusion.

Supporting pricing evidence
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

Advanced Automation with custom services and advanced playbook designAdd-on

The add-on includes custom services, advanced playbook designer, and dedicated automation visibility for alerts and cases in Threat Center.

Plan: New-Scale SIEM: Optional add-onAdvanced Automation
Official source
Long-term searchable and storage retention capacityAdd-on

Long-term Search Capacity supports search and export; Long-term Storage Capacity has limited search capabilities.

Plan: New-Scale SIEM: Optional add-onLong-term Search Capacity and Long-term Storage Capacity
Official source
Automation Management for response workflowsIncluded capability

Automation Management is included in the documented New-Scale SIEM license matrix.

Plan: New-Scale SIEM: Included
Official source
Collectors, Log Stream, Context Management, and CIM normalizationIncluded capability

New-Scale SIEM includes documented collector and security-data-management capabilities; Exabeam describes CIM normalization at ingestion.

Plan: New-Scale SIEM: Included
Official source
Correlation rules, Search, and Threat Center case investigationIncluded capability

The licensing matrix includes Correlation rules, Search, and Threat Center for New-Scale SIEM; the product page describes search-to-investigation workflows.

Plan: New-Scale SIEM: Included
Official source
Behavioral analytics, multi-layer risk scoring, and Analytics rulesSeparate product

New-Scale Analytics is a separate license; the feature matrix explicitly excludes Analytics rules from base New-Scale SIEM.

Plan: New-Scale SIEM: UnavailableNew-Scale Analytics
Official source
Combined SIEM and Analytics capabilitiesSeparate product

Exabeam describes New-Scale Fusion as a combined offering that includes New-Scale SIEM and New-Scale Analytics capabilities.

Plan: New-Scale SIEM: UnavailableNew-Scale Fusion
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
80%
AI claim confidence
95%
Required-field evidence status
76%
Evidence freshness
100%
Field traceability
100%
Model agreement
97%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 6 of 8 weighted claims have evidence links.
  • 1 A1 documentary official sources and 1 A2 official product sources are linked.
  • 1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • No weighted claim is past the review window.
  • No blocking evidence conflict was identified.
Detection and correlation quality19%
74

Detection is grounded in included correlation rules and Threat Center workflows, but the base license excludes Analytics rules, so buyers get documented rule-based detection without the broader behavioral analytics tier.

Investigation and threat hunting17%
85

Advanced query builders, natural-language search, timelines, visualizations, and Threat Center case workflows support structured hunting and investigation inside a single workbench.

Data collection and context16%
86

Collectors for cloud and site sources, multiple ingestion methods, context collectors, and CIM normalization form a coherent pipeline for hybrid enterprise security data into the cloud SIEM.

Response and security operations14%
76

Threat Center unifies alerts, cases, detections, and watchlists and automates prioritization, triage, and evidence collection, while advanced playbook design is reserved for the separate Advanced Automation add-on.

Scale, retention, and performance14%
63

Long-term search capacity and long-term storage capacity are available as add-ons, which gives buyers retention expansion options, but the included retention period and capacity are not publicly stated.

Deployment, support, and total cost10%
55

The commercial model is sales-assisted and term-subscription based with no public numeric list price, and several capabilities are sold as add-ons, which leaves total cost and deployment economics dependent on the quote.

Integrations and detection content10%
82

The product includes 7,000+ prebuilt log parsers, rule templates, threat-feed ingestion via STIX/TAXII Cloud Collector, and broad ingestion methods, which gives buyers substantial built-in content without a marketplace-specific entitlement being established.

Public review signals

Exabeam New-Scale SIEM has a small exact-product review sample

The retained Gartner Peer Insights profile is exact-product but contains only six ratings. Review text supports the product's analytics, integrations, out-of-box content, and automation while also identifying setup effort, parser maintenance, and expertise requirements.

Public review signals updated: Aug 10, 2026

Commonly reported strengths

  • Broad integrations and prebuilt SIEM content
  • Useful security analytics, search, and automation
  • Strong context for investigation

Commonly reported concerns

  • Initial setup and tuning can be complex
  • Parser coverage may require customization for less common vendors
  • The small sample limits generalization

Limited review signals

These ratings are retained for transparency but are not presented as representative buyer sentiment.

Gartner Peer Insights4.3/5

Insufficient sample · 6 ratings

Rating count
6 ratings
Source context
Exabeam New-Scale SIEM on Gartner Peer InsightsExact product
View sourceHistory baseline established: Aug 10, 2026
Score75
Pricing modelSales-assisted cloud-delivered term subscription. Current official product and licensing pages identify the New-Scale SIEM license and its add-ons but do not publish a numeric list price.
Use caseSecurity log correlation, Incident response automation
Structured tags

Exabeam New-Scale SIEM tag profile

Business function
  • Security operations
Use case
  • Security log correlation
  • Incident response automation
  • Threat intelligence enrichment
Compliance requirement
  • Data residency
Key features

Exabeam New-Scale SIEM core capabilities

  • Cloud, site, and context collectors with API, agent, syslog, SIEM, and data-lake ingestion options
  • Common Information Model normalization at ingestion
  • High-performance search with simple, advanced-query, and natural-language modes
  • Correlation-rule detection engineering and Threat Center investigation workflows
  • Threat Center alerts, cases, detections, watchlists, and automated evidence collection
  • Automation Management and optional Advanced Automation
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Cloud, site, and context collectors support API, agent, syslog, SIEM, and data-lake ingestion so hybrid enterprises can centralize on-premises and cloud security telemetry without self-hosting the SIEM service.
  • Common Information Model normalization at ingestion standardizes parsing and analysis for correlation and search workflows.
  • Threat Center combines alerts, cases, detections, watchlists, timelines, and automated evidence collection so analysts can move from search to investigation in one workbench.
  • Base license includes Automation Management plus correlation-rule engineering with templates and monitoring of up to 1,000 rules.
Cons

What to confirm before buying

  • Analytics rules and Attack Surface Insights are not included in the base New-Scale SIEM license and require New-Scale Analytics or New-Scale Fusion.
  • Long-term search capacity, long-term storage capacity, and Advanced Automation are separate add-ons whose quantities and commercial terms must be confirmed in the order.
  • No public numeric subscription price, metering unit, minimum purchase, renewal term, or implementation fee is published, so total cost depends on a sales quote and Product Entitlement Document.
  • The SIEM service itself is not self-hosted
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 23, 2026

Score comparisonGPTxAIRange
Detection and correlation quality78708
Investigation and threat hunting83863
Data collection and context84873
Response and security operations76760
Scale, retention, and performance63621
Integrations and detection content81832
Deployment, support, and total cost58526
siem log ingestion normalization85883
siem correlation detection quality80728
siem search investigation speed82842
siem compliance reporting readiness65650
siem scale cost operability725814
Where models differ
  • siem scale cost operability: 58–72 (14-point range)
  • Detection and correlation quality: 70–78 (8-point range)
  • siem correlation detection quality: 72–80 (8-point range)
GPTAI-assisted buyer perspective76

Exabeam New-Scale SIEM fits buyers that need cloud-delivered SIEM collection, normalization, search, correlation-rule detection, and investigation workflows, while checking commercial quotes for pricing, add-ons, and entitlement limits.

Review confidence
76/100
Model details
Strengths
  • The product supports cloud, site, and context collectors with API, agent, syslog, SIEM, and data-lake ingestion, which suits hybrid security-data collection.
  • The product normalizes data at ingestion with CIM, which can reduce parsing and analysis friction for security teams.
  • The product includes correlation rules, search, Threat Center, Automation Management, and scheduled reporting, which supports day-to-day SOC workflows.
Cautions
  • The base license is a term subscription with no public numeric price, so buyers need a sales quote to confirm total cost and included capacity.
  • Long-term search capacity, long-term storage capacity, and Advanced Automation are add-ons, so retention economics and automation scope need commercial confirmation.
  • Analytics rules and Attack Surface Insights are not included in the base New-Scale SIEM license, so buyers needing those functions need a different license path.
xAIAI-assisted buyer perspective74

Fit for security operations teams that need a cloud-delivered SIEM on GCP with hybrid collectors, CIM normalization, correlation-rule detection, high-performance search, and Threat Center investigation, provided the buyer can complete a sales-assisted term quote and confirm retention, automation, and analytics boundaries outside the base license.

Review confidence
74/100
Model details
Strengths
  • Cloud, site, and context collectors support API, agent, syslog, SIEM, and data-lake ingestion so hybrid enterprises can centralize on-premises and cloud security telemetry without self-hosting the SIEM service.
  • Common Information Model normalization at ingestion standardizes parsing and analysis for correlation and search workflows.
  • Threat Center combines alerts, cases, detections, watchlists, timelines, and automated evidence collection so analysts can move from search to investigation in one workbench.
  • Base license includes Automation Management plus correlation-rule engineering with templates and monitoring of up to 1,000 rules.
Cautions
  • Analytics rules and Attack Surface Insights are not included in the base New-Scale SIEM license and require New-Scale Analytics or New-Scale Fusion.
  • Long-term search capacity, long-term storage capacity, and Advanced Automation are separate add-ons whose quantities and commercial terms must be confirmed in the order.
  • No public numeric subscription price, metering unit, minimum purchase, renewal term, or implementation fee is published, so total cost depends on a sales quote and Product Entitlement Document.
  • The SIEM service itself is not self-hosted

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
2
Broad product review sources
1
Marketplace and app-store sources
0
Editorial sources
0
Latest evidence check
Sep 23, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

Unresolved evidence is disclosed on the page; affected deterministic calculations and price schema are withheld when the conflict is blocking.

View research methodology
Verified findingsCloud, site, and context collectors with API, agent, syslog, SIEM, and data-lake ingestion options Common Information Model normalization at ingestion High-performance search with simple, advanced-query, and natural-language modes Correlation-rule detection engineering and Threat Center investigation workflows Threat Center alerts, cases, detections, watchlists, and automated evidence collection Automation Management and optional Advanced Automation Included threat intelligence service with commercial and open-source feed ingestion Dashboards, scheduled reporting, service health, and consumption monitoring
  • New-Scale SIEM is one of three term-subscription product licenses in the New-Scale Security Operations Portfolio. Buyers contact Exabeam for commercial terms. Long-term search capacity, long-term storage capacity, and Advanced Automation are documented as add-ons rather than included base-license pricing.
Verification notes and unresolved itemsNo permanent free plan or time-limited free trial is stated on the reviewed official product and licensing pages. The product page offers expert contact and demo requests.
  • Sales-assisted cloud-delivered term subscription. Current official product and licensing pages identify the New-Scale SIEM license and its add-ons but do not publish a numeric list price.
  • No public numeric starting price stated.
  • The reviewed official product page and licensing guide establish New-Scale SIEM as a cloud-delivered term-subscription license but do not establish a public numeric amount, priced unit, payment timing, minimum commitment, renewal term, included retention quantity, or implementation fee.
  • The product page references some shared New-Scale Fusion platform services
Sources checked

Sources checked

Exabeam New-Scale SIEM source links

New-Scale Security Operations Portfolio Licenses | Exabeam Documentation PortalExabeam Documentation PortalLevel A1Linked to 3 scored claimsChecked Sep 23, 2026
New-Scale SIEM | ExabeamExabeamLevel A2Linked to 2 scored claimsChecked Sep 23, 2026

FAQ

Exabeam New-Scale SIEM FAQ

Is New-Scale SIEM a standalone product license?

Yes. Exabeam documents New-Scale SIEM as one of three New-Scale Security Operations Portfolio product licenses, alongside New-Scale Analytics and New-Scale Fusion.

Does the base New-Scale SIEM license include behavioral Analytics rules?

No. The published licensing table marks Analytics rules as unsupported for New-Scale SIEM; they are supported in New-Scale Fusion and New-Scale Analytics.

Can New-Scale SIEM ingest cloud and on-premises data?

Yes. Exabeam describes collectors for cloud and site data, plus API, agent, syslog, SIEM, and data-lake ingestion methods.

Are long-term retention options included in the base price?

Exabeam lists long-term search capacity and long-term storage capacity under add-ons. Public pages do not state included quantities or prices.

Is New-Scale SIEM self-hosted?

No. Exabeam states that New-Scale SIEM is delivered from Google Cloud Platform, while collectors can run as virtual machines behind the customer firewall.

Popular comparisons

Common Exabeam New-Scale SIEM comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Exabeam New-Scale SIEMvsElastic Security
75Gap 782

Enterprise / Mid-market

VS #2
Exabeam New-Scale SIEMvsSecuronix Unified Defense SIEM
75Gap 883

Enterprise / Mid-market

VS #3
Exabeam New-Scale SIEMvsRapid7 Incident Command
75Gap 075

Mid-market / Enterprise