Rapid7 Managed Threat Complete

My main use case for Rapid7 MDR involves points in our infrastructure level, specifically all infrastructure level.

A specific example of how I'm using Rapid7 MDR at the infrastructure level is that it helped us identify and investigate unusual internal activities such as suspicious login attempts and abnormal server-to-server communication. The 24/7 monitoring and alerting enabled our team to quickly validate the threat, contain the affected assets, and reduce the response time significantly compared to manual monitoring.

Rapid7 MDR's threat detection and response capability improves our security operation efficiency by providing continuous monitoring, expert analysis, and timely incident guidance, helping us to reduce response times.

Rapid7 MDR positively impacts my organization by improving our threat detection and response capabilities, enhancing security visibility, reducing false positives, and enabling faster incident handling, resulting in a stronger overall security posture.

In terms of impact, I have noticed specific improvements in response times, with reduced incidents and optimized workload for our internal security team through continuous monitoring and analysis, validated alerts, improved threat visibility, and lower false positive investigations.

The integration of digital forensics and incident response within the MDR service has improved our incident recovery process by enabling faster root cause analysis, quicker threat containment, and more effective remediation through expert forensic support and incident response guidance.

Having a dedicated cybersecurity advisor through Rapid7 MDR helps align my security program with business needs by providing strategic guidance, best practice recommendations, and prioritization of security issues, improving the effectiveness of our security program and ensuring better alignment with business objectives.

The best features Rapid7 MDR offers are continuous monitoring, high-quality threat detection, expert analysis and support, actionable incident recommendations, and improved visibility across the environment.

Of the features I mentioned, I find myself relying most on 24/7 threat monitoring and analyst validation because it helps focus on the real security incidents, reduce alert fatigue, and improve response.

The combination of advanced detection capability and expert SOC analyst support is a particular advantage, as it helps improve threat visibility and streamline investigation and response to security incidents more efficiently.

Regarding Rapid7 MDR's AI capabilities, I think its governance and security are enhanced by maintaining appropriate human oversight and security controls while supporting effective governance and operational reliability.

For threat detection and prioritization, Rapid7 MDR's AI capabilities, combined with analyst validation, help reduce false positives and improve the efficiency of security operations.

Rapid7 MDR offers strong visibility into detections and investigations through detailed alerts, analyst insights, investigation timelines, and actionable recommendations, helping us understand the root cause of security events and respond more effectively.

The risk-aware detection feature helps me prioritize realistic attack paths by correlating threat activity with the asset risk context, which improves threat prioritization, reduces alert fatigue, and enables more efficient incident response.

I have used the multi-vector telemetry feature in Rapid7 MDR, which improves investigation accuracy by correlating data from multiple sources, providing better context, reducing false positives, and helping us identify and respond to threats more efficiently.

I believe Rapid7 MDR could be improved through enhanced dashboard customization, additional automation capabilities, deeper third-party integration, and more detailed executive reporting for better visibility and decision-making.

I would like to see more automation, greater customization of detection rules and dashboards, deeper integration with third-party tools, and enhanced threat intelligence with more environment-specific recommendations.

I have been using Rapid7 MDR for two years.

Rapid7 MDR is stable.

Rapid7 MDR is scalable and effectively supports my growing environment across on-premises and cloud infrastructure while maintaining strong visibility, threat detection, and managed security coverage without requiring a significant increase in internal staff.

The customer support is excellent, as the team is responsive, knowledgeable, and provides timely assistance, detailed threat analysis, and actionable guidance, helping us resolve security issues efficiently.

I would rate the customer support as a nine on a scale of one to ten.

I previously did not use a different solution.

Rapid7 MDR has delivered a strong ROI by reducing alert triage efforts, improving response times, enhancing threat visibility, and providing 24/7 expert monitoring without the need to significantly expand my internal security staff.

My experience with pricing, setup cost, and licensing is that the pricing model is clear and manageable, and the setup process is smooth. While it is a strategic security investment, the value gained through continuous monitoring, expert support, and improved threat detection makes it cost-effective.

Before choosing Rapid7 MDR, we evaluated solutions such as Microsoft Defender, CrowdStrike Falcon Complete, and Arctic Wolf, and we chose Rapid7 MDR because of its strong managed service capabilities, threat detection quality, analyst support, and overall fit for our security operation requirements.

Rapid7 MDR is a good product and I recommend using it in your environment to provide more security. I rate Rapid7 MDR an eight out of ten because it provides strong 24/7 monitoring, quality threat detection, and valuable analyst support that has improved my security operations. The main areas for improvement are increased automation, more customization options, and deeper third-party integration.

Rapid7 MDR includes the SIEM and all the Rapid7 products, such as Rapid7 Automation, Rapid7 InsightIDR, Rapid7 AppSec, CloudSec, and Rapid7 SIEM, which has this MDR feature. The customer representative, who serves as a customer advisor for our company, responds very quickly to whatever concerns we have. The SIEM operations are integrated with every event source, starting from the firewalls to all other event sources where we cannot install Rapid7 agents. The SIEM features such as investigations and alerts are segmented properly so even beginners can understand the interface. It is not confusing compared to other MDR or SIEM sources. The UI interface helps you understand everything quickly and in a very short time.

The best features of Rapid7 MDR include its ease of use and UI. However, when it comes to feature-wise comparison, I cannot say it is only the best MDR tool we have. Rapid7 agent should be integrated with everything properly, but we have had issues with inability to integrate event sources from other applications such as AppLocker or host-based firewall logs. In those cases, we had to create a custom script and deploy it on the machines to collect the logs. For a top SIEM MDR solution, one should not need to write custom scripts or put in manual effort. Rapid7 seems difficult in getting logs from all applications, especially third-party or custom applications. Additionally, when comparing AI integrations with others such as CrowdStrike, Rapid7 is lacking. CrowdStrike has integrated AI agents, but Rapid7 is still developing that feature, which they hope to complete by the end of this year. Despite this, it remains easy to understand and operate, even for beginners, but its integration of logs, third-party applications, and AI needs improvement.

I would like to see improvements in AI and the integration of third-party application logs, as there is no proper way to obtain those logs.

In terms of risk-aware detection, Rapid7 MDR operates by having its own managed detection rules and creates investigations on their behalf. If any investigation is managed by Rapid7, they take care of that. However, if we create a custom rule and it is very critical, Rapid7 MDR will not manage it, which is a drawback. While Rapid7 provides insights into attack paths, it is not as efficient as CrowdStrike, which offers detailed attack path analysis, whereas Rapid7 only offers a limited view.

Regarding multi-vector telemetry, when it comes to collecting and analyzing security information from multiple sources, I would say Rapid7 does not improve the investigation process much. It is pre-configured, and the investigation chain is based on the evidence that Rapid7 decides; this does not provide real-time insights. We can only see a list of linked investigations without details on the specific parameters or processes involved.

AI, integration, and logging are definitely key areas for improvement in Rapid7 MDR. However, it is not a platform full of glitches; it is good to start with and is beneficial for any organization looking for SIEM solutions. It helps employees fully understand what is going on with Rapid7 MDR and how it integrates. The integration process is good, and the investigations and collection of event sources are also effective. You can happily start with it, but it needs more in-depth improvements to reach its full potential. If any organization is considering a SIEM solution within their budget, I believe Rapid7 has good capabilities to collect event sources, though there are noticeable differences when working in-depth.

I have been using Rapid7 MDR for one year.

In terms of stability, I can confidently rate Rapid7 MDR a 10. We have never faced any major downtime, bugs, or glitches.

Approximately seven to nine users utilize the solution.

For scalability, I would rate Rapid7 MDR an 8.

On a scale of 1 to 10 for support, I rate Rapid7 MDR a 10. The support I receive is exceptional; when I raise cases to them, regardless of the platform, the response time is usually within two days. Even complicated issues do not take more than two days to resolve. The support team is intellectual and dedicated to ensuring that issues are resolved thoroughly before closing the case.

The deployment of Rapid7 MDR is cloud-based. Rapid7 assists in the installation process by deploying several Rapid7 collectors on cloud infrastructure, whether it is Azure, GCP, or AWS. These collectors are instrumental in gathering logs from devices where we cannot install agents.

When comparing Rapid7 MDR to other solutions such as Arctic Wolf, Sophos, and Huntress, I find that Rapid7 integrates many products well, such as CloudSec, application security, vulnerability management, and automation. Rapid7 is the best for vulnerability management and has a legacy system capable of scanning machines even where we cannot install agents, which makes its architecture very efficient for vulnerability scanning. If an organization is looking to utilize Rapid7, I recommend focusing on its vulnerability management tool, also known as InsightVM. The application security is good, but I would be cautious about recommending CloudSec due to its drawbacks. The Rapid7 Automation tool serves as a SOAR tool and is beneficial for organizations that have multiple Rapid7 products, but if they do not, I would remove it from my recommended list. Overall, I believe Rapid7 vulnerability management is an essential tool for any organization.

My organization is on Azure.

Regarding the maintenance of Rapid7 MDR, it is easy and not complicated. However, ease of maintenance also depends on the setup and the customer advisor assigned to you, who should be attentive to your issues. If you have a great customer advisor, they will respond quickly and ensure any issues are handled efficiently. Thus, while maintaining Rapid7 MDR is straightforward, it relies heavily on the quality of your customer advisor.

My advice for those considering Rapid7 MDR is to pursue it if the organization wants the entire suite, which includes application security, cloud security, automation, vulnerability management, and Rapid7 MDR. If budget constraints arise compared to higher-priced tools, Rapid7 remains a solid option. While I notice slight differences compared to other platforms as an engineer, others such as SOC analysts or managers find Rapid7 a recommended solution. It may not be the best in the market, but within a reasonable budget, it is certainly a viable choice. I have rated Rapid7 MDR a 7 overall.

My main use case for Rapid7 MDR is log collection and alerting. I have a specific example of how I use it for log collection and alerting, such as sending all logs and creating custom alerts, including Duo fraud alerts.

Rapid7 MDR allows for 24/7 coverage so that I do not have to pay for 24/7 coverage separately.

I cannot share any specific outcomes or metrics, such as time saved, cost savings, or improved detection rates since I started using Rapid7 MDR.

The inclusion of digital forensics and incident response within the MDR service has helped during incidents, as we were able to stand up queries to find what we needed a couple of times; other times, it has mostly just been the alert.

The best features Rapid7 MDR offers are seeing our own data and custom alerting. I find the process of setting up and tuning those custom alerts to be straightforward.

I do not know what risk-aware detection features in Rapid7 MDR are, so I cannot say how they help prioritize realistic attack paths. I do not know if I have used the multi-vector telemetry feature in Rapid7 MDR.

I understand that multi-vector telemetry means Rapid7 MDR pulls data from many sources, and it does include data from multiple sources, but it has never been helpful because of our environment; we do not necessarily sync all of our systems.

Having a dedicated cybersecurity advisor through Rapid7 MDR is not useful in aligning our security program with business needs; however, they do show us new features coming out and how to use the tool, so they are a valuable resource when I do not want to waste time with support.

An improvement for Rapid7 MDR would be to make it work with Orchestrator more easily, as it is currently cumbersome and confusing. I would like to add that we are trying to get custom alerting to our ticketing system, but all the options are not efficient.

The accuracy and reliability of output in Rapid7 MDR are trustworthy, although the query builder could use some work. There are no other improvements needed for Rapid7 MDR that we have not discussed.

I assess the transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations as somewhat slow; we usually find issues before the team does.

I have been using Rapid7 MDR since 2021.

Rapid7 MDR is stable for me; there are no issues and no downtime.

Rapid7 MDR's scalability is strong and has kept up as my organization has grown or changed.

The customer support is inconsistent. I would rate the customer support a seven on a scale of one to ten.

Before Rapid7 MDR, I used Arctic Wolf because they are the worst in the industry and they raise their costs eight percent every year.

We have custom alerts which save time, but I have not really saved time in the sense of auto-closing because Orchestrator is not set up efficiently.

My experience with pricing and setup cost was good, as pricing includes licensing. However, setup was slow.

I evaluated Red Canary and some other options before choosing Rapid7 MDR.

On a scale of one to ten, I would rate Rapid7 MDR a nine. I would rate it a nine because Orchestrator implementation would make it a ten for me. I do not know what governance and security regarding Rapid7 MDR's AI capabilities mean or how to answer that. I have no concerns about the AI features in Rapid7 MDR being secure and managed well.

Rapid7 MDR is deployed in my organization with on-site collectors that send to a public cloud. I do not know which cloud provider is used, but I know Rapid7 hosts it. My advice to others looking into using Rapid7 MDR is that it is what you make of it. I rate Rapid7 MDR a nine out of ten overall.