Who does what
Provider
- Automated triage and investigation context
- Configured containment workflows and action records
Your team
- Data permissions and workflow policy
- Incident judgment and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- SaaS Applications
- Code & Applications
Details
Service scope
Best for A cloud and SaaS environment whose SOC wants investigation context and response workflows in one platform.
Correlate
Joins activity, identity and configuration data.
Investigate
Triages alerts and preserves evidence for analysts.
Execute
Runs configured response with approval controls.
Full service analysis
AI triage, investigation and permitted response on a shared data model
- Your team owns
- Maintain source permissions and required data delivery.
- Test workflow approvals, timeouts and response authority.
- Own difficult incident decisions and restore affected services.
Pricing & contract
- Billing
- Custom
Obtain a quote that identifies connected data sources, retention, Exabot entitlements and response workflows. AWS lists an annual Agentic SOC Starter Pack but does not define a comparable deployment allowance. Optional MDR and infrastructure or intermediate storage charges need separate confirmation.
Tradeoffs & buying questions
Strengths
-
Investigation context carries into response
The same investigation context can carry into response workflows.
-
Direct ingestion or existing SIEM
Can triage source data without requiring a separate SIEM.
Considerations
-
Permissions and ingestion need upkeep
Permissions and source ingestion require operational work.
-
Approvals and fallbacks need testing
Automated action needs tested approvals and fallback behavior.
Ask before buying
- What happens when response approval times out?
- Which sources need intermediate storage or custom ingestion?
- Which entitlements and MDR duties does the quote include?
Customer feedback
Customers value
-
A small February–April 2026 G2 sample valued context and reduced investigation work.
February–April 2026 G2 reviewers valued alert context and less manual investigation.
Reported concerns
-
Reviewers reported connector and permission work plus occasional large-query performance problems.
Those reviewers also reported permission work, missing direct data connectors and occasional slow or failed large queries.
Integrations
Platform / SIEM
- Splunk
Endpoint
- CrowdStrike
Cloud
- AWS
- Microsoft Azure
- Google Cloud
Other integrations
- Okta
- Microsoft Entra ID
- GitHub
1 more integrations
- Google Workspace
Common questions
Must Exaforce replace an existing SIEM?
No. Exabot Triage can ingest data directly or use external SIEM information when useful. Agree which system retains the authoritative logs and how each source reaches it.
Does every Exabot purchase include human SOC coverage?
No. Exaforce offers customer-operated and Exaforce-operated models. Confirm the optional MDR service and its response responsibilities explicitly.