Cortex XDR by Palo Alto Networks vs Rapid7 InsightIDR comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Microsoft Defender XDR
Sponsored
Ranking in Extended Detection and Response (XDR)
5th
Average Rating
8.4
Number of Reviews
87
Ranking in other categories
Endpoint Detection and Response (EDR) (7th), Microsoft Security Suite (1st)
Cortex XDR by Palo Alto Net...
Ranking in Extended Detection and Response (XDR)
4th
Average Rating
8.4
Number of Reviews
80
Ranking in other categories
Endpoint Protection Platform (EPP) (4th), Ransomware Protection (2nd)
Rapid7 InsightIDR
Ranking in Extended Detection and Response (XDR)
12th
Average Rating
8.4
Number of Reviews
31
Ranking in other categories
Security Information and Event Management (SIEM) (9th), User Entity Behavior Analytics (UEBA) (3rd), Endpoint Detection and Response (EDR) (21st), Threat Deception Platforms (5th)
 

Mindshare comparison

As of June 2024, in the Extended Detection and Response (XDR) category, the mindshare of Microsoft Defender XDR is 23.3%, up from 6.7% compared to the previous year. The mindshare of Cortex XDR by Palo Alto Networks is 7.5%, down from 14.3% compared to the previous year. The mindshare of Rapid7 InsightIDR is 1.8%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Extended Detection and Response (XDR)
Unique Categories:
Endpoint Detection and Response (EDR)
8.4%
Microsoft Security Suite
4.9%
Endpoint Protection Platform (EPP)
4.9%
Ransomware Protection
15.6%
Security Information and Event Management (SIEM)
4.0%
User Entity Behavior Analytics (UEBA)
13.1%
 

Featured Reviews

Benjamin Van Der Westhuyzen - PeerSpot reviewer
Jul 28, 2023
Provides us with better insight into what's going on across our platform
In the beginning, it's difficult to navigate the system because it is quite large. Just trying to find your way and understand how the system works can be hard. After spending quite a lot of time searching it's a lot easier, but I wish it were a bit more user-friendly when you're trying to find things. The information it provides is great, but for a newcomer, it is quite tedious and takes a long time to load. Here in South Africa, when you click, oftentimes you have to wait quite some time before you get to the next page. It's not necessarily internet-related. I think it's just that the service is a bit slow. Also, while the solution does help to prioritize threats, unfortunately, it doesn't do so for the entire environment. The reason is that it only supports full integration from Windows 10 and up. It provides you certain information from your server environment, but when you start going with legacy services, it is a bit lacking. Another issue that is sometimes a headache is that they constantly make changes. Things will be merged, they will get different names, or be moved around. Things will be added and other things go somewhere else. They do a lot of development to make the product better, but it's very frustrating having to search for stuff after they've moved it, because you don't always know that they have moved things. They might have little banners, but if you're just working and don't read them, you don't know where things have gone. I would also really like to see better integration with the server platforms for managing your server environment. That's something it currently doesn't do. For all the server environments, you either need to make use of group policies or SCCM to manage that independently. It can provide you information on the system, but it doesn't have control over your server line. Also, I make use of 365 Defender on a business level and on a personal level. On the personal level, there is a lot less functionality. Something that would be very nice is that, for the level you are on, you would only see the product you are subscribed to. For instance, if you log on via the business, you have all your action areas, anything you can do and see, on the left. Because you're using it at a corporate level, you can see and do everything. On the personal level, or in a small business where you're only using some of the features, you still have all the same options, but when you click on them, it tells you that you need to upgrade or subscribe. They should only show you what you have access to, and not all the tabs and then say, "You need to subscribe to get access to this." It just clutters the whole area.
MP
Mar 21, 2024
A stable XDR solution with file detection
The licensing model is complex to understand. It requires expertise to explain how the licensing works. You need expertise to guide you through the subscription plan. Everything is fine. However, if there are any security suggestions, they should be addressed promptly. For instance, configuring the tool and setting up email configurations are essential. Additionally, web filtering is crucial; if there are any high-risk URLs or logs, they should be filtered. Palo Alto Networks already has a robust database for this purpose, which they utilize in their perimeter-level devices by leveraging this database and integrating it into Cortex XDR, enhancing the security posture. Automatic security suggestions are also provided for individual devices, further enhancing security. Adding URLs and addressing the mentioned points are essential steps. They're aggregating all the logs from various devices.
Agustinus DWIJOKO - PeerSpot reviewer
Nov 7, 2023
A tool to detect malicious activities and provide security to networks and endpoints
Rapid7 InsightIDR helps me detect any malicious activities in any endpoints in my company I have seen that Rapid7 InsightIDR provides security to the networks and endpoints in the company. With Rapid7 InsightIDR, you must install the Insight Agent, after which you may get to see some of the…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It provides a single pane of glass within the 365 admin interface, streamlining our experience by consolidating information in one place and eliminating the need to navigate through multiple interfaces."
"Within advanced threat hunting, the tables that have already been defined by Microsoft are helpful. In the advanced threat hunting tab, there were different tables, and one of the tables was related to device info, device alert, and device events. That was very helpful. Another feature that I liked but didn't have access to was deep analysis."
"The Endpoint Manager is incredible; it has a very straightforward interface and is exceedingly easy to use. Pulling out and deploying different tags or resources is a simple task across various departments with different levels of security. The notifications are also simple and satisfying; it's great to see the bubble informing us which devices are compliant and which are waiting to update."
"The most valuable aspect is undoubtedly the exploration capability"
"The solution is well integrated with applications. It is easy to maintain and administer."
"The most valuable feature is the DLP because that's where we can have an added data protection layer and extend it not just to emails but to the documents that users are working on. We can make sure that sensitive data is tagged and flagged if unauthorized parties are using it."
"In our company,we have faced multiple attacks over the last few months, but none of them have been successful, and I think Microsoft Defender XDR has played a major role in it."
"We can automate routine tasks and write scripts to carry out difficult tasks, which makes things easier for us."
"The most valuable feature of Cortex XDR by Palo Alto Networks is its machine-learning capabilities. Additionally, there is full integration with other solutions."
"The management capabilities, allow an IT organization to get quite a good picture of attempted cyber attacks."
"This software helps us understand any issues that may arise when someone is not at work."
"The initial setup isn't too bad."
"It can automatically correlate events and logs, which is very helpful for an IT administrator. It can correlate different kinds of malware activities over a network, agent, or host system. You do not need to do it manually. It is a good feature. It is also a user-friendly solution. We have deployed it on the cloud because our space does not provide any flexibility for on-premises deployment, but Palo Alto has added some flexibility to install it on-premises. It must be like the same Cortex XDR agent for all the VPN services, web filtering services, and everything else."
"Best solution for avoiding security breaches, malware attacks, and other kinds of security issues."
"The one feature of Palo Alto Networks Traps that our organization finds most valuable is the App ID service."
"I've found the solution to be highly scalable for enterprises."
"The product works well. Stability-wise, I rate the solution a ten out of ten."
"The solution is very stable and works very well for what I need it to do."
"Great coverage of all systems within our network from endpoint to firewall."
"Scalability-wise, I rate the solution a ten out of ten. As a cloud tool, the product is highly scalable."
"The UI is very good."
"I like the tool's user analysis feature."
"It improved my organization by building a security alerting program."
"The incident case management is the most valuable feature. Even though there's always something I find I would like to add to that feature, the ability to quickly sort through all the logs, network and endpoint data, etc., and add it to an incident case as part of the investigation, is nice. Having it automatically timeline that additional data into the original incident timeline, and correlate it to other notable events and activities on the network, results in a huge improvement in our overall confidence that we've quickly traced down the right source of an issue."
 

Cons

"The only issue I've had is, when it comes to deployment, the steps I must take around policy setup. That is challenging."
"Advanced attacks could use an improvement."
"For some scenarios, it provides good visibility into threats, and for some scenarios, it doesn't. For example, sometimes the URLs within the emails have destinations, and you do get a screenshot and all further details, but it's not always the case. It would be good if they did a better job of enabling that for all the emails that they identified as malicious. When you get an email threat, you can go into the email and see more details, but the URL destination feature doesn't always show you a screenshot of the URL in that email. It also doesn't always give you the characteristics relating to that URL. It would be quite good if the information is complete where it says that we identified this URL, and this is what it looks like. There should be some threat intel about it. It should give you more details."
"Customers say they want absolutely seamless integration between other Microsoft solutions and Defender XDR, including the ability to change device settings within the Defender portal. They need to contact the IT team responsible for the device management tools to change some settings. They would prefer that those changes be initiated directly from the Defender portal or applied from Intune without involving the IT operations team."
"It would be helpful if the solution could scan faster when it comes to scanning attachments to emails."
"What could be improved in Microsoft 365 Defender is its licensing, e.g. it should be more consolidated and would be good if it has some optimizations. Improving the alerts and notifications, in terms of adding more details, would also be good for this solution."
"The solution does not offer a unified response and standard data."
"There is no common area where we can manage all the policies for the EDR, third-party solutions, devices, servers, Windows, Mac, etc., but it's on the road map, and we ware waiting for that feature."
"We had a problem with getting our older endpoints up to date, but their newest updates have been really good. I've been pleased with it in terms of what our needs are. It's doing what we want it to do."
"They've been having some issues with updating their endpoint agents, and it has been quite frustrating."
"Cortex XDR by Palo Alto Networks could improve by offering remote management. It would be useful to look at the client's issue to fix it."
"The licensing model is complex to understand. It requires expertise to explain how the licensing works. You need expertise to guide you through the subscription plan."
"The solution should force customers to integrate with network traffic to see the full benefits of XDR."
"Technology evolves every day, so it would be nice if it gets more secure. It can also have more integration with other platforms."
"In an upcoming release, the solution could improve by proving hard disk encryption. If it could support this it would be a complete solution."
"It is a complex solution to implement."
"I would like the ability to adjust the threshold of certain existing alerts. Currently the only option is to change the notifications or create my own alert."
"The APIs can be further improved in Rapid7."
"The reporting is the weakest aspect. There needs to be multi-level grouping for events (for example, group by user and destination). Right now, we can do a group by user and a separate table or group by destination. But I'd be more interested in where a person was logging into instead of who was logging in or where he was logging in."
"The searching feature in Rapid7 InsightIDR needs to evolve"
"The interface for doing investigation needs to be enhanced with minor improvements that would make it more useful."
"Currently, it lacks the functionalities provided by Rapid7's User Behavior Analytics (UBA)."
"Rapid7 doesn't integrate well with all our security tools from various vendors, so we plan to switch. Many of our solutions work with Rapid7, but some do not. We are already searching for a replacement already."
"Tenable Nessus is easier to deal with. It's more efficient and accurate. InsightIDR is heavier than Tenable in terms of performance and scanning. Rapid7 would be much easier to use if it had a network connector like Tenable. Tenable's connector allows continuous monitoring over the B caps."
 

Pricing and Cost Advice

"The solution is too expensive."
"Microsoft purposely makes its license combinations complex and includes combinations like Microsoft 365 E3 and Microsoft 365 E5, Office 365 E3, Office 365 E5, and Office 365 E1, so you get confused. Microsoft tries to sell you a bundle of a lot of things together."
"The price of the solution is high compared to others and we have lost some customers because of it."
"We have a lot of problems in Latin America regarding the price of Microsoft 365 Defender, because the relationship between dollars and the money of the different countries, it's is a lot. Many customers that have small businesses say that they would like the solution but it is too expensive. However, large companies do not find the cost an issue."
"Defender plan 1 is tenant-wise, and Defender plan 2 is per-user, which makes it more expensive. To have certain features, you would need to purchase the E5 license. For all of the capabilities that the tool provides, the price, though it can be high, is fair."
"They have moved from a licensing model to pay-per-use... The question is: What happens if, for any reason, there's not enough budget to accept this model? That could be a great problem."
"I believe that the pricing of the licensing is fair."
"All I can say again is the E5 gives you all the capabilities that it offers. It also gives Office 365 and one terabyte of storage. All in all, the E5 license model makes sense. There are some people who say it's quite costly, but rather than paying different vendors, it makes sense to go all in with Microsoft if you've got that licensing. From that perspective, it's cost-effective, but I can't comment much on that."
"It has a yearly renewal."
"When we first bought it, it was a bit expensive, but it was worth it. The licensing was straightforward."
"I don't recall what the cost was, but it wasn't really that expensive."
"It has a higher cost than other solutions, like CrowdStrike or Microsoft’s EDR tools, but it reduces the cost of our operations because it’s a new generation antivirus tool."
"Our license will require renewal in August, after which the maintenance will continue as usual."
"It is "expensive" and flexible."
"Cortex XDR's pricing is ok."
"The price is on the higher side, but it's okay."
"Rapid7 InsightIDR's pricing is reasonable but we have challenges with the Minimum Order Quantity. It is not reasonable for customers who have less than one hundred devices. If they can reduce Minimum Order Quantity, it is good. You have to pay around 5000-6000 dollars per year for the product. The pricing includes maintenance and support costs."
"It is more reasonably priced than other vendors."
"Rapid7 InsightIDR is priced very well and is cost-effective."
"It is a reasonably priced solution."
"Rapid7 InsightIDR is a cheaply priced product. On a scale of one to ten, where one is very expensive, and ten is very cheap, I rate the product's price at seven or eight."
"It is on a yearly basis. For our own company, for about 250 users, it was 16,000 euros a year."
"I rate Rapid7 InsightIDR's price a four on a scale of one to ten, where one is cheap, and ten is expensive."
"​I am sure that there are cheaper products out there, but none that meet so many of our needs whilst maintaining stability and usability.​"
report
Use our free recommendation engine to learn which Extended Detection and Response (XDR) solutions are best for your needs.
789,135 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
10%
Government
8%
Manufacturing Company
8%
Computer Software Company
15%
Government
8%
Financial Services Firm
8%
Manufacturing Company
6%
Computer Software Company
16%
Manufacturing Company
8%
Financial Services Firm
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about Microsoft 365 Defender?
Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and p...
What is your experience regarding pricing and costs for Microsoft 365 Defender?
Microsoft Defender XDR is expensive, especially for the full suite functionality. However, when compared to buying mu...
What needs improvement with Microsoft 365 Defender?
Improving scalability, especially for very large tenants, could be beneficial for Microsoft Defender XDR. Additionall...
Cortex XDR by Palo Alto vs. Sentinel One
Cortex XDR by Palo Alto vs. SentinelOne SentinelOne offers very detailed specifics with regard to risks or attacks. ...
Comparing CrowdStrike Falcon to Cortex XDR (Palo Alto)
Cortex XDR by Palo Alto vs. CrowdStrike Falcon Both Cortex XDR and Crowd Strike Falcon offer cloud-based solutions th...
How is Cortex XDR compared with Microsoft Defender?
Microsoft Defender for Endpoint is a cloud-delivered endpoint security solution. The tool reduces the attack surface,...
What SOC product do you recommend?
For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...
What do you like most about Rapid7 InsightIDR?
During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, ...
What is your experience regarding pricing and costs for Rapid7 InsightIDR?
We chose Rapid7 because of its price. IBM QRadar charges us based on data storage. Rapid7 InsightIDR charges us based...
 

Also Known As

Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender
Cyvera, Cortex XDR, Palo Alto Networks Traps
InsightIDR
 

Overview

 

Sample Customers

Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.
CBI Health Group, University Honda, VakifBank
Liberty Wines, Pioneer Telephone, Visier
Find out what your peers are saying about Cortex XDR by Palo Alto Networks vs. Rapid7 InsightIDR and other solutions. Updated: May 2024.
789,135 professionals have used our research since 2012.