LogRhythm SIEM vs Rapid7 InsightIDR vs Sentinel comparison

Security Information and Event Management (SIEM)

Download the complete report

Helped 899,052 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of June 2026, in the Security Information and Event Management (SIEM) category, the mindshare of LogRhythm SIEM is 2.5%, down from 3.2% compared to the previous year. The mindshare of Rapid7 InsightIDR is 2.1%, down from 2.6% compared to the previous year. The mindshare of Sentinel is 2.7%, down from 3.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM) Mindshare Distribution
Product	Mindshare (%)
LogRhythm SIEM	2.5%
Sentinel	2.7%
Rapid7 InsightIDR	2.1%
Other	92.7%

Security Information and Event Management (SIEM)

Featured Reviews

SumitKumar20

Security Engineer at Granicus Inc.

Tool consistently aids in effective threat detection and monitoring but could benefit from improved log source management and resource optimization

One major area for improvement in LogRhythm SIEM is the lack of volume measurement capability in terms of storage. There is currently no way to determine how much data is being consumed in terms of gigabytes, terabytes, or petabytes from particular devices or environments. This information is crucial for planning future storage needs and scalability. The system monitor (collector) agent has issues with resource consumption. Even when not actively collecting data, the agent continues to consume significant CPU and memory resources, which can be particularly problematic for small business environments with limited resources. LogRhythm SIEM could improve by adding more default device support. While they have good default settings for devices such as Palo Alto firewalls, custom log sources often require extensive work. Increasing the number of supported devices with built-in policies and functionality would reduce the need for custom work. Competitive SIEM tools often provide more comprehensive coverage for various devices and vendors.

Read full review

SohailHyder

Head Of Cyber Security at Super Secure

Has supported compliance needs for mid-sized organizations but lacks customization and advanced integration

If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as a SIEM solution is. This is where it can improve if we keep in front the feature sets of a complete SIEM solution. Most common in the market is QRadar, but it is depleting now. It has been taken over by some other products such as Splunk and LogRhythm. If we compare these things with Rapid7 InsightIDR, then there are definitely some gaps that need to be filled. Data retention is also one concern because Rapid7 InsightIDR is cloud-based and operates on a subscription model. Whatever data you want to retain, it has to be paid for separately or it has a cost. Other solutions that are on-premises can have their own infrastructure or they provide some data retention for a month or in some capacity-wise, they provide that solution to them which makes them more attractive.

Read full review

Simon Johnston

Manager, Customer Success at Coltek Business Soltuions

Simple antivirus solution integrates well but could improve pricing and currency options

I don't really have experience working with these solutions. I promote them for our clients, but I don't work with them. I can't share my experience with these tools as I make assumptions about that. For both Adlumin and CrowdStrike, both confirm that they're scalable and enterprise-ready and all those kinds of things. We haven't had any specific problem with either of those. We just have a preference for which one we would prefer. If somebody says they want to use a different one from the one that we prefer, then we have to find reasons why they aren't. But scalability is not one of the reasons that one is better over the other. I don't really have advice for people that are looking into using Sentinel; just do your research across what is available. On a scale of one to ten, I rate Sentinel a seven.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It is stable; there are no bugs or glitches and it doesn't crash or freeze, so it's reliable and the performance is good."

"The most valuable feature I get out of the LogRhythm platform is being able to take machine data and present it in a format that's easy to understand, easy to analyze, easy to pivot through to get answers to the questions that I had that I'm investigating, whether they're security related or operationally related."

"For the same price, we have been able to go from a SIEM that could only manage about 20 percent of our environment to a full 100 percent coverage of all the devices on our network."

"The ability to drill down and pivot from an event is one of the biggest advantage the product has compared to other things that I have seen in the market."

"From a performance standpoint, I have no problems recommending LogRhythm because it allows me to get in under the hood and tweak some things."

"It is very effective."

"The most valuable part of the solution is being to view all of the logs whenever you want."

"The user interface is good."

More LogRhythm SIEM pros

"The log aggregation and storage provided by InsightIDR has shown no issues with scalability; aggregating over one hundred millions events daily."

"The platform offers unlimited storage and agent-based solutions."

"The incident case management is the most valuable feature. Even though there's always something I find I would like to add to that feature, the ability to quickly sort through all the logs, network and endpoint data, etc., and add it to an incident case as part of the investigation, is nice. Having it automatically timeline that additional data into the original incident timeline, and correlate it to other notable events and activities on the network, results in a huge improvement in our overall confidence that we've quickly traced down the right source of an issue."

"If you were on other solutions, you would notice that they use agents from third-party, from open-source, from a native OS, or from other tools. Here, however, it is an agent from Rapid7 itself. This adds to the solution's overall capabilities."

"I like the tool's user analysis feature."

"The solution is very cost-effective because they are not charging based on the EPS but on the number of assets."

"The alerting to drive investigations and remediation has been its most valuable feature, plus the ability to quickly search multiple logs makes investigations easier."

"The most valuable features have to do with ease-of-use, as it is easy to check the events, investigate suspicious activities, and do forensic analysis, and the web interface is great — very useful and user-friendly."

More Rapid7 InsightIDR pros

"We can do advanced hunting queries and modify SQL queries to get desired results based on the rules triggering over the console."

"The solution lets us get all the logs properly and regularly monitor customer infrastructure."

"It makes everything easier by automating some tasks and growing with our needs."

"The stability is phenomenal and we never had any issues with downtime or even had to restart."

"The tool is simple to use."

"The most valuable feature of this solution is that it provides a central locking system for many event sources."

"The solution's Kusto Query Language (KQL) execution time is pretty good."

"Transactional user information improves security, prevents fraud, and promotes best practices."

More Sentinel pros

Cons

"The biggest thing I want is, right now you have thick console and the web console. Most of the reporting has to be done in the thick console. I'd love more reporting in the web console."

"Right now you have to apply what they call RIM policies, Registry Integrity Monitoring policies, one agent at a time. If you have thousands of endpoint agents, you have to touch each one of those one at a time."

"We have run into problems with stability going through upgrade processes. Recently, we have been on the front edge of the upgrade path. When that happens we tend to run into issues either with certain functionality not working after the upgrades or stability issues because of the upgrades."

"Their ticketing system for managing cases can be improved. The current system works and gets the job done, but it is very bare-bones and basic."

"Out of 10, I would give it an eight. We upgraded our firewall and that broke our parsing rules and it took a while to get that all fixed, but other than that it's been great."

"The biggest thing that I think needs improvement is reporting in the Web Console."

"The initial setup is complex and I rate it a six out of ten."

"I would like to see our vulnerabilities counter. We will be using Tenable to fill that void right now."

More LogRhythm SIEM cons

"The APIs can be further improved in Rapid7."

"Rapid7 InsightIDR is not intuitive to search for logs. It should be more user-friendly and improve the dashboards. We should be able to use ready-made templates instead of having to build one."

"The integration capabilities of the solution have certain shortcomings where improvements are required."

"The searching feature in Rapid7 InsightIDR needs to evolve"

"I would like to see more development in InsightIDR towards building their SIEM solution and converting it to XDR."

"The interface for doing investigation needs to be enhanced with minor improvements that would make it more useful."

"Rapid7's customer support is awful. They didn't respond at all."

"One of the things that could be better is digital forensics. It is there, but it can be better. They could provide more on the endpoint detection level."

More Rapid7 InsightIDR cons

"There is a need for more flexibility in customization, especially when working with different vendors and platforms."

"The web interface needs to be improved, as it has a java-based way to call its controls."

"Some functions look great but, in practice, some key limitations turn the process into something opaque."

"The solution does not allow outsourced authorizations."

"I rate Sentinel a six out of ten for scalability."

"It is an ancient product."

"Price is always a consideration, so the price would be nice if it were lower."

"Creating a drag-and-drop dashboard or workbook in Sentinel is a little more complex compared to other tools like LogRhythm and IBM QRadar."

More Sentinel cons

Pricing and Cost Advice

"On a scale of one to ten, I'd rate the pricing of this solution as a seven - not too expensive but not cheap either. Regarding licensing costs, it varies depending on factors like being a partner or an end user, but there are no additional costs aside from standard licensing fees for the basic SIEM solution."

"In comparison to the competition, they are more affordable. This allows us to do more with less."

"I would rate the tool's pricing around eight out of ten."

"The product is inexpensive than other tools."

"On a scale of one to ten, where one is low, and ten is high, I rate the pricing between six and seven."

"The license cost is around $10 per MPS."

"In the context of our country, the price of this solution is too high."

"NextGen SIEM's pricing is moderate."

More LogRhythm SIEM pricing and cost advice

"The team is very willing to work with companies. My suggestion is to call the Rapid7 sales department and see how they can help."

"Licensing is by endpoint and amount of retention time (at least ours is). Default retention was one year, but we are able to push the retention further if needed. There's also a provide-your-own-S3 option for longer retention if you don't want to pay for the additional retention years in your Rapid7 agreement."

"I rate Rapid7 InsightIDR's price a four on a scale of one to ten, where one is cheap, and ten is expensive."

"Rapid7 InsightIDR is a cheaply priced product. On a scale of one to ten, where one is very expensive, and ten is very cheap, I rate the product's price at seven or eight."

"Rapid7 InsightIDR is priced very well and is cost-effective."

"The pricing of the solution depends on the user. But there is a yearly licensing cost."

"It is a reasonably priced solution."

"Accurately predict your licensing counts as this is a subscription based product."

More Rapid7 InsightIDR pricing and cost advice

"Sentinel is a subscription-based solution."

"We inquired about getting support from the vendor, Micro Focus, but the cost was very high."

"The solution’s pricing is aligned with its competitors."

"Sentinel's slightly on the expensive side."

"We receive a pricing discount because of our ongoing partnership with Micro Focus."

"Sentinel is moderately priced."

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

899,052 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Construction Company

12%

Financial Services Firm

10%

Computer Software Company

Manufacturing Company

10%

Financial Services Firm

Computer Software Company

Comms Service Provider

Financial Services Firm

10%

Manufacturing Company

Computer Software Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	38
Midsize Enterprise	39
Large Enterprise	83

By reviewers
Company Size	Count
Small Business	21
Midsize Enterprise	5
Large Enterprise	6

By reviewers
Company Size	Count
Small Business	9
Midsize Enterprise	3
Large Enterprise	7

Questions from the Community

What is the difference between log management and SIEM?

Rony, Daniel's answer is right on the money. There are many solutions for each in the market, a lot depends upon you...

What needs improvement with LogRhythm NextGen SIEM?

LogRhythm SIEM could learn from Wazuh, as Wazuh has a built-in mechanism that allows you to write custom scripting an...

What is your experience regarding pricing and costs for LogRhythm SIEM?

I find LogRhythm SIEM affordable, as it is a bit less costly than QRadar, although I have not been involved in negoti...

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...

What is your experience regarding pricing and costs for Rapid7 InsightIDR?

The product pricing is very cheap.

What needs improvement with Rapid7 InsightIDR?

If we pitch Rapid7 InsightIDR against solutions such as SIEMs from Splunk or LogRhythm, it is not as customizable as ...

What is your experience regarding pricing and costs for NetIQ Sentinel?

I don't have too many comments overall about pricing as we're in South Africa, so it makes more sense if it's billed ...

What needs improvement with NetIQ Sentinel?

I'm not sure what the room for improvement is for Sentinel. It needs to stay current, and it does, so I suppose that'...

What is your primary use case for NetIQ Sentinel?

It's our go-to choice for antivirus. I use Sentinel a lot.

IBM Security QRadar vs LogRhythm SIEM

Comparisons

Compared 7% of the time

Splunk Enterprise Security vs LogRhythm SIEM

Compared 6% of the time

Devo vs LogRhythm SIEM

Compared 4% of the time

USM Anywhere vs LogRhythm SIEM

Compared 4% of the time

More LogRhythm SIEM Competitors

Microsoft Sentinel vs Rapid7 InsightIDR

Compared 4% of the time

Splunk Enterprise Security vs Rapid7 InsightIDR

Compared 4% of the time

Adlumin Security Operations vs Rapid7 InsightIDR

Compared 3% of the time

Vectra AI vs Rapid7 InsightIDR

Compared 3% of the time

Netsurion vs Rapid7 InsightIDR

Compared 2% of the time

More Rapid7 InsightIDR Competitors

Splunk Enterprise Security vs Sentinel

Compared 23% of the time

IBM Security QRadar vs Sentinel

Compared 9% of the time

Wazuh vs Sentinel

Compared 5% of the time

Stellar Cyber Open XDR vs Sentinel

Compared 4% of the time

Elastic Security vs Sentinel

Compared 3% of the time

More Sentinel Competitors

Product Reports

LogRhythm SIEM

Download LogRhythm SIEM product report

Rapid7 InsightIDR

Download Rapid7 InsightIDR product report

Sentinel

Download Sentinel product report

Also Known As

LogRhythm NextGen SIEM, LogRhythm, LogRhythm Threat Lifecycle Management, LogRhythm TLM

InsightIDR

NetIQ Sentinel, Novell SIEM

Overview

LogRhythm SIEM offers advanced threat intelligence, scalable deployment, and streamlined log management. It enhances security posture with AI-driven threat detection and comprehensive monitoring.

LogRhythm SIEM stands out for its AI-driven threat correlation, ease of log aggregation, and robust reporting. Offering real-time visibility and analytics through consistent navigation and dashboards, it integrates with security components for enhanced monitoring and response. Advanced threat intelligence and customizable alerts streamline processes and bolster security. While it faces challenges with log parsing, reporting, and dashboard intuitiveness, plans to enhance cloud integration and transition to Linux are noted.

What are the standout features?

AI Threat Correlation: Employs AI to correlate threats for efficient detection.
Log Aggregation: Simplifies the collection of logs from multiple sources.
Scalable Deployment: Offers flexible scaling to accommodate growth.
Robust Reporting: Provides detailed analysis for informed decisions.
Advanced Threat Intelligence: Engages cutting-edge techniques to assess threats.

What benefits and ROI can users expect?

Improved Security Posture: Enhanced threat detection and response.
Streamlined Processes: Automation leads to efficiency gains.
Comprehensive Compliance: Facilitates adherence to regulatory standards.
Centralized Log Management: Unified log overview aids in quick insights.

In industries like banking and finance, organizations utilize LogRhythm SIEM for centralized log management, security monitoring, and compliance. It helps detect insider threats, analyze server logs, correlate events, and monitor user behaviors. Appreciated for log ingestion and anomaly identification, it ensures robust cybersecurity and incident response by integrating data from multiple sources.

Exabeam

Rapid7 InsightIDR is a cloud-based security information and event management solution known for its user behavior analytics, offering rapid detection and response capabilities while facilitating seamless integration across systems.

Rapid7 InsightIDR is designed to enhance threat detection and investigation through its efficient user behavior analytics and advanced threat intelligence framework. The platform's cloud-based deployment ensures rapid setup and comprehensive event monitoring across diverse IT environments, including endpoints and Office 365. Its intuitive interface supports seamless data collection, honing in on threat detection through honeypot utilization and intelligent alerting. However, it is noted for lacking some customization features and better integration, especially with Microsoft and ITSMs.

What are the key features of Rapid7 InsightIDR?

User Behavior Analytics: Detects threats by analyzing patterns and anomalies.
Cloud Deployment: Enables quick setup and scalability.
Comprehensive Monitoring: Monitors events across systems and platforms like Office 365.
Honeypots and Alerting: Utilizes honeypots to reduce false positives and alert fatigue.
Threat Intelligence Framework: Supports effective threat hunting and remediation.

What benefits should users consider in reviews when evaluating Rapid7 InsightIDR?

Enhanced Detection: Improves threat detection with user behavior analysis.
Easy Integration: Integrates across systems for a streamlined security approach.
Rapid Response: Facilitates quick action against identified threats.
Operational Efficiency: Offers a cohesive view of security operations.

Rapid7 InsightIDR is prominently used in security operation centers to manage events, detect threats, and respond effectively. Industries apply it for network behavior monitoring, compliance, and vulnerability management. Companies integrate it with security tools to boost threat investigation, ensuring full SIEM functionalities and robust log management capacities. Its application spans behavioral and intrusion analytics, aiding in monitoring and addressing malicious activities.

Rapid7

Sentinel is a robust platform offering seamless native integration, enhanced security through transactional data, and a user-friendly interface reminiscent of Microsoft Windows. Its capabilities in threat detection, monitoring, and business intelligence integration make it an attractive choice for organizations.

Sentinel simplifies security management with its advanced features, including the Kusto Query Language and automation abilities that reduce the complexity of coding tasks. The platform's correlation engine allows for efficient rule generation, while its threat visibility and intelligence features offer preparation against risks. Advanced hunting queries, anomaly dashboards, and scalability options enhance its utility. Users appreciate its seamless connections with Microsoft tools and ability to improve threat detection through cloud and business intelligence integration. However, enhancements could improve documentation on security aspects, simplify dashboards, and optimize drag-and-drop features. There are suggestions for better device integration, a shift to web interfaces, and improved customization options, although some users face challenges with Unix scripting.

What are the most important features of Sentinel?

Native Integration: Offers seamless connections with Microsoft tools.
Enhanced Security: Utilizes transactional data for better protection.
User-Friendly Interface: Features a GUI similar to Microsoft Windows.
Automation Capabilities: Simplifies coding tasks with Kusto Query Language.
Advanced Threat Visibility: Strengthens risk preparation with intelligence features.

What benefits or ROI should users consider in reviews?

Improved Security Monitoring: Provides proactive threat detection.
Increased Efficiency: Offers automation, reducing manual efforts.
Scalability: Supports growth with adaptable features.
Integration Benefits: Ensures seamless connection with existing systems.

Sentinel finds application across sectors for logging, security event monitoring, and integration with tools like Microsoft Defender for Endpoint. Users from industries such as government and academic institutions leverage its advanced SQL query support for customized responses, enhancing security measures with AI capabilities in diverse environments.

OpenText

Sample Customers

Macy's, NASA, Fujitsu, US Air Force, EY, Abbott, HD Supply, SAB Miller, UCLA, Raytheon, Amtrak, Cargill

Liberty Wines, Pioneer Telephone, Visier

Faysal Bank, GaVI, Handelsbanken, ISC Mªnster, Lambeth Council, Swisscard, The Municipality of Siena, Tukes, University of Dayton, University of the Sunshine Coast

Security Information and Event Management (SIEM)