Finally a SIMPLE and EASY to use SIEM/SOAR solution :) One you will ENJOY using (really!!)
Use Cases and Deployment Scope
It is our SIEM and SOAR tool. We use it for all investigations. We use it for log retention and complance reporting. We use it for all alerting and InfoSec ticketing. With its simplicisty our help desk uses it to diagnose issues with user assets quickly and easly with very little training.
Pros
- Simple graphical interface
- Plan text searching, no need to know another coding language
- Very very fast response
- All saved logs up to 7 years instantly searchable
- Not cold or frozen buckets for years old logs
Cons
- More and better drop-down menus, some items in threat hunter require you know subsets.
- Less dashboards, combine AA and DL without having separate logins.
- More complete playbooks are already built out. You have the structure set up for templates like malware and phishing, go further and completely build them out from start to finish, most companies would just use them and not personalize their configurations.
- Quarterly health checkup diagnostics of systems sent out to users.
Return on Investment
- The simple automated response has allowed us to respond to thousands of more alerts a day.
- From a phishing perspective, Exabeam can recognize a threat and automatically remove it from all mailboxes effected before an analyst can see it on a dashboard.
- With the cloud deployment, Exabeam handles almost all admin duties for the tool themselves versus us having to spend 10 to 20 hours a month just keeping our old cloud-based SIEM healthy and up to date.