Try our new research platform with insights from 80,000+ expert users

Elastic Security vs Rapid7 InsightIDR comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Sep 9, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Elastic Security
Ranking in Security Information and Event Management (SIEM)
5th
Ranking in Endpoint Detection and Response (EDR)
16th
Ranking in Extended Detection and Response (XDR)
8th
Average Rating
7.6
Reviews Sentiment
6.7
Number of Reviews
63
Ranking in other categories
Log Management (5th), Security Orchestration Automation and Response (SOAR) (6th)
Rapid7 InsightIDR
Ranking in Security Information and Event Management (SIEM)
9th
Ranking in Endpoint Detection and Response (EDR)
20th
Ranking in Extended Detection and Response (XDR)
15th
Average Rating
8.4
Reviews Sentiment
7.5
Number of Reviews
31
Ranking in other categories
User Entity Behavior Analytics (UEBA) (3rd), Threat Deception Platforms (5th)
 

Mindshare comparison

As of January 2025, in the Security Information and Event Management (SIEM) category, the mindshare of Elastic Security is 7.5%, down from 9.8% compared to the previous year. The mindshare of Rapid7 InsightIDR is 2.6%, down from 2.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Security Information and Event Management (SIEM)
 

Featured Reviews

Nikhil-Kumar - PeerSpot reviewer
Customizable with great dashboards but the premium support is poor
The initial setup can be complex if you don't have technical knowledge. However, once it is deployed, it works well. I'm not sure how long it took to deploy. I wasn't there when it was set up and configured. We have an internal team that handles deployment and maintenance. It doesn't require too many people to deploy. Five or six people would be enough. However, for 24/7 monitoring, you need to have someone always on it.
Prasanth Prasad - PeerSpot reviewer
Offers capabilities in areas like threat intelligence and vulnerability management but needs to improve support
The most valuable feature of the product for managing security events stems from the fact that the product's intelligence part is very good since it offers its own threat intelligence and vulnerability management platform. The tool also has its own cloud security posture management platform. The tool also is a dynamic application security testing platform. The aforementioned tools fall under Rapid7 InsightIDR's kitty. The intelligence and the data that Rapid7 gathers from customers across the globe enrich the quality of its detection capabilities. All other tools in the market depend on third-party solutions for intelligence. Rapid7 InsightIDr has the intelligence part natively available within the product, giving it a good edge over other vendors.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The stability of the solution is good."
"The most valuable feature is the speed, as it responds in a very short time."
"Elastic Security is a highly flexible platform that can be implemented anywhere."
"The feature that we have found the most valuable is scalability."
"Just the ability to do a lot more than just up-down is nice, which a lot of people take for granted."
"Its flexibility is most valuable. We can have a number of scenarios, and we can get logs from anything. If we know how to use Logstash, we can tweak it in many ways. This makes the logging search on Elastic very easy."
"The most valuable feature for me is Discover."
"ELK documentation is very good, so never needed to contact technical support."
"The web interface is great — very useful and user-friendly."
"It improves because several sensors are deployed within the on-premise environment. It can be very efficient if the customer implements and operates it effectively."
"If you were on other solutions, you would notice that they use agents from third-party, from open-source, from a native OS, or from other tools. Here, however, it is an agent from Rapid7 itself. This adds to the solution's overall capabilities."
"Enables the use of honey pots, honey users, and honey files to monitor for suspicious patterns."
"Rapid7 InsightIDR integrates well with other solutions. It's also easy to configure because Rapid7 InsightIDR has a lot of instructions posted on their website that customers can follow if they need to get the source log."
"Scalability-wise, I rate the solution a ten out of ten. As a cloud tool, the product is highly scalable."
"I am able to run automated actions based on the output of reports, leaving me extra time to focus on more pressing matters."
"During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an application belongs to a known ransomware group. The system rates the threat, offering a clear detection ratio, such as 97 out of 100. It not only identifies threats but also illustrates the associated behaviors, helping us understand the potential risk to a particular endpoint."
 

Cons

"They don't provide user authentication and authorisation features (Shield) as a part of their open-source version."
"The solution could also use better dashboards. They need to be more graphical, more matrix-like."
"This type of monitoring is not very mature just yet. We need more real-time information in a way that's easier to manage."
"The Integration module could be improved. It is a pain to build integration with any product. We have to do parking and so on. It's not like other commercial solutions that use profile integration. I would also see more detection features on the SIEM side."
"With Elastic, you have to build the use cases for the specific requirement. Other products have a simple integration and more use cases to integrate out-of-the-box solutions for SIEM."
"Their visuals and graphs need to be better."
"Elastic Security has a steep learning curve, so it takes some time to tune it and set it up for your environment. There are some costs associated with logging things that don't have value. So you need to be cautious to only log things that make sense and keep them around for as long as you need. You shouldn't hold onto things just because you think you might need them."
"The solution could offer better reporting features."
"The reporting is the weakest aspect. There needs to be multi-level grouping for events (for example, group by user and destination). Right now, we can do a group by user and a separate table or group by destination. But I'd be more interested in where a person was logging into instead of who was logging in or where he was logging in."
"Customised alert recipients need to be added to allow better first-line action and quicker response. Configurable honeypots would be a welcome addition."
"Rapid7 InsightIDR is not intuitive to search for logs. It should be more user-friendly and improve the dashboards. We should be able to use ready-made templates instead of having to build one."
"The main problem lies in the processes within the client's operating systems."
"One thing that springs to mind is easier API integration with ITSMs. We are evaluating a new ITSM and I would like to have InsightIDR create a ticket when an attack is identified, and the ticket would be closed in InsightIDR when the ITSM resolution is completed. This would take out the "single point of failure" we currently have, if the email recipient is somehow absent, in recording the risk appetite for the incident and the actions taken to mitigate or not."
"The solution needs improvement in threat intelligence. Increasing the depth of intelligence to help users understand more about threats is a possibility. My suggestion is to expand access to other websites or resources."
"Currently, it lacks the functionalities provided by Rapid7's User Behavior Analytics (UBA)."
"Inability to get access to compliance reports within the solution."
 

Pricing and Cost Advice

"This is an open-source product, so there are no costs."
"It's a monthly cost with Elastic SIEM, but I am not sure of the exact cost."
"I can say that the product is cheaply priced."
"The base product is open-source but if you need advanced security features then you need to pay for the subscription. Elastic Security's price is reasonable in some cases and in other cases it's not."
"There is no charge for using the open-source version."
"The tool's pricing is flexible and comes at unit cost. You don't have to pay for everything."
"Its price is fine. Its licensing works on a yearly basis. We have to renew the license every year. I also have a good experience with Darktrace. When we buy Darktrace, we get training free of cost, which is not there in Elastic. We have to pay extra for training. There is certainly room for improvement."
"The product offers an amazing pricing structure. Price-wise, the product is very competitive."
"It is a reasonably priced solution."
"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."
"​Accurately predict your licensing counts as this is a subscription based product.​"
"The pricing of the solution depends on the user. But there is a yearly licensing cost."
"Rapid7 InsightIDR charges us based on the endpoints we connect to."
"It is on a yearly basis. For our own company, for about 250 users, it was 16,000 euros a year."
"The solution has a mid-range price point in the market"
"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."
report
Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.
831,158 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
16%
Government
10%
Financial Services Firm
9%
University
7%
Computer Software Company
16%
Financial Services Firm
8%
Manufacturing Company
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Datadog vs ELK: which one is good in terms of performance, cost and efficiency?
With Datadog, we have near-live visibility across our entire platform. We have seen APM metrics impacted several times lately using the dashboards we have created with Datadog; they are very good c...
What do you like most about Elastic Security?
Elastic provides the capability to index quickly due to the reverse indexes it offers. This data is crucial as it contains critical information. The reverse index allows fast data indexing because ...
What is your experience regarding pricing and costs for Elastic Security?
Elastic Security is considered cost-effective, especially at lower EPS levels. However, a direct comparison was not made due to different pricing structures.
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is asking to miss details that are critical, and ending up a statistic. Also, rememb...
What do you like most about Rapid7 InsightIDR?
During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, its origin, and potential threats. For instance, it can identify if an applicati...
 

Also Known As

Elastic SIEM, ELK Logstash
InsightIDR
 

Learn More

 

Overview

 

Sample Customers

Texas A&M, U.S. Air Force, NuScale Power, Martin's Point Health Care
Liberty Wines, Pioneer Telephone, Visier
Find out what your peers are saying about Elastic Security vs. Rapid7 InsightIDR and other solutions. Updated: January 2025.
831,158 professionals have used our research since 2012.