New service pairs customers’ Microsoft Sentinel and Splunk Enterprise Security SIEMs with Expel’s MDR expertise to deliver the security outcomes their SIEM was built for
[TL;DR / Key Takeaways]
- What: Expel launched Expel Managed SIEM, a transparent co-managed service that brings Expel’s MDR detection engineering expertise directly into customers’ SIEM environments.
- Impact:Â Takes the traditional SIEM administration burden off security teams’ plates, cuts the data they’re overpaying to ingest, and gives them full visibility into every rule and tuning decision.
- Availability:Â Generally available now for Microsoft Sentinel and Splunk Enterprise Security as an add-on to Expel MDR.
SAN FRANCISCO, March 23, 2026 /PRNewswire/ — Expel, the human-led, AI-accelerated security provider, today launched Expel Managed SIEM—a co-managed service that puts Expel’s expert detection engineers directly inside customers’ Microsoft Sentinel and Splunk Enterprise Security environments. The service handles detection strategy, writes and tunes custom detection logic, optimizes data ingestion costs, and feeds security information and event management (SIEM) alerts directly into Expel’s MDR response workflows. Following a successful beta program, the service is now generally available for Expel MDR customers.
The SIEM isn’t the problem. It’s how it’s being managed.
Most organizations didn’t invest in a SIEM to spend their time tuning noisy rules and watching management and storage expenses climb. But that’s exactly where security teams end up—caught in a cycle of SIEM administration that consumes the people who should be focused on actual threats.
Traditional MSSP and legacy providers profit from increased data volume—the more customers ingest, the more revenue the providers generate, regardless of whether the increased data volumes lead to better security outcomes. Expel Managed SIEM does not require customers to purchase their SIEM through Expel, and does not profit from increased data volume. In fact, Expel makes recommendations that help customers optimize data usage, improve retention strategies, and control ingestion costs, all while preserving SIEM security coverage.
What’s included
The service is available in two offers:
- Detection Engineering:Â This service provides ongoing, structured detection engineering support designed to continuously improve the effectiveness and efficiency of a customer’s SIEM. Through a defined cadence of review and analysis, Expel assesses existing detection rules, evaluates coverage against key threat scenarios, and identifies opportunities to reduce noise and improve signal quality. This offering is designed to strengthen detection outcomes over time while preserving clear ownership boundaries between detection operations and administrative IT operations.
- Performance Engineering:Â This additional professional service model builds on the Detection Engineering offering by providing a deeper, more hands-on SIEM partnership for customers that require increased operational support, customization, and optimization. Expel works alongside customer teams in a co-managed model to actively monitor SIEM health, develop automation, and optimize SIEM costs. The offering is designed to accelerate detection maturity and operational efficiency through ongoing collaboration, while maintaining shared ownership and clearly defined responsibilities for platform and security operations.
Expel works with customers’ existing Sentinel or Splunk investment, and doesn’t require a platform migration. The service is designed to take the heavy lifting of detection operations off internal teams—not replace them—so security engineers can focus on the higher value, strategic work that requires their judgment.
Additional capabilities include detection strategy reviews aligned to business context, ongoing management of log source changes as environments evolve, direct integration of SIEM alerts into Expel’s 24×7 MDR investigation and response workflows, and quarterly business reviews showing detection efficacy and service value.
Expel also offers flexibility and an adaptable starting point, meeting customers where they are today, without requiring the “perfect” environment or baseline configurations.
Every detection Expel writes belongs to customers—no proprietary formats, no lock-in, no hostage-taking if they decide to move on. Customers own the rules Expel creates, unlike other co-managed services which require new technology purchases and lock detections. Customers see every rule, every filter, every tuning decision in real-time.
“Organizations didn’t spend millions on SIEMs to waste endless hours administering them; they bought them to detect threats and protect the business,” said Justin Bajko, Chief Strategy Officer at Expel. “Too many teams are consumed by the day-to-day grind of keeping their SIEM running instead of using it to actually secure their organization. Our Managed SIEM service takes that tedious management out of the hands of our customers’ SOCs, so they can focus their efforts on what actually matters.”
Availability
Expel Managed SIEM is available now for customers as an add-on to Expel MDR. The Detection Engineering subscription is priced based on the number of attack surfaces and log sources, with all custom detection engineering included. Professional Services are scoped and quoted project-by-project.
For more information, visit our website, contact us, or stop by our booth at RSAC 2026 (#5261 in the North Hall).
About Expel
Expel is human-led, AI-accelerated security. Our MDR solutions use human expertise and AI to work with the tools you already have, providing coverage across critical attack surfaces such as cloud, identity, email, SIEM, SaaS, and on-prem environments, out in the open, alongside you. No black boxes. No rip-and-replace. Just clearer decisions, faster action, and security operations that get stronger over time. For more information, visit our website, check out our blog, or follow us on LinkedIn.
SOURCE Expel