Rapid7 InsightIDR

Rapid7 InsightIDR is a cloud-delivered security information and event management product, now marketed by Rapid7 under the name Incident Command, while the documentation still titles it SIEM (InsightIDR). It collects logs from firewalls, identity systems, cloud services and endpoints, normalises them, ties events to users and assets, and raises alerts for a security operations team to investigate. The vendor also describes it as extended detection and response when the endpoint agent and its forensic features are in use.

Rapid7, a United States company, sells it in three packages called Essentials, Advanced and Ultimate. Customers that buy Rapid7 managed detection and response get logins to the same console, so the product can serve a team that runs its own operations centre or one that shares monitoring with Rapid7 analysts. The vendor's home page cites more than 11,000 customers across its portfolio, a figure that covers all Rapid7 products.

• Log collection and search. Event sources send logs to a collector, which forwards them to the cloud. Log Search then allows queries, dashboards and compliance reports. The vendor also advertises natural language search across large record sets with its AI tooling.
• User attribution. The product normalises raw data into a common JSON form and then correlates activity between a single asset and a user. That lets an analyst see who, from which device and at what time, rather than only an IP address.
• Rapid7 Agent for endpoints. A lightweight agent on supported assets adds real-time endpoint monitoring, process data, remote asset visibility and response actions. The documentation calls it critical to the product's endpoint detection and the source of hundreds of attacker-analytics rules.
• Deception technology. Honeypots and similar traps alert on attacker activity even when nothing else looks suspicious. The vendor lists deception technology from the Advanced package upward, with AWS honeypots documented.
• Detection as code. Teams can manage detections as code, alongside legacy and basic detection rules with automation. Behavioural analytics and user behaviour analytics cover lateral movement and privilege abuse.
• AI triage and enrichment. The home page describes AI triage, contextual enrichment of every alert with exposure and vulnerability data, and guided response. Agentic investigation workflows are listed among the product's capabilities.
• Response automation. Orchestrator and automation features can isolate hosts, revoke credentials or kill processes, and create ServiceNow or Jira tickets. The Ultimate package adds embedded forensics and the vendor's XDR capabilities in a single agent.

• A mid-size company with a two-person security team. A small team installs a collector and the agent, connects Microsoft 365, Okta and the firewall, and relies on built-in detections plus prioritised alerts instead of writing every rule themselves.
• An organisation with audit duties. A compliance owner picks the Essentials package for central log retention, using Log Search and dashboards to answer auditors. The documentation says logs stay searchable for 13 months by default.
• A company that outsources monitoring. A business buys Rapid7 managed detection and response. Rapid7 analysts monitor and hunt, and the in-house team receives console access for log search, reporting and visualisation. The vendor expects at least 80 percent of supported assets to run the agent.

Onboarding is built around two components. A collector, installed on a server or virtual machine with a fully qualified domain name, gathers event sources such as Active Directory, firewalls and cloud services and sends them encrypted to the cloud. The Rapid7 Agent goes on endpoints for real-time data. The documentation offers a separate quick start guide for each package.

Rapid7 advises about 1 GB of collector disk space for every 10 GB of data, plus 24 hours of spillover, and the collector is not supported on ARM architecture. The product does not ingest historical data from event sources, so analysis starts from connection time. A demo is offered on the vendor's pages, and no self-serve trial is shown on the pages read.

Rapid7 now sells this SIEM as Incident Command in Essentials, Advanced and Ultimate packages, with AI triage and deception technology from Advanced and XDR with embedded forensics in Ultimate. The InsightIDR address redirects to the new page, while the docs still title it SIEM (InsightIDR). The pages show no prices, only a demo. Rapid7 lists a Boston address.

Rapid7 InsightIDR is entry #8 of 12 in the SIEM software list: Datadog sits directly above it and Microsoft Sentinel directly below. No numeric score is attached; established products follow the challengers in their ranked order.

Rapid7 InsightIDR is based in the United States; 10 of the 12 products here share its region, North America.

Incident Command combines logs, telemetry and asset context in one view and enriches alerts with exposure, vulnerability and asset risk data.

The packages step up from streamlined SIEM with threat hunting in Essentials, to AI triage and deception in Advanced, to endpoint detection and embedded forensics in one agent in Ultimate.

That bundling helps buyers already using Rapid7, but it ties the SIEM to the same vendor's agent, so leaving later means replacing more than the SIEM.

In the catalogue: Essentials, Advanced and Ultimate packages; quoted per organisation; demo offered.

Rapid7 does not publish prices for this product on the pages read. It sells three packages, Essentials, Advanced and Ultimate, and invites visitors to request a demo or talk to sales. The documentation describes Essentials as a basic tool for compliance requirements, Advanced as the core detection and response tool, and Ultimate as the extended detection and response tier. No amounts, currency, billing period or per-gigabyte rate appear on the vendor's pages. Log Search data is retained 13 months on the standard subscription, and the documentation says customers can buy additional retention. A separate managed detection and response subscription is sold on top. Volume terms are not published.

Where this comes from: the vendor pages at rapid7.com/products/insightidr, checked for Best SIEM Software in 2026 on 5 November 2026.

The documentation states that the product is hosted in Amazon Web Services for all data storage and analytics. Data is encrypted before it leaves the collector, using public key cryptography and challenge-response handshakes, and each customer's logs are tokenised with a unique identifier to separate them.

The collector removes unnecessary raw logs and sensitive data, and credentials are not stored in AWS. Logs and generated detections are kept 13 months, and logs can be archived to your own Amazon S3 bucket. Specific hosting regions and compliance certifications are not stated on the pages read; the vendor runs a separate Trust page.

Integrations the vendor names (12):

• Microsoft Active Directory
• Office 365
• Microsoft Defender for Endpoint
• Okta
• Duo Security
• AWS CloudTrail
• AWS GuardDuty
• Google Cloud Platform
• CrowdStrike Falcon
• Palo Alto Networks firewall
• Cisco Umbrella
• Zscaler

Closest by traits, not by rank: 3 products from the same list that overlap most with Rapid7 InsightIDR.

• Google Security Operations (#10 of 12): SIEM, SOAR and threat intelligence sold as ingestion-based packages. Watch out: rule capacity is capped per package, so growth in detections can force a move to a dearer package. (United States)
• Splunk Enterprise Security (#11 of 12): Splunk's SIEM in Essentials and Premier editions, priced by quote. Best for: Large security teams that already run Splunk for logs and want one vendor.
• IBM QRadar (#12 of 12): Not for: teams wanting a self-serve cloud SIEM with published pricing. On-premises SIEM licensed by events per second or managed servers.

Read from the vendor’s own pages on 5 November 2026.

• rapid7.com/products/insightidr: Incident Command naming, three packages, AI triage, response and deception descriptions, 11,000 customer claim
• docs.rapid7.com/insightidr: overview, AWS hosting, packages, quick start guides, event source list
• docs.rapid7.com/insightidr/data-storage-faq: 13-month retention, encryption, tokenisation, S3 archive, AWS redundancy
• docs.rapid7.com/insightidr/log-collection-and-storage: normalisation, user attribution, no historical ingestion, credentials not stored in AWS
• docs.rapid7.com/insightidr/collector-requirements: collector disk space, FQDN and ARM limits
• docs.rapid7.com/insightidr/insight-agent: agent benefits and 80 percent MDR requirement

Four tests decide a position: how soon the product is useful, what the bill really becomes, how data leaves and who it suits. Here that gives Rapid7 InsightIDR the #8 position in a list of 12. How vendor facts are sourced, and how money can and cannot influence a page, is in the editorial process.