Rapid7 InsightIDR review
A broad SIEM with investigation and response tools, sold in three Incident Command packages.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Security operations teams looking to bring detection and incident response into one SIEM can consider Rapid7 InsightIDR. It collects and correlates logs, endpoint telemetry, network data, authentication activity, and cloud-service events, then supports searches, alerts, investigations, and response actions. Its feature set spans built-in and custom detection rules, user and attacker behavior analytics, endpoint detection and response, network traffic analysis, and investigation timelines. That breadth suits teams that want to work across several security signal types rather than focus on log search alone.
The current package presentation groups SIEM capabilities under Incident Command. Essentials is described as streamlined SIEM and includes 90 days of log retention, with an add-on option. Advanced adds AI triage, deception technology, and threat intelligence, and lists 180 days of log retention plus an add-on option. Ultimate is described as including full XDR capabilities and also lists 180 days of log retention plus an add-on option. Each package lists 13 months of alert and audit retention plus an add-on option. The pricing model is contact sales, so organizations comparing budgets will need a quote rather than a published numeric price.
Integration coverage connects the SIEM to AWS CloudTrail, Microsoft Azure, Microsoft Office 365, Google Cloud Platform, Okta, Salesforce, Palo Alto Cortex Data Lake, and Zoom. Web, API, and self-hosted platforms are listed, while deployment is specified as cloud. This makes it a fit for teams bringing varied cloud, identity, productivity, and security telemetry into investigation workflows. Organizations primarily seeking a low-cost product with transparent list pricing may prefer another option; InsightIDR is better suited to teams prepared to evaluate package scope and retention against a sales quote.
Rapid7 InsightIDR pros and cons
- Where it wins
- Combines log search with built-in and custom detection rules
- Links endpoint, network, identity, and cloud activity in investigations
- Offers response automation, threat intelligence, and MITRE ATT&CK mapping
- Where it doesn't
- Pricing requires contacting sales
- Essentials lists 90 days of log retention; longer retention is in higher packages
- Advanced features such as AI triage and deception technology require Advanced
Rapid7 InsightIDR fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update