Rapid7 InsightOps provides asset management, log tracking, and issue resolution with machine learning threat detection, enhancing integration with various systems for real-time monitoring across networks.
| Product | Mindshare (%) |
|---|---|
| Rapid7 InsightOps | 0.8% |
| Splunk Enterprise Security | 6.8% |
| Wazuh | 4.8% |
| Other | 87.6% |
| Type | Title | Date | |
|---|---|---|---|
| Category | Log Management | Jun 23, 2026 | Download |
| Product | Reviews, tips, and advice from real users | Jun 23, 2026 | Download |
| Comparison | Rapid7 InsightOps vs Splunk Enterprise Security | Jun 23, 2026 | Download |
| Comparison | Rapid7 InsightOps vs Wazuh | Jun 23, 2026 | Download |
| Comparison | Rapid7 InsightOps vs Cribl | Jun 23, 2026 | Download |
| Title | Rating | Mindshare | Recommending | |
|---|---|---|---|---|
| Datadog | 4.3 | 4.0% | 97% | 211 interviewsAdd to research |
| Splunk Enterprise Security | 4.2 | 6.8% | 94% | 402 interviewsAdd to research |
| Company Size | Count |
|---|---|
| Small Business | 6 |
| Midsize Enterprise | 1 |
| Large Enterprise | 2 |
| Company Size | Count |
|---|---|
| Small Business | 46 |
| Midsize Enterprise | 24 |
| Large Enterprise | 56 |
Rapid7 InsightOps enables businesses to track assets, manage logs, and resolve issues efficiently. It offers predefined policies, customizable dashboards, and ticketing system integrations. Its endpoint agent ensures real-time monitoring and forensic analysis, aiding incident response and root cause analysis. Log aggregation and search functionality enhance operational efficiency by integrating with SIEM systems. Improvements in search capabilities, interface user-friendliness, and expanded security features could significantly boost user experience and performance.
Why consider Rapid7 InsightOps?Finance sectors extensively implement Rapid7 InsightOps for alert generation, suspicious login detection, and ensuring regulatory compliance. It helps in monitoring IT environments by centralizing log data, analyzing unexpected behavior, data discrepancies, and checking message deliveries, vital for maintaining security and operational standards.
Rapid7 InsightOps was previously known as InsightOps, Logentries.
Trimble Navigation Limited
| Author info | Rating | Review Summary |
|---|---|---|
| Head of Sales Services Department at a comms service provider with 51-200 employees | 4.5 | I've used Rapid7 InsightOps for two years to support compliance needs, finding its automation, dashboards, and threat detection effective, with straightforward setup and solid support, though minor interface improvements could enhance usability. |
| Compliance Ofcr at Hotel Trader | 5.0 | Our application generates numerous logs, and we use Rapid7 InsightOps to manage them efficiently. We appreciate its ability to create key-value pairs from text. However, the initial website load time is slow. We switched from CloudWatch upon a client's recommendation. |
| Technical Team Lead at Quester | 4.5 | I use Rapid7 InsightOps for log investigation. Its search is valuable, though query reliability needs improvement. It's a stable, scalable, and easy-to-use solution, performing well for our team, and I recommend it. |
| Senior Security Consultant at ITSEC Asia | 4.0 | Our clients utilize Rapid7 InsightOps for real-time IT monitoring, valuing its integration with other tools to boost operational efficiency. However, the dashboard needs improvement to aid less technical users, as it currently lacks clear guidance on features. |
| Senior Software Engineer at Saama | 4.5 | I use Rapid7 InsightOps for security information and event management by centralizing and analyzing logs from various devices. Its features simplify attack identification and incident response, though it could improve with dashboards to enhance security awareness. |
| Information Security Officer at a tech services company with 501-1,000 employees | 3.5 | I use this SIEM for alerts and log tracking from various sources. It's stable, scalable, and easy to set up. My main issue is the limited flexibility for complex queries due to its SaaS nature. |
| Technicien Niveau 2 at a tech services company with 11-50 employees | 5.0 | I found InsightOps invaluable for root cause analysis, aggregating logs from multiple sources and standardizing them. My main concern during the two-month beta was dashboard clarity, possibly due to limited documentation. |
| Cyber Security Engineer at a recruiting/HR firm with 51-200 employees | 4.5 | I find this product offers excellent off-network endpoint visibility, easy deployment, and forensic tools, outperforming previous solutions. While real-time queries can be slow, its comprehensive monitoring and support are highly effective. |
| Systems Administrator at a university with 10,001+ employees | 4.5 | I found the product's dashboard and manageability great. Setup was mostly easy, though AD connection was harder initially. After that, it's been stable and easy to use, saving time compared to SCCM. Customer service is great. |
| InfoSec Consultant at a tech services company with 51-200 employees | 4.5 | I love InsightOps for its complete asset visibility, quick issue resolution, and improved team efficiency. Setup is easy, it’s stable, scalable, and support is excellent. It's clearly superior to previous solutions and competitors. |
The usual use cases for Rapid7 InsightOps that I work with are to meet standard requirements such as PCI DSS and ISO standards, collecting data and protecting event logs.
Rapid7 InsightOps plays a significant role in maintaining regulatory compliance for my customers, as it meets mandatory requirements for collecting and managing logs in standards like PCI DSS, especially for financial sectors.
The features of Rapid7 InsightOps that I have found most valuable are the predefined policies and the use of correlation rules, which are very valuable because they eliminate the need to spend time creating those rules.
This feature detects insider threats or compromised credentials by using user behavior analytics, which can collect other compromise indicators. It makes it easier to install and implement this solution because you can run it as normal behavior of users and then switch off to look for the anomalous behavior of any entities, such as laptops and others. In any violation or restricted behavior, the system will notify you that something unusual is occurring.
The machine learning algorithms in Rapid7 InsightIDR for threat detection work quite effectively as part of the user entity behavior analytic model, allowing us to focus group normal typical behavior of users and then turn on the rule to spot any unexpected behavior.
The automation features of Rapid7 InsightOps are quite satisfactory, as users appreciate these features, especially when integrating with the ticketing system. If something goes wrong, InsightOps will notify the ticketing system to create a ticket and assign it to the responsible person to handle the events found in the infrastructure.
The customizable dashboards in Rapid7 InsightOps are quite valuable and interesting because SOC center operators spend most of their time investigating on those dashboards, making them easy to manage. Additionally, we can configure email reports for high-level talks, sending historical data without needing to look online, which is very convenient.
In my opinion, there are no specific areas of Rapid7 InsightIDR that need improvement because all solutions in the SIEM market, including InsightOps and its competitors, are doing the same things but with different approaches, using automation and user and entity behavior analytics as essential parts of the solution.
Some minor changes or updates I might introduce could involve making the interface more user-friendly or optimizing configuration for more flexibility, but it is really a matter of preference. Some administrators prefer a detailed configuration, while others appreciate the convenience of clicking on a record for deep analysis.
I have been working with Rapid7 InsightOps for about two years.
I have not worked with the real-time data indexing feature of Rapid7 InsightOps yet.
I have never seen complaints regarding the stability of Rapid7 InsightOps.
I find Rapid7 InsightOps to be scalable; you just need to purchase a new license to collect more logs or data sources, depending on your prior license setup.
The customer service and technical support for Rapid7 InsightOps is satisfactory, as customers can create support tickets on the vendor's web portal, and the vendor usually offers different support levels. In most cases, it is not necessary to have immediate reactions, so customers often opt for the lowest level of support with response times of a few days, which leads to overall satisfaction.
Based on my experience with the technical support, I would rate it excellent.
Positive
My experience with the initial setup and deployment of Rapid7 InsightOps is straightforward because it is a cloud-based solution that does not require installation or integration with third-party threat intelligence platforms. You just connect to your infrastructure, whether on-premise or in the cloud, and it starts working, focusing on creating correlation rules important for your business and connecting event log sources.
The integration capabilities of Rapid7 InsightIDR with other security or IT management tools are quite simple. To integrate with another solution, you just need that solution to push system logs into Rapid7 InsightOps, or you can install an agent to pull those logs from the entity and send them to the solution, which is quite simple without needing any huge changes.
On a scale of one to ten, I rate Rapid7 InsightOps a nine.
We receive messages from our clients, and we send messages too. So our application generates a lot of logs. We push all these messages to Rapid7. If a client does not receive a message from us, we go to Rapid7 and query with that timestamp and message.
We can save logs as plain text. If we have a column in a text, it automatically creates a key-value pair. It is very useful. Whatever we need to do is present in the solution.
The solution takes a little bit of time when we load the website for the first time. It takes 15 to 20 seconds to load for the first time.
I have been using the solution for three years.
The tool is not that stable. There are some issues with the metrics. Although we push a lot of logs to the solution, sometimes, it shows fewer records. Our subscription is for 30GB per month, but we are pushing more than 30GB of records per month. The product is neither stopping us nor is it charging us extra. Though it is a bug in the code, it benefits us. I rate the solution’s stability an eight out of ten.
The solution is scalable. We are pushing 150 million records daily. We did not find any problems yet. I rate the product’s scalability a ten out of ten.
We were using CloudWatch before. One of our clients suggested we move to Rapid7. They were already using it, so they told us that Rapid7 was very good. So we moved to Rapid7. We didn't do much research when we moved to Rapid7.
I rate the ease of initial setup a nine out of ten. There are some bugs in the UI. If there are 100 logs on the screen, we cannot scroll it properly. The product is very easy to set up.
The deployment took only five to ten minutes.
The product is cheap.
We are using the latest version of the solution. We are considering moving away from the product. If the tool does not remove InsightOps, we will keep using it. Otherwise, we will switch. The product is deployed on the cloud in our organization. We do not deploy the tool in our system. We just send the logs to Rapid7.
It is easy for us to find the features available in the product. Rapid7 is a good solution. People can definitely use the product as long as the product doesn’t stop supporting it. Overall, I rate the solution a ten out of ten.
We use Rapid7 InsightOps to look at the logs from customers who report some unexpected behavior in applications. We look at the logs to see what has happened. Sometimes the customers complain that the data is different from what they had submitted, we look at the logs to see what data the user submitted and what data we have stored in our database.
The most valuable feature of Rapid7 InsightOps is the search functionality.
Rapid7 InsightOps could improve by making the search query better. There are times when the search query is broken and it does not find anything.
I have been using Rapid7 InsightOps for approximately one year.
The stability of Rapid7 InsightOps has been good.
Our company handles a lot of donations on a daily basis and Rapid7 InsightOps has been working well for our usage. We have not faced any issues.
We have approximately 20 to 25 developers using this solution in our team. Most use it roughly once a week, while others use it more.
The solution works for different sized companies, such as medium and small.
I have not had any issues with Rapid7 InsightOps for the need to contact support.
I have used ELK Logstash previously. The main difference is ELK Logstash is we have to host it. I have not noticed any major differences between the two.
The setup of Rapid7 InsightOps was done by our CTO. The maintenance of the solution is handled by our platform team.
My advice to others is this is an easy-to-use solution and they should try it out.
I rate Rapid7 InsightOps a nine out of ten.
Our clients use InsightOps for real-time monitoring of their IT environments.
Integration of InsightOps with other tools, especially SIEM solutions, has generally improved operational efficiency.
Improvement is needed in the dashboard of InsightOps, especially for less technical users. Currently, it lacks clear guidance on icons and features, making it confusing for those with limited experience, like level one support staff. They require more assistance to understand and interpret the information.
I have been working with Rapid7 InsightOps for ten years.
I would rate the stability of the solution as a nine out of ten.
I would rate the scalability of the solution as a nine out of ten. Our clients for InsightOps typically fall into the small to medium-sized business category. Large enterprises usually have multiple tools in place already. The solution is more commonly installed by businesses that aren't the largest in their industry but still require comprehensive security solutions.
I would rate the easiness of the initial setup as a seven out of ten. Generally, installation isn't too difficult for me due to my experience, unless specific prerequisites are needed, like with some IBM software.
Deployment time varies depending on the system. For simpler and more compatible solutions, it usually takes minutes to hours. However, for more complex systems, especially on-premises installations, it can take weeks or even longer due to compatibility issues and additional configuration requirements.
The dashboard and reporting functions of InsightOps are clear and understandable for technical users, but less so for non-technical individuals who may need more guidance to understand it.
Overall, I would rate Rapid7 InsightOps as an eight out of ten.
Rapid7 InsightOps is a security information and event management platform that collects and analyses logs from servers, user systems, and network and infrastructure devices. The data is stored in a centralized data for future analysis.
Rapid7 has a collection of logs. You can easily identify the attack. The solution’s investigation and reporting educate us and help us to respond to incidents.
Rapid7 InsightOps can improve security attack time by providing dashboards that help users analyze and understand the security posture.
I have been using Rapid7 as a customer.
The product is stable.
Rapid7 provides timely support using direct chat or contact with support. We have enterprise support, which includes access to P1 tickets.
Positive
The initial setup is easy. We can directly install it on any environment, including Linux, Windows, CentOS, and Mac. They are providing multiple setup configurations.
We should understand the basic concepts of Rapid7 InsightOps. We are using Rapid7 InsightOps to collect and analyze data. We need to ensure that our environment is suitable before proceeding.
The solution is user-friendly and support all environment like Linux, Windows, CentOS, etc. It is suitable for all.
Overall, I rate the solution a nine out of ten.
I use it primarily to send alerts, or detect suspicious logins, and be proactive in the detection of compromised accounts.
All of them. I use it as a security incident and event management system. It has the ability to alert and track logs from different sources.
Flexibility. There are a few things I would like to do with a few more complex queries which I am not able to do right now, because it is a SaaS solution. I think it really comes to that. One of the main drawbacks of SaaS is the limited flexibility of its advanced features.
For the security aspects, there are things that all the Rapid7 products have (all the solutions have) that they don't have in this product, or that I have not seen yet.
I have used it fairly recently. We tested it about six to eight months ago. Right now, I have been using it for the last two months.
There have been a few browsers hiccups, depending on the browser. Otherwise, it is fairly stable.
No, as far as I have noticed, I do not have any issues scaling up the product.
Good. I mainly asked for some tech support when I was in the testing phase. I don't really know how to assess it.
I did not need help during setup. I have not gone through any trainings. I only asked a few questions about features and things like that, which may have not been available to me during the testing phase and I have not tried to implement them yet.
I had a previous solution, and I switched to Rapid7 insightOps due to management and costs.
It was really simple. They have some documentation. It is pretty straightforward for the client to install. There are really limited things to configure on their interface.
I chose from a pool of options, some that included all of the Rapid7 products, which were more focused on security. I probably had four or five options which I looked at during the initial process.
Do your homework beforehand to know what you expect from such a solution and how you plan to scale up. Because like any solution, when you scale up, you want to first make sure you have a solution that can handle it, and second, the cost of expanding matches your expectations.
Imagine having to recreate the timeline of an event across three servers, with multiple logs each, and some logs dated using UTC and some using our actual time zone. You either have to build complex scripts using grep, sed, and awk to standardize the data before you can start your analysis or you risk getting lost. InsightOps does it all automatically so you can get to work right away. Less time lost and less risk of taking the wrong path.
Since I used the beta, improvements are to be expected. The dashboard options could have been clearer, but I believe it is more a problem with the limited documentation available at the time.
Two months. The time that the beta lasted.
None at all.
No, but our testing has been rather limited.
We have a lot of mobile users who are not always on our network, and this gave us the ability to have full visibility into them. We're able to do real time requests and questions with the agent. So I can basically search all my agents and see if there's a malicious registry key in any of the registries. I can see a process that might be running, that should be running or shouldn't be running, I can do a real time query across the entire board.
You can use this to also see if systems are up or down, from an infrastructure level as well. So it has more than just monitoring things for malicious activity. It can also see if things are working properly as well.
The most important feature is the ability to have the end point agent on all of our systems. And since they talk back to their cloud infrastructure, it doesn't matter if the systems are on our network or not on our network. We still get real time feedback, not only on the InsightOps part, but also our InsightIDR and others as well. It's only one agent, and they all pull back data that's relevant to our network.
It also gives us a lot of almost "forensic" capabilities, because the agent itself monitors the entire system, from the registry all the way down to the file level. If there's anything malicious, or network connections, anything of that nature that's going on, you can do searches on them and it's beaconing back in real time.
Yes. The searching capability, or when you ask real time questions. The searching is pretty decent but it's still not up to par with, say, Splunk. It's much better than it used to be but it can take a little longer than you may want.
Also, when you do the real time queries, if you do too many it could take longer than you want. They're constantly improving it, so I will give them credit on that. It is getting better, but it still could take a little longer than you care for.
It's hard to say that it's not fast enough when you're querying agents that are overseas and not on your network. So, it does do a pretty good job of handling that type of traffic, but sometimes it can take a little bit for everything to populate.
No, not at all. It's actually very simple. I don't know if you can or not, but you could probably deploy it through a group policy if you wanted to. But we use K Software deployment. I just take the MSI, put in a few command lines, and toss it onto all my systems as need be.
It was very, very simple to deploy the agent, and that agent automatically communicates back to their cloud service, or to your onsite collector, if it's onsite. All those settings are configured automatically, it's not something you have to do. So setting up the agents and the collector for it, you have visibility over everything, it's very simple.
And if you're also using it to integrate other logs from other sources, that's extremely easy as well, because they will ingest any logs. Some products won't, for example, take logs from Splunk, or they won't take logs unless they're in a separate format. That's probably one of the better attributes of InsightOps. If you put an onsite collector, and you point things at it to collect logs, it doesn't matter what format it's in, it can ingest just about any type of log.
You can set up alerts, queries and dashboards based off those logs as well. You're not just limited to what InsightOps has. You can also use logs from other sources to give you more insight or more information, where it's feasible.
I have a Customer Success Manager, so I have called their customer support. When you call their customer support you get several people immediately jumping on what's wrong. Normally, I don't have to worry about the problems because they usually know about them before I do, because they're very on top of things.
But I do have a customer rep so if I have any problems that aren't immediate, I can email her. She always helps me take care of it the same day. Or if it's gonna be longer, because it needs to be developed, she gets that put in, then that gets worked on as well. Whenever I've had to call them, I've never had a problem with their customer support at all.
We used to use SecureWorks as our MSSP for everything from end point protection to infrastructure monitoring. To say we weren't happy with them would be probably an understatement. We felt we were overpaying, and getting less than we should. What they tried to sell us on and say they could do, they couldn't. They said they could do true end to end correlation and visibility on all your assets, and that just didn't happen until we got Rapid7 and got their products. It was IDR, Ops and really combining the two. But even just Ops by itself gave us more visibility and better alerting than we had with SecureWorks.
One of the things I didn't like about them is that there was a lot of false positives. You would try to tune them, you'd try to work with their associates to try and get things customized to your environment, and it just never seemed to really work properly. Whereas with Ops and IDR and our other ones, we've been able to get it to a point where we don't have alert fatigue, and false positives. I don't really have to worry about that anymore, where it used to be kind of a headache.
Very similar to when I was talking about deploying the agents and all that. It goes hand in hand with the actual setup.
There are just two of us, me and my boss, and when we did the proof of concept for it I told my boss, "I should have it set up completely in less than two weeks." He laughed at me, jokingly. But, really, I had probably 98% of it set up in the first two weeks. The last two percent were very customized things that I was trying to do personally, to see if I could get it done.
But when it came to getting it set up, getting the agents deployed, getting the collector deployed, getting all the root things, and the root metrics and operations set up, yeah two weeks was all I needed. And that was by myself. Bigger companies may take a little bit longer, whether it's red tape or it's just they have more hoops to jump through, but when it comes to really setting it up, it's not very difficult.
We did a proof of concept with a few other companies before we purchased this one. It seems like they are definitely one of the best in the field. Whether we're talking about ease of deployment or price. We get way more out of it than we did with SecureWorks and we pay about a third of the price.
Make sure you know what you're trying to monitor. Because one of the things that you can do, and I started doing it at the beginning myself, is have it ingest all the logs you give it. I mean, we have everything pointed at it and giving our alerts and our logs to it. And then I got to the point where I've got everything coming in, what do I need to monitor the most? So having a very well defined path for it, on exactly what you want to use it for. What you want to monitor, how you want your alerts to go.
Just make sure you have a good starting point.
Whether it's price, customization, full user visibility, full end point invisibility, it gives you a lot that you can do with it. In some ways you're only limited based off of what you can think of, and what you come up with to monitor, or to develop, or feed for logs.
Dashboard and manageability.
Easy to use and spend less time on setups/troubleshooting.
There were some difficulties in product setup, but after those issues were resolved, there were no issues.
Two months.
No.
No.
Great.
SCCM. That product was not easy to use.
Setting up the application was easy, but connection to the AD structure was a little harder than with other applications.
Licensing model is easy.
LANDesk.
Look into standardizing your naming schemes prior to implementation. It will save you a lot of time later.
You have a complete view of your assets, from logs to monitoring to queries. In a single web interface it is possible to resolve even the trickiest issue very quickly. Once you start using InsightIDR, which works hand in glove with InsightOps, you will feel like you were operating in the stone age before.
Our service desk and sysadmins are now less busy tracking "boring issues". InsightOps helps them to focus on real problems and to have all IT assets monitored in one place.
Not because it's not great already, but because when it comes to searching there are always new (hopefully better/cleaner) ways to present data and analyze it.
Three months or so. We also took part at beta testing process.
No issue, the cloud-based solution works very well.
No issue, the cloud-based solution works very well.
Maybe I'm biased because of the beta program, but the support is very quick and competent. Also, the Rapid7 community is a great help, and public docs are gold.
We had Nagios and WhatsUp Exchange Monitor. We removed Nagios because the hidden costs were too high. We were quite happy with WhatsUp, mainly because we have a couple of very expert engineers. InsightOps is head and shoulders above the rest.
Setup is very neat. You deploy an agent and start collecting data in minutes. Very easy.
Licensing is quite flexible and pricing is affordable. Plus, you can ask for a 30-day demo.
We tried almost every competitor, both FOSS and commercial, but there is no real competitor yet.
Try the demo, you'll find yourself loving it.
