Rapid 7 (InsightIDR)

Name: Rapid 7 (InsightIDR)
Brand: Rapid7
Rating: 4.4 (85 reviews)

Rapid7 InsightIDR is a cloud-native security information and event management (SIEM) platform that centralizes log management, applies detections and user and entity behavior analytics (UEBA) for threat detection, and provides investigation and case-management workflows with optional endpoint telemetry and MDR/XDR integrations.

Est 2000|Valuation $1B|Raised $388.2M|36 Ref Customers

LinkedIn 225K|Website|Web traffic 713K|FTEs 2,613|HQ Boston, Massachusetts, US

MarketsSecurity Information and Event Management (SIEM)Endpoint Security (EPP/EDR)

Platform CoversSecurity Orchestration, Automation, and Response (SOAR)IT Asset Management (ITAM)

Published Oct 24, 2026

01Common complaints

SCIM provisioning is a hard requirement for identity lifecycle automation; the Command Platform does not support SCIM.
Very large enterprises that require highly customized correlation and advanced, power-user query workflows may prefer solutions designed for that scale (for example, Splunk ES).
Organizations that prefer ingest-based billing models and expect to optimize costs directly against log volume may find cloud-native ingest-priced SIEMs more aligned to their economics.
Buyers that require comprehensive, mature SOAR playbooks embedded within the SIEM without purchasing a separate SOAR product should evaluate dedicated SOAR offerings or SIEMs with more built-in orchestration.
If detailed, prebuilt executive reporting and dashboards are primary purchase drivers, validate reporting capabilities in a proof of concept.

1. SCIM provisioning is a hard requirement for identity lifecycle automation; the Command Platform does not support SCIM. 2. Very large enterprises that require highly customized correlation and advanced, power-user query workflows may prefer solutions designed for that scale (for example, Splunk ES). 3. Organizations that prefer ingest-based billing models and expect to optimize costs directly against log volume may find cloud-native ingest-priced SIEMs more aligned to their economics. 4. Buyers that require comprehensive, mature SOAR playbooks embedded within the SIEM without purchasing a separate SOAR product should evaluate dedicated SOAR offerings or SIEMs with more built-in orchestration. 5. If detailed, prebuilt executive reporting and dashboards are primary purchase drivers, validate reporting capabilities in a proof of concept.

Deal disqualifiers (poor fit)

SCIM provisioning is a requirement for identity lifecycle automation; the Command Platform does not support SCIM.
The security program requires extensive bespoke correlation, highly advanced query workflows, and Splunk-scale customization.
The organization prefers ingest-based economics tied directly to log volume.
The procurement objective is comprehensive SOAR capabilities embedded in a single SKU without purchasing a separate SOAR product.
The organization requires extensive out-of-the-box executive reporting and dashboard granularity beyond what reviewers report is available.

- SCIM provisioning is a requirement for identity lifecycle automation; the Command Platform does not support SCIM. - The security program requires extensive bespoke correlation, highly advanced query workflows, and Splunk-scale customization. - The organization prefers ingest-based economics tied directly to log volume. - The procurement objective is comprehensive SOAR capabilities embedded in a single SKU without purchasing a separate SOAR product. - The organization requires extensive out-of-the-box executive reporting and dashboard granularity beyond what reviewers report is available.

Publicly documented limitations

SCIM provisioning is not supported for the Command Platform; identity lifecycle automation is limited.
Logs archived to customer-managed S3 cannot be re-ingested into the product’s log search (per product documentation).
InsightIDR does not ingest historical data from event sources for retrospective analysis in some configurations; the product emphasizes forward-looking ingestion.

Common limitations/complaints from customers

Reporting lacks depth/granularity according to multiple reviewers.
Log search and query capabilities can be less flexible than those in some competitor products.
False positives and noise require tuning and operational effort.
Built-in automation capabilities are reported as limited without InsightConnect.
Some customers report latency or performance degradation under very heavy data loads.

02Why they buy

Observed in customer feedback and product documentation

Review narratives commonly reference a consolidated interface for monitoring and investigations (often characterized by reviewers as a single consolidated view).
Reviewers frequently highlight comparatively straightforward deployment and onboarding.

Differentiation themes

Velociraptor integration (InsightIDR Ultimate): Integration of Velociraptor provides DFIR capabilities within the SIEM offering, which can reduce the need for separate DFIR infrastructure in some use cases.
Default retention period: Rapid7 documents a default retention period (reported as approximately 13 months) in standard subscriptions, which can support many compliance scenarios without additional retention purchases.

Competitor advantages

Splunk: broader customization and deeper analytics at scale.
Sentinel: strong native integration with Microsoft/Azure signals.
Some alternative SIEMs: richer identity lifecycle automation (for example, SCIM support) and potentially more advanced reporting out of the box.

03Field reports

Below are representative excerpts and thematic summaries drawn from public review platforms and community discussions. Quotations below are paraphrased to summarize reviewer sentiment.

G2 (mix of positive and negative)

Positive example (ease of installation/management): A G2 reviewer described the installation process as straightforward, making endpoint management easier in their environment.
Mixed example: One G2 entry was poorly rated on G2 while also noting ease of use and that customer support was good; this indicates reviewer context and rating may not consistently align.

Interpretation: G2 excerpts emphasize relative ease of deployment and usability, but do not provide conclusive evidence on scalability, advanced correlation, or integration depth.

- Positive example (ease of installation/management): A G2 reviewer described the installation process as straightforward, making endpoint management easier in their environment. - Mixed example: One G2 entry was poorly rated on G2 while also noting ease of use and that customer support was good; this indicates reviewer context and rating may not consistently align. Interpretation: G2 excerpts emphasize relative ease of deployment and usability, but do not provide conclusive evidence on scalability, advanced correlation, or integration depth.

Capterra (balanced highlights)

Positive sentiment: A reviewer reported reduced manual workload and improved operational assurance after deployment.
Common negative theme: Some reviewers noted reporting did not provide sufficient detail and that integrations with particular tools could be cumbersome.

TrustRadius (pros and cons themes)

Pros reported:

Reviewers cited a consolidated interface for visibility and found log ingestion straightforward.
Several reviewers reported useful detection content and UEBA value for identifying abnormal behavior. Cons reported:
Some reviewers report lag or latency under heavy data loads.
Noise/false positives are commonly cited and require tuning.
Limitations in built-in automation were reported by multiple reviewers.
Search and query capabilities and the UI can be challenging for some users.

Pros reported: - Reviewers cited a consolidated interface for visibility and found log ingestion straightforward. - Several reviewers reported useful detection content and UEBA value for identifying abnormal behavior. Cons reported: - Some reviewers report lag or latency under heavy data loads. - Noise/false positives are commonly cited and require tuning. - Limitations in built-in automation were reported by multiple reviewers. - Search and query capabilities and the UI can be challenging for some users.

Community / forum discussions (Rapid7 Discuss)

Community posts provide candid feedback, including:

Historical threads criticizing the limitations of included automation and describing a forced purchase path to InsightConnect for more complete SOAR capabilities.
Follow-up threads where Rapid7 representatives described continued investment in InsightConnect while also noting investments in embedded/quick actions within the platform.

Interpretation: Community feedback suggests a recurring buyer risk: marketing language around embedded automation may not match operational expectations unless the buyer understands the division between InsightIDR functionality and InsightConnect features.

Community posts provide candid feedback, including: - Historical threads criticizing the limitations of included automation and describing a forced purchase path to InsightConnect for more complete SOAR capabilities. - Follow-up threads where Rapid7 representatives described continued investment in InsightConnect while also noting investments in embedded/quick actions within the platform. Interpretation: Community feedback suggests a recurring buyer risk: marketing language around embedded automation may not match operational expectations unless the buyer understands the division between InsightIDR functionality and InsightConnect features.

Why customers select InsightIDR (patterns across reviews)

Common selection drivers indicated by reviews and product messaging:

A cloud-hosted SIEM that avoids building and managing SIEM infrastructure.
Faster onboarding and simplified deployment for smaller teams.
UEBA capabilities and messaging focused on reducing irrelevant alerts.
Integration with the Rapid7 product ecosystem and availability of MDR services.

Why some customers leave / churn risk signals

Common risk factors identified in reviews and discussions include:

Limitations in deep SIEM customization and advanced query workflows compared with some market leaders.
High false positive rates (noise) that require tuning.
Integration friction with specific APIs or tools.
Perceived automation/SOAR limitations without purchasing additional Rapid7 products.

Vendor-published outcomes vs independently verified outcomes

Many Rapid7 product pages and press materials include customer stories and vendor-published case studies. SIEM-specific case studies are available but may be gated or less prominent in search results. Independent signals include participation in structured evaluation frameworks.

MITRE Engenuity ATT&CK Evaluations (independent signal)

Critical caveats:

MITRE Engenuity evaluations are structured emulations under specific configurations and should not be interpreted as absolute rankings.
Buyers should review MITRE evaluation artifacts directly to assess what was telemetered versus what generated alerts, and how that maps to the organization’s detection goals.

Rapid7 has published materials noting participation in MITRE Engenuity ATT&CK Enterprise Evaluations. Rapid7’s materials describe telemetry and detection coverage claims across many ATT&CK techniques. Critical caveats: - MITRE Engenuity evaluations are structured emulations under specific configurations and should not be interpreted as absolute rankings. - Buyers should review MITRE evaluation artifacts directly to assess what was telemetered versus what generated alerts, and how that maps to the organization’s detection goals.

Velociraptor integration (practical implications)

Critical lens:

The integration provides endpoint investigation capabilities without requiring separate Velociraptor infrastructure.
Retention of Velociraptor-collected endpoint data is described as limited and may be insufficient for long-running investigations unless data is exported or archived externally.

Rapid7 documentation indicates InsightIDR Ultimate includes an integrated instance of Velociraptor (the open-source DFIR tool) as part of endpoint capabilities, with certain endpoint data retained for a limited period. Critical lens: - The integration provides endpoint investigation capabilities without requiring separate Velociraptor infrastructure. - Retention of Velociraptor-collected endpoint data is described as limited and may be insufficient for long-running investigations unless data is exported or archived externally.

04Best fit

Company size

Typical fit: midmarket to mid-enterprise organizations where a relatively small SOC seeks SIEM outcomes without managing SIEM infrastructure.
Also relevant for SMBs with regulatory needs that lack 24/7 staffing, especially when pairing with Rapid7 MDR services.

Industries / verticals

Based on review examples and typical SIEM adoption patterns:

Financial services
Healthcare
Retail and organizations with distributed office footprints

Roles and personas

Decision makers: CISO/Head of Security, Director of IT/Security, Security Operations Manager
End users: SOC analysts, incident responders, security engineers, threat hunters

Qualification criteria (good fit)

The buyer seeks a SaaS-delivered SIEM with curated/packaged detection content and integrated investigation workflows.
The buyer values asset-based pricing over ingest-based billing for predictable costs.
The organization plans to deploy the Rapid7 Agent on endpoints for integrated telemetry.
The buyer requires default mid-term retention (around 13 months) with options to archive to customer-managed storage for longer-term retention.

05The pitch

What the product does (core value proposition)

Rapid7 InsightIDR is a cloud-native security information and event management (SIEM) product that Rapid7 positions as a next-generation SIEM. The product supports detection and investigation through centralized log management, detection rules, investigations and case management workflows, user and entity behavior analytics (UEBA), endpoint telemetry via the Rapid7 Agent, and optional automation and response capabilities through adjacent Rapid7 products. Rapid7 materials also describe alignment with extended detection and response (XDR) use cases when combined with endpoint telemetry and managed detection and response (MDR) services.

Target market and market positioning

Primary target: Small-to-medium and mid-enterprise security teams seeking a cloud-hosted SIEM with less infrastructure and maintenance overhead than traditional on-premises SIEM deployments.
Positioning themes: Claims of improved signal-to-noise ratio, reduced time-to-detect and time-to-investigate, integrated workflows (detections → investigations), and asset-based pricing presented as an alternative to ingest-based pricing.
Common usage pattern: A centralized interface for collecting logs, applying detections, and performing investigations, with MDR offered as augmentation for teams lacking 24/7 coverage.

- Primary target: Small-to-medium and mid-enterprise security teams seeking a cloud-hosted SIEM with less infrastructure and maintenance overhead than traditional on-premises SIEM deployments. - Positioning themes: Claims of improved signal-to-noise ratio, reduced time-to-detect and time-to-investigate, integrated workflows (detections → investigations), and asset-based pricing presented as an alternative to ingest-based pricing. - Common usage pattern: A centralized interface for collecting logs, applying detections, and performing investigations, with MDR offered as augmentation for teams lacking 24/7 coverage.

Get a comprehensive analysis of Rapid 7 (InsightIDR) including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →