Rapid7 InsightIDR
Rapid7 InsightIDR: A broad SIEM with investigation and response tools, sold in three Incident Command packages. Ranked #4 of 28 in SIEM Software by our editors (8.9/10); pricing: Pricing on request; best for teams seeking integrated detection and incident response.
At a glance
- Editor score8.9 / 10
- PricingPricing on request
- Best forTeams seeking integrated detection and incident response
- Custom detection rulesYes
- Founded2000 · Boston, Massachusetts, United States
- Facts checked19 Sep 2026
Where it wins
- Combines log search with built-in and custom detection rules
- Links endpoint, network, identity, and cloud activity in investigations
- Offers response automation, threat intelligence, and MITRE ATT&CK mapping
Where it doesn't
- Pricing requires contacting sales
- Essentials lists 90 days of log retention; longer retention is in higher packages
- Advanced features such as AI triage and deception technology require Advanced
Our verdict on Rapid7 InsightIDR
Security operations teams looking to bring detection and incident response into one SIEM can consider Rapid7 InsightIDR. It collects and correlates logs, endpoint telemetry, network data, authentication activity, and cloud-service events, then supports searches, alerts, investigations, and response actions. Its feature set spans built-in and custom detection rules, user and attacker behavior analytics, endpoint detection and response, network traffic analysis, and investigation timelines. That breadth suits teams that want to work across several security signal types rather than focus on log search alone.
The current package presentation groups SIEM capabilities under Incident Command. Essentials is described as streamlined SIEM and includes 90 days of log retention, with an add-on option. Advanced adds AI triage, deception technology, and threat intelligence, and lists 180 days of log retention plus an add-on option. Ultimate is described as including full XDR capabilities and also lists 180 days of log retention plus an add-on option. Each package lists 13 months of alert and audit retention plus an add-on option. The pricing model is contact sales, so organizations comparing budgets will need a quote rather than a published numeric price.
Integration coverage connects the SIEM to AWS CloudTrail, Microsoft Azure, Microsoft Office 365, Google Cloud Platform, Okta, Salesforce, Palo Alto Cortex Data Lake, and Zoom. Web, API, and self-hosted platforms are listed, while deployment is specified as cloud. This makes it a fit for teams bringing varied cloud, identity, productivity, and security telemetry into investigation workflows. Organizations primarily seeking a low-cost product with transparent list pricing may prefer another option; InsightIDR is better suited to teams prepared to evaluate package scope and retention against a sales quote.
Your product? Our editors can test Rapid7 InsightIDR in depth and publish a review, labelled as paid · from $149/mo →
Rapid7 InsightIDR pricing
All 3 Rapid7 InsightIDR plans and prices →
Rapid7 InsightIDR fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Not verified |
| Free ingestion limit | Not verified |
| Data retention | 90 days |
| Custom detection rules | Yes |
| Real-time alerting | Yes |
| Deployment | Cloud |
| Query language | Log Entry Query Language (LEQL) |
| Deployment | Cloud, Self-hosted |
| Platforms | Web |
| Integrations | 8 integrations: AWS CloudTrail, Microsoft Azure, Microsoft Office 365, Google Cloud Platform, Okta, Salesforce … |
| Pricing | Pricing on request (source) |
| Website | rapid7.com |
| Facts checked | 19 Sep 2026 |
Rapid7 InsightIDR integrations
Rapid7 InsightIDR lists 8 integrations on its own site.
- AWS CloudTrail
- Microsoft Azure
- Microsoft Office 365
- Google Cloud Platform
- Okta
- Salesforce
- Palo Alto Cortex Data Lake
- Zoom
Alternatives to Rapid7 InsightIDR
- Elastic SecurityFlexible SIEM coverage with detection, threat hunting, and response workflows.9.4
- CrowdStrike Falcon Next-Gen SIEMA cloud-only SIEM combining cross-domain search, CQL detections, and automated response.9.2
- FortiSIEMA broad IT/OT SIEM with multivendor collection, analytics, case management, and SOAR.9.0
See all Rapid7 InsightIDR alternatives →
Rapid7 InsightIDR vs the competition
- Rapid7 InsightIDR vs CrowdStrike Falcon Next-Gen SIEM
- Rapid7 InsightIDR vs FortiSIEM
- Rapid7 InsightIDR vs Devo Security Operations
- Rapid7 InsightIDR vs Securonix Unified Defense SIEM
- Rapid7 InsightIDR vs NetWitness Platform
- Rapid7 InsightIDR vs Panther
Compare Rapid7 InsightIDR with any tool side by side →
Also Ranked In
Rapid7 InsightIDR is ranked in 6 of our directories.
Used Rapid7 InsightIDR? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Rapid7 InsightIDR for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Rapid7 InsightIDR is listed in our SIEM Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/rapid7-insightidr/"><img src="https://www.itechguides.com/best/badge/rapid7-insightidr.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update