Rapid7 InsightIDR

Rapid7 InsightIDR is security information and event management, identifying unauthorised access from external and internal threats and surfacing suspicious activity, combining endpoint forensics, log search and dashboards in one product, with data aggregated at an on-premises collector or a dedicated host.

Bundling endpoint forensics into the SIEM rather than requiring a separate agent is the design choice worth noting, and it addresses the moment a SIEM usually fails its user. An alert says a process ran on a machine at two in the morning, and the next question is always what else that process did, which a log aggregator alone cannot answer.

The purpose Rapid7 states is not weeding through thousands of data streams, which is the honest description of what a SIEM is for. Collecting logs is trivial and every organisation already does it; the difficulty is that the signal is buried, and the product's value is entirely in what it surfaces rather than in what it stores.

Three packages named Essential, Advanced and Ultimate give a clear ladder, with Essential positioned as the basic tool for meeting compliance requirements, which is a candid acknowledgement that a large share of SIEM purchases are driven by an audit rather than by a security programme. Quick start guides are published for each InsightIDR package. Rapid7 now markets this under the Incident Command name.