Expel launched Managed SIEM on Monday at RSAC 2026, a co-managed service that puts the company’s detection engineers directly inside customers’ Microsoft Sentinel and Splunk Enterprise Security environments.

The service is designed to address what Expel calls a fundamental mismatch between what SIEMs promise and what security teams actually end up spending time on. Most organizations buy SIEMs to detect threats, but find themselves consumed instead by rule tuning, data ingestion management, and ongoing administration.

“Organizations didn’t spend millions on SIEMs to waste endless hours administering them; they bought them to detect threats and protect the business,” said Justin Bajko, Chief Strategy Officer at Expel. “Too many teams are consumed by the day-to-day grind of keeping their SIEM running instead of using it to actually secure their organization. Our Managed SIEM service takes that tedious management out of the hands of our customers’ SOCs, so they can focus their efforts on what actually matters.”

The service is available in two tiers. Detection Engineering provides ongoing, structured detection support: Expel reviews existing rules, evaluates coverage against threat scenarios, and reduces noise. Performance Engineering goes deeper, with a co-managed model where Expel actively monitors SIEM health, builds automation, and optimizes ingestion costs alongside the customer team.

The offering does not require customers to buy their SIEM through Expel, and the company says it doesn’t profit from increased data volume. In fact, Expel actively recommends ways to reduce ingestion costs. Every detection rule Expel writes belongs to the customer, with no proprietary formats or lock-in.

The service also integrates SIEM alerts directly into Expel’s 24×7 MDR investigation and response workflows, and includes quarterly business reviews showing detection efficacy. Customers can see every rule, every filter, and every tuning decision in real time.

Expel Managed SIEM follows a successful beta program and is generally available now as an add-on to Expel MDR. The Detection Engineering subscription is priced by the number of attack surfaces and log sources. Performance Engineering is scoped and quoted per project. No platform migration is required.