Rapid7 InsightOps Reviews

The usual use cases for Rapid7 InsightOps that I work with are to meet standard requirements such as PCI DSS and ISO standards, collecting data and protecting event logs.

Rapid7 InsightOps plays a significant role in maintaining regulatory compliance for my customers, as it meets mandatory requirements for collecting and managing logs in standards like PCI DSS, especially for financial sectors.

The features of Rapid7 InsightOps that I have found most valuable are the predefined policies and the use of correlation rules, which are very valuable because they eliminate the need to spend time creating those rules.

This feature detects insider threats or compromised credentials by using user behavior analytics, which can collect other compromise indicators. It makes it easier to install and implement this solution because you can run it as normal behavior of users and then switch off to look for the anomalous behavior of any entities, such as laptops and others. In any violation or restricted behavior, the system will notify you that something unusual is occurring.

The machine learning algorithms in Rapid7 InsightIDR for threat detection work quite effectively as part of the user entity behavior analytic model, allowing us to focus group normal typical behavior of users and then turn on the rule to spot any unexpected behavior.

The automation features of Rapid7 InsightOps are quite satisfactory, as users appreciate these features, especially when integrating with the ticketing system. If something goes wrong, InsightOps will notify the ticketing system to create a ticket and assign it to the responsible person to handle the events found in the infrastructure.

The customizable dashboards in Rapid7 InsightOps are quite valuable and interesting because SOC center operators spend most of their time investigating on those dashboards, making them easy to manage. Additionally, we can configure email reports for high-level talks, sending historical data without needing to look online, which is very convenient.

We use Rapid7 InsightOps to look at the logs from customers who report some unexpected behavior in applications. We look at the logs to see what has happened. Sometimes the customers complain that the data is different from what they had submitted, we look at the logs to see what data the user submitted and what data we have stored in our database.

The most valuable feature of Rapid7 InsightOps is the search functionality.

Rapid7 InsightOps is a security information and event management platform that collects and analyses logs from servers, user systems, and network and infrastructure devices. The data is stored in a centralized data for future analysis.

Rapid7 has a collection of logs. You can easily identify the attack. The solution’s investigation and reporting educate us and help us to respond to incidents.

We receive messages from our clients, and we send messages too. So our application generates a lot of logs. We push all these messages to Rapid7. If a client does not receive a message from us, we go to Rapid7 and query with that timestamp and message.

We can save logs as plain text. If we have a column in a text, it automatically creates a key-value pair. It is very useful. Whatever we need to do is present in the solution.

Our clients use InsightOps for real-time monitoring of their IT environments.

Integration of InsightOps with other tools, especially SIEM solutions, has generally improved operational efficiency.

I use it primarily to send alerts, or detect suspicious logins, and be proactive in the detection of compromised accounts.

All of them. I use it as a security incident and event management system. It has the ability to alert and track logs from different sources.

• The log aggregation and research capabilities are definitely what pays for itself. 
• The ability to browse logs from multiple sources at the same time really speeds up root cause analysis, which involves more than one source and this is almost always the case. 
• Visual mode search and live monitoring are just icing on the cake.

Imagine having to recreate the timeline of an event across three servers, with multiple logs each, and some logs dated using UTC and some using our actual time zone. You either have to build complex scripts using grep, sed, and awk to standardize the data before you can start your analysis or you risk getting lost. InsightOps does it all automatically so you can get to work right away. Less time lost and less risk of taking the wrong path.

We have a lot of mobile users who are not always on our network, and this gave us the ability to have full visibility into them. We're able to do real time requests and questions with the agent. So I can basically search all my agents and see if there's a malicious registry key in any of the registries. I can see a process that might be running, that should be running or shouldn't be running, I can do a real time query across the entire board.

You can use this to also see if systems are up or down, from an infrastructure level as well. So it has more than just monitoring things for malicious activity. It can also see if things are working properly as well.

The most important feature is the ability to have the end point agent on all of our systems. And since they talk back to their cloud infrastructure, it doesn't matter if the systems are on our network or not on our network. We still get real time feedback, not only on the InsightOps part, but also our InsightIDR and others as well. It's only one agent, and they all pull back data that's relevant to our network.

It also gives us a lot of almost "forensic" capabilities, because the agent itself monitors the entire system, from the registry all the way down to the file level. If there's anything malicious, or network connections, anything of that nature that's going on, you can do searches on them and it's beaconing back in real time.