Co-Managing LogRhythm After the Exabeam Merger: Keeping Your Rules, Retention, and Audit Continuity

Q1. What actually happened in the LogRhythm and Exabeam merger, and is LogRhythm going away?

LogRhythm and Exabeam completed their merger on July 17, 2024, forming one company that now operates as Exabeam under Thoma Bravo ownership. Self-hosted LogRhythm SIEM continues as a supported product, with the 7.21 release shipping in 2025. The signal worth watching: 2025 was the first Gartner SIEM Magic Quadrant where “LogRhythm” no longer appeared as an independent name.

The facts, before the panic

I got the same Slack message from three different security directors that week. “Are we about to lose our SIEM?” So let me give you the dates first.

The two companies announced intent to merge in May 2024, and the deal closed on July 17, 2024. Thoma Bravo, which already owned LogRhythm, backed the combined entity, and the merged company runs as Exabeam across roughly 22 countries. SIEM means Security Information and Event Management, the system that collects your logs and fires alerts. If you are weighing how that platform fits a managed model, our guide to understanding SIEM breaks down the moving parts.

Decoding the “Blockbuster” fear

Here is the real anxiety under the search. Nobody types “LogRhythm Exabeam merger” because they love mergers. They type it because they have seen vendors get absorbed and quietly starved.

A founder I respect described the cybersecurity market bluntly. “We have a lot of Blockbuster video cybersecurity companies out there that are not going to be around in two to three years.” Netflix did not beat Blockbuster on movies. It beat them on the model. That distinction matters here, because the question is rarely the product itself, but the way you are managing it.

So is LogRhythm going away? Not today. The honest read is that the brand sunset in the 2025 Gartner Magic Quadrant is the tell to track, where LogRhythm shows up only through Exabeam now. Plenty of teams reach this point and start asking why businesses switch cybersecurity providers in the first place.

Your Monday move

Separate two questions before you do anything dramatic. Is the product surviving, and is your operating model surviving? At UnderDefense, we watch teams conflate the two and panic-migrate when they did not need to.

This week, pull your current LogRhythm license and support entitlement status. Confirm what you are owed, in writing. That single document tells you whether you are reacting to a real cliff or to a headline.

Q2. What changes for LogRhythm support, roadmap, and end-of-life after the merger?

Exabeam publicly committed to continuing support and development of self-hosted LogRhythm SIEM, and the 7.21 GA release in July 2025 backs that up. Yet support and roadmap investment differ. Net-new innovation flows to the cloud-native New-Scale platform. Read the LogRhythm end-of-life policy for your specific version, confirm your Unlimited Upgrades entitlement, and assume the strategic center of gravity has shifted toward cloud.

“Supported” and “invested in” are different words

Here is a distinction that trips up smart buyers. A product can be fully supported and still sit outside the roadmap spotlight.

“Supported” means the vendor fixes bugs, ships patches, and answers your tickets. Exabeam put that commitment in writing for LogRhythm SIEM customers, and the 7.21 general-availability release in July 2025 is real proof, not a press line. “Invested in” means net-new capability, and that energy is clearly flowing toward the cloud-native New-Scale platform.

What this means for a version you depend on

Think of it like a car model that still gets parts and service, while the factory’s design team has moved to the next platform. You can drive it safely for years. You just should not expect it to grow new features at the old pace.

Every LogRhythm version carries its own end-of-life timeline under the published EOL policy. EOL means the date after which a version stops receiving fixes and support. Your terms and your Unlimited Upgrades entitlement decide how painful the next jump is. This is the kind of timing risk our SIEM buyers guide helps teams plan around.

Your three-step Monday checklist

Do these in order, this week:

1. Pull your specific version’s end-of-life date from the LogRhythm documentation.
2. Confirm your Unlimited Upgrades entitlement in your contract.
3. Write one paragraph documenting where roadmap investment is going, so your board hears it from you first.

I am a big believer in having one neck to choke. As a leader, if there is a problem area, I want one person thinking about it holistically. A co-management partner like our managed SIEM team becomes that single owner of continuity, so support tickets, version planning, and roadmap risk live with one accountable team rather than scattered across stretched staff.

I have watched the alternative play out. A rookie team trying to manage a fleet of Ferraris in the security stack, engines mostly idle, while the leader fights to hire expertise. A supported tool with no driver is still idle horsepower.

Q3. LogRhythm vs Exabeam New-Scale: which platform should you run in 2026?

Keep self-hosted LogRhythm SIEM when you need data residency, on-prem control, and you have invested years in AIE rule tuning. Move toward Exabeam New-Scale Fusion when you want cloud-native scale and UEBA-led analytics and you are ready to re-tune. For most mid-market teams the deciding factor sits above the platform: the quality of the humans operating it determines whether either one finds threats daily.

The decision, side by side

AIE means the Advanced Intelligence Engine, LogRhythm’s correlation layer. UEBA means User and Entity Behavior Analytics, which scores anomalies in behavior. Here is the honest comparison. If you want the broader criteria, our piece on how to choose a SIEM goes deeper.

Dimension	LogRhythm SIEM (self-hosted)	Exabeam New-Scale Fusion
Deployment	On-prem, you control the hardware	Cloud-native, vendor-hosted
Retention default	Legacy long-term retention you tune	Tiered, with short default windows plus add-ons
Analytics	AIE correlation rules, fact-based	UEBA behavioral models
Rule portability	Years of your own tuning lives here	Re-tuning expected on migration
Data residency	Strong, fully on-prem	Depends on cloud region

Choose based on your real constraints

Pick LogRhythm self-hosted when residency rules, air-gapped needs, or deep AIE tuning anchor you on-prem. Pick New-Scale when you want elastic cloud scale and behavior-led detection, and you have budget and time to re-tune. Independent comparisons rate both as capable platforms with different center-of-gravity.

The part the comparison charts miss

Here is my contrarian read. The platform is closer to a commodity than vendors want to admit. You could hand the same baseball bat to Babe Ruth or to me, and the bat performs to the hand that holds it.

The average team now manages around 76 security tools, and roughly 80% of teams use only 20% of the features they own. More platform rarely fixes that. A vendor-agnostic operator matters here, and our MDR service runs the platform you keep instead of forcing a rip-and-replace to fit our stack.

“The platform itself is straightforward. It pulls in data from all our existing security tools, so we didn’t have to rip and replace anything. Their SOC team is responsive and knows their stuff. When they escalate something, they include the context we need.”
Verified User in Marketing and Advertising UnderDefense G2 Verified Review

“UnderDefense Agentic AI SOC integrates well with our systems, specifically with our SIEM, Splunk. Their team is proactive in identifying and addressing threats, providing 24/7 oversight.”
Oleg K., Director of Information Security UnderDefense G2 Verified Review

Q4. Why does switching SIEMs put your correlation rules and institutional memory at risk?

When you switch SIEM vendors, hardware and licenses transfer while the business logic stays behind. Your correlation rules, automation playbooks, and tuned detections, built over years of incident-by-incident learning, rarely migrate. You restart the tuning cycle and lose institutional memory. That sunk cost, far more than the license fee, explains why a forced migration hurts, and why a model that lets you keep your rules matters.

The thing that does not come with you

I have lived through four major SIEM implementations. On the last one, we replaced the legacy platform and stood up 35 of 37 fully defined use cases in 12 weeks. That speed came from years of accumulated tuning, not from the box itself.

Here is what nobody warns you about at the demo. When you make a vendor switch, the business logic, the correlation rules, and the automation rules do not come with. You start the tuning process over, and years of institutional memory walk out the door.

Why this costs more than the invoice

Correlation rules are the logic that turns raw log noise into a real alert. Each one usually exists because a human got burned once and encoded that lesson. Lose the rule, and you lose the lesson.

Academic work confirms the stakes. A 2024 ACM Computing Surveys study on alert prioritization found that alert handling stays fragmented and analyst-dependent, with no clean transfer between systems. A USENIX Security 2024 study tied missed threats directly to alert volume rather than analyst skill, which is exactly what spikes when your tuning resets to zero. Tracking the right SOC metrics like MTTD and MTTR makes that regression visible early.

Treat your rules like code

Here is the discipline that protects you. Forward-looking teams treat detection rules like software, written in flexible languages, version-controlled, unit-tested, and deployed through a pipeline. That habit also feeds AI-driven detection later, the kind that powers a modern SOC service.

The machine-learning angle reinforces it. A 2024 Rapid7 patent describes training alert-triage models on a team’s own historical case dispositions, which means your past decisions become training data. Throw away your history in a migration, and you throw away that fuel.

Your Monday move

Before any migration conversation, inventory and export your rules, your playbooks, and your historical case dispositions. Treat that export as the asset it is.

A co-managed model with the UnderDefense Agentic AI SOC platform is built around this exact problem. You keep ownership of the rules and the data while we operate them, so a future vendor change never resets your institutional memory to zero.

Q5. What is co-managed SIEM, and how does it keep your rules, retention, and audit continuity intact?

Co-managed SIEM means you keep ownership of the platform, the data, and the detection logic while an expert partner operates monitoring, tuning, and response alongside your team. Through a merger this model preserves continuity. Your AIE rules stay yours, your retention posture is governed deliberately, and your audit trail holds because operations never pause during a vendor transition. You own the toys and gain experienced drivers.

What “co-managed” actually means

Let me define it plainly. In a co-managed SIEM, you hold the license, the data, and the rules, while a partner runs the daily operations with you. SIEM here is your log-and-alert engine.

Compare that to a fully outsourced model where the provider owns everything. As one operator put it, the goal is simple. “I would own the SIEM and can take my toys and leave.” That ownership is the whole point during a merger, and it is the heart of how our managed SIEM service is built.

Pillar one: rule continuity

Your correlation rules are years of encoded lessons. In a co-managed model, they stay in your tenant, version-controlled and exportable. At UnderDefense, our team tunes them with you, so the logic improves without ever leaving your hands.

Monday action: export your current rule set and confirm it lives in your repository, not only the vendor’s console.

Pillar two: retention continuity

Retention is how long your logs stay searchable. Default windows shift after a merger, and Exabeam’s documentation shows tiered retention that you must configure on purpose. A co-managed partner governs that deliberately, so nothing silently expires, which is exactly what good log monitoring for compliance requires.

Monday action: document your required retention window per data type before any license change.

Pillar three: audit continuity

Audit continuity means your evidence trail never breaks. Map your detections to a framework like NIST CSF 2.0, the detection-and-response standard, so auditors see unbroken coverage. Because operations keep running through the transition, you avoid the gap that triggers audit findings.

Monday action: pull last quarter’s incident reports and confirm they reconcile to your control set.

You keep the toys, you gain the drivers

I have watched teams buy a fleet of Ferraris, then leave the engines idle while the leader begs to hire expertise. Co-management supplies the drivers without the headcount fight, which is the same logic behind choosing an outsourced SOC over an in-house build. UnderDefense runs this as an AI SOC plus human ally model, vendor-agnostic, with concierge analysts and 2-minute alert-to-triage plus 15-minute escalation for critical incidents through the UnderDefense Agentic AI SOC platform. The result is fewer glasses of pain across your stack.

“Their expert management of our SIEM has added to the value of our security investments and tools.”
Yaroslava K., IT Project Manager UnderDefense G2 Verified Review

“It pulls in data from all our existing security tools, so we didn’t have to rip and replace anything.”
Verified User in Marketing and Advertising UnderDefense G2 Verified Review

Q6. How do you protect log retention and stay compliant when defaults and storage tiers change?

Default retention settings can quietly betray you. A platform that purges searchable logs after one month breaks SOC 2, PCI DSS, and HIPAA retention obligations unless you deliberately license long-term storage. Plan for roughly 40 days, about six weeks, of data on fast storage for live investigations and pattern analysis, then tier the rest to long-term retention. Check your default before a license conversion rather than after an audit.

The default that catches teams off guard

Retention means how long logs stay searchable. Exabeam’s own documentation shows short default windows, with long-term search and storage as deliberate add-ons. Miss that, and your evidence is gone when you need it.

SOC 2, PCI DSS, and HIPAA all carry retention floors. SOC 2 is a trust audit, PCI DSS governs card data, and HIPAA governs health data. A one-month default quietly fails all three, which is why our compliance services treat retention as a first-class control.

A retention checklist you can run this week

Do these in order:

1. Set your fast-storage window. Plan for at least 40 days, about six weeks, of data on fast storage for rapid investigation and pattern analysis.
2. Tier the rest. Move older logs to long-term storage that still meets your compliance floor.
3. Confirm your minimums. Match the window to SOC 2, PCI DSS, or HIPAA before any license conversion.
4. Watch disk growth daily. Plain-text logs balloon before overnight compression, and that metric routinely reaches 80%.

Fund the retention you need, not the noise

Here is a money point most vendors skip. After tuning correlation rules, your data volume drops, often by half or more, which is another lever to cut cost. We aim for a 50 to 90% reduction in noisy logs, and our managed SIEM pricing guide shows how that translates into spend.

At UnderDefense, we tune that ingestion diet first, so you fund the retention compliance demands instead of paying to store junk. One honest caution from the field: good compliance does not make you secure, and many boards miss that gap. So map retention to your specific framework, then keep tuning the detections that actually catch attacks.

Q7. What are the real LogRhythm alternatives, and when should you switch versus co-manage?

The credible LogRhythm alternatives in 2026 are Splunk, Microsoft Sentinel, Google SecOps (Chronicle), Securonix, and Sumo Logic, each strong and each demanding fresh tuning. Switching restarts the institutional-memory clock. Before migrating, ask whether the problem is the platform or the way it is operated. Often the lower-risk move is to co-manage what you already own rather than buy a new SIEM and re-learn it from scratch.

The honest order of options

Here is how I rank the paths for most mid-market teams:

1. Co-manage your existing LogRhythm with our MDR service. Keep your rules and data, add operators.
2. Splunk, when you want maximum flexibility and have budget.
3. Microsoft Sentinel, when you are heavy in Azure.
4. Google SecOps (Chronicle), when you want cloud-scale search.
5. Securonix or Sumo Logic, when behavior analytics or cloud-native logging lead your needs.

These alternatives are well-rated and real. Each one, though, asks you to re-tune from scratch, a cost our MDR vendors list helps you weigh.

The switching itch, and what it really costs

The instinct after a merger is to bolt. I get it. The problem is the hidden bill.

The average team already manages around 76 tools, and most use only 20% of the features they own. Adding a new SIEM rarely fixes operations, which is part of the wider security stack problem. As one operator framed the discipline, stay open to replacing tools when the category truly evolves, the way you would replace your identity provider but never your crypto stack.

Resolve it by operating model, not panic

My current read is simple. Switch when the technology category has genuinely moved past you, across maybe four or five capabilities at once. Co-manage when the platform is fine and the operation is the gap.

Because UnderDefense is vendor-agnostic, this advice stays honest. If a switch is genuinely right, we will run the new platform too. If not, we keep your LogRhythm investment productive.

“I used to work with many MDR solutions in the past, and so far UnderDefense is the best one. The platform seamlessly integrates our existing security tools.”
Inga M., CEO UnderDefense G2 Verified Review

“Crowdstrike was our favorite choice, but after a few calls with UnderDefense we realized that we could get way more value.”
Oleksii M., Mid-Market UnderDefense G2 Verified Review

Q8. How does an AI SOC with human analysts beat alert-only monitoring during a transition?

Monitoring-only tools and legacy MSSPs hand you alerts and leave your stretched team to triage noise during a vendor transition, the worst possible window. An AI SOC pairs machine-speed triage and investigation with human analysts who actually respond. Research is clear that alert volume, more than analyst skill, drives missed threats. The fix is fewer, contextualized, acted-upon alerts delivered through people who close the loop.

The standard read gets this backwards

Most teams assume more alerts mean more safety. The evidence says otherwise. A 2024 ACM survey on alert prioritization found that sheer alert volume, more than analyst quality, drives missed threats. A USENIX Security 2024 study and a 2023 study on alert fatigue both tie burnout and misses to volume, which is why SOC automation matters so much.

The timing makes it worse. The 2025 Verizon DBIR found vulnerability exploitation up 34% and ransomware present in 44% of breaches. A transition is exactly when you cannot afford a coverage gap, so a tested ransomware response plan earns its keep.

What an AI SOC actually does

An AI SOC is a security operations center where automation handles routine triage and humans handle judgment. The triage is observable, not a black box. A 2024 Varonis patent describes large-language-model investigation that auto-generates audit-ready incident reports, which is the kind of evidence you can show an auditor.

The model that holds up is human plus automation. Automation scales the repetitive work. Humans own the edge cases, a balance we explore in does AI kill or save your SOC team. AI, after all, is just whatever machines have not done yet.

Why speed wins

A CISO once told me he broke out in hives because he could not keep up with the issues piling up. That is what alert-only monitoring leaves behind. If your team takes days or weeks to act because it is stuck in manual toil, you are bringing a knife to a gunfight.

This is the core of UnderDefense’s AI SOC plus human ally model. UnderDefense Agentic AI SOC does triage at machine speed while concierge analysts deliver context and response, with 2-minute alert-to-triage and 15-minute escalation for critical incidents through the UnderDefense Agentic AI SOC platform. Track two metrics on Monday, your true-positive rate and your alerts per analyst, both covered in our SOC metrics guide.

“The biggest win for me was getting actual control over our security alerts. Their team cleaned up our configurations and got the noise under control within the first week.”
Verified User in Marketing and Advertising UnderDefense G2 Verified Review

“Now, not only do we get alerts, but we also get clear guidance on how to handle them. This has significantly reduced our response time.”
Valeriia D., Marketing Specialist UnderDefense G2 Verified Review

Q9. What is the real-world payoff, and what should you do on Monday morning?

The payoff of co-managed visibility shows up where you least expect it. One team uncovered a $300K payroll fraud during onboarding, before any cyber incident. Your Monday plan: export and version your detection rules, confirm your LogRhythm EOL and support entitlement, audit your retention against your compliance framework, and decide deliberately whether to stay, switch, or co-manage rather than letting the merger decide for you.

The payoff hides in plain sight

Here is a story I still think about. During an onboarding, while wiring up visibility into a customer’s environment, we surfaced a payroll fraud nobody knew was running. That accidental find saved the company roughly $300K in the first three months, the kind of outcome our benefits of MDR breakdown explores in depth.

I share it because you cannot fake that kind of proof. Real visibility catches things the threat model never listed. EOL, by the way, means end-of-life, the date a software version stops getting fixes.

Your four-step Monday plan

You do not need a six-month program to act. You need four moves this week:

1. Export and version your detection rules. Get your correlation logic into a repository you control, the foundation of any well-run SOC service.
2. Confirm your LogRhythm EOL and support entitlement. Know your real timeline in writing.
3. Audit retention against your framework. Match your window to SOC 2, PCI DSS, or HIPAA before any license conversion, guided by our compliance services.
4. Decide deliberately: stay, switch, or co-manage. Let evidence drive the call rather than merger headlines.

The cost of getting this wrong is concrete. When operations stop for even half a day, a mid-market company can lose around $20K, and a transition gap is exactly when attackers move, a risk we plan for with every incident response engagement. The 2025 Verizon DBIR shows why that window is dangerous, with ransomware present in 44% of breaches, which is why a current ransomware response plan matters.

The question I am sitting with

My honest read: the LogRhythm merger is a forcing function, not a death sentence. The teams who treat it as a deadline to panic-migrate often lose more than the teams who pause and protect what they already built, a pattern documented in why businesses switch cybersecurity providers.

So here is what I keep asking the leaders I talk to. If your platform survives but your operating model does not, did you really solve anything? At UnderDefense, that is the conversation we would rather have through our managed SIEM team before a migration than after an audit finding.

“They’ve also made our audit process much less painful. The reports from their platform give us clear evidence of our security controls and incident response capabilities.”
Verified User in Marketing and Advertising UnderDefense G2 Verified Review

“With UnderDefense Agentic AI SOC, we’ve reduced security breaches. Their adherence to SLAs gives me confidence in our infrastructure’s protection.”
Oleg K., Director of Information Security UnderDefense G2 Verified Review