What you are evaluating
This portfolio page deliberately distinguishes the offerings rather than treating their names as interchangeable editions of one installation. Merger history does not prove that integrations, licenses or migration paths are identical.
A useful evaluation context
Consider the portfolio when behavior analytics or an existing LogRhythm deployment shapes requirements. Evaluate cloud and self-hosted options as distinct operating models with separate acceptance criteria.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Collect and normalize supported records for searching, detection and investigation in the selected offering.
- Use available user and entity behavior analytics to develop leads that analysts must validate against evidence.
- Organize investigation context and response workflows according to the capabilities of the contracted product.
Where it fits in the work
- Choose the exact cloud or self-hosted offering and document who operates its collection and storage components.
- Validate source parsing and identity resolution before evaluating behavioral alerts.
- Investigate a labeled scenario, inspect why activity was considered unusual and compare it with an authorized business event.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
Create fabricated after-hours sign-ins for two fictional users: one with an approved maintenance change and one without.
Evidence to look for
Show the evidence used to investigate both cases. Explain why unusual behavior is not by itself malicious and identify where the authorization context must come from.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which product, edition and deployment model is the proposal actually describing?
- How are entity baselines explained, reset and maintained when accounts or roles change?
- What evidence, detections and historical data can be carried through an upgrade or migration?
Names you may encounter: Exabeam New-Scale · LogRhythm SIEM. Historical names do not establish current availability or feature equivalence.