Security1 publisher2 min readPublished
Exabeam extends AI-assisted security operations to on-premises LogRhythm SIEM
Exabeam is bringing AI-assisted operations to its on-premises LogRhythm SIEM and says its Nova agent triages cases 30 times faster than analysts. The speed figure is Exabeam's own measurement, and teams that keep data local still need to find out where the on-premises AI processing happens.
The Watch · Security desk
What happened
- Nova now works across Exabeam's platform as a persistent investigator, gathering context, running secondary searches and pulling entity profiles as an incident unfolds.
- A deeper Claude Enterprise integration puts prompts, tool calls and agent actions on one timeline and correlates behavior to flag rogue agents and behavioral drift.
- Exabeam's Agent Behavior Analytics now monitors AI agents alongside human users, building on user behavior analytics work the company began more than a decade ago.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision LogRhythm customers that kept AI out of the SOC on data-residency grounds now have an on-premises option to evaluate, and the first test is whether any prompt or log leaves the site.
- constraint Exabeam measured the 30x triage figure on its own team and its own cases, so a buyer cannot use it as a benchmark until they have rerun it on their own alert mix.
- capability SOCs with Claude Enterprise agents in production can investigate an agent that drifts using the same behavioral tooling they use on a compromised user account.
For a regulated or disconnected SOC, the on-premises half of this announcement is the part that matters. Exabeam says the modernized LogRhythm SIEM Platform "brings AI-assisted security operations into the local environment while preserving control over sensitive data." It pitches the platform at organizations that keep infrastructure, data or AI workloads on-premises [2]. Control over sensitive data is a weaker promise than data that never leaves the site. An air-gapped team has two questions: where the model runs, and whether the features work with no outbound connection. The release text available does not answer either [2].
Most of the detail about agentic features is under the other platform. Exabeam lists Nova, the Claude Code and Codex plugin and the Claude Enterprise integration as New-Scale capabilities, and covers LogRhythm in a separate section [9]. A buyer with on-premises constraints is evaluating LogRhythm. I would not assume Nova comes with it until Exabeam says so.
Exabeam says its own security operations team measured Nova triaging an average case in about 10 minutes, against the five hours a human analyst would typically need [4]. Five hours is 300 minutes, and 300 divided by 10 gives the 30x multiple the company quotes [1]. So the two numbers match the multiple. They are still a vendor measuring its own product on its own caseload [4]. Exabeam pairs Nova with Related Cases, a feature that automatically groups connected incidents [10].
For defenders, the agent monitoring has the most direct security value. The Claude Enterprise integration normalizes prompts, tool calls and actions into a single timeline. It then applies event-time analysis and behavior-based correlation to detect rogue agents and behavioral drift [6]. Separately, Exabeam has expanded Agent Behavior Analytics to watch AI agents alongside human users, building on user and entity behavior analytics work it began more than a decade ago [7]. An agent with tool access is one more privileged identity in the environment. With this integration it leaves a trail an investigator can follow, the same way a user account does [6].
The plugin is narrower in scope. It brings guided workflows into Claude Code and Codex, so analysts can triage alerts, prioritize cases and investigate through natural-language commands. Exabeam calls it the first in a planned series from its Agent Skills Marketplace [5].
"The Agentic SOC gives security teams the speed and scale of AI without giving up human judgment, context, or control," said Steve Wilson, Exabeam's Chief AI and Product Officer [8].
What to watch
- Exabeam documentation stating where LogRhythm's on-premises AI inference runs and whether it operates with no outbound connection.
- Whether Nova and the Claude Code and Codex plugin are offered on LogRhythm on-premises, and on what dates.
- Customer-published triage times that can be set against Exabeam's self-measured 10-minute average.