Rapid7 MDR Reviews

Rapid7 MDR serves as our endpoint security solution. When we receive an alert from Rapid7 MDR, we check the logs of the endpoints that are managed on the client side, which provides us with richer information for the tickets. The enrichment that Rapid7 MDR generates for the client is greater than with other tools, and this has had a big impact.

Everything works very well with Rapid7 MDR. One day we had an incident related to an attack where Rapid7 MDR detected social engineering in a Teams chat, for which we received a notification by email. By correlating the events in Rapid7 MDR, we identified that it was a call from an unauthorized tenant within the organization.

Being able to list the vulnerabilities of the machines, being able to correlate alerts with the respective users who managed them, and having the artificial intelligence for creating query searches in the logs is crucial. The artificial intelligence for creating queries in the logs with Rapid7 MDR has been a great help because normally we use another platform called CrowdStrike, and the queries there are very different. This ultimately helps us create queries faster and more efficiently.

Rapid7 MDR has had a big impact when handling tickets by enriching them with information for the client. The client has been very pleased when handling tickets with Rapid7 MDR, unlike with other platforms, and this has had a positive impact.

It has helped with the ease and speed of detections and event correlations. Rapid7 MDR is very transparent. Investigations and detections are always identified normally, and they enrich the tickets.

I do not feel there is any improvement needed at the moment; all the features, the tools within it, and their functions are satisfactory. Because it is very good, there are always areas to improve, though I cannot point out specific ones at this moment.

I have been using Rapid7 MDR for almost a year.

I have not experienced any stability issues.

We used CrowdStrike previously. We still use CrowdStrike, and we have not moved 100% to Rapid7 MDR; we have a 50/50 split with both tools.

The setup was very good. You just install a sensor for Rapid7 MDR and that is it.

I have not used the implementation team.

I recommend reading the documentation, requesting a demo, and comparing Rapid7 MDR with other tools to see which is best for your organization.

The typical use case for Rapid7 MDR is that it is highly valued. It is not so bad, but competition with EDR is tough. Rapid7 MDR does not position itself as EDR or XDR, so it is rather a SIEM type solution, which makes it different from CrowdStrike, SentinelOne, or Microsoft. They are not in the competition listing of EDR products.

The features of Rapid7 MDR that I find most effective for threat detection are the threat intelligence capabilities because it already collects many vulnerabilities and exploitations, as well as the configuration of network devices. They integrate everything into one solution. The other solutions such as CrowdStrike or SentinelOne don't collect all the vulnerabilities or threat intelligence except within their product itself, making Rapid7 MDR very strong in this aspect.

I have seen an ROI from this solution in terms of time savings. Because it includes everything, including SIEM, EDR, and vulnerability control, other solutions require integration of every module and vendor. It is easier to implement once they start, as the modules of the EDR can be challenging to implement and may require consulting.

There are areas of Rapid7 MDR that have room for improvement. The market is now changing very quickly towards artificial intelligence, and all the SIEM, EDR, and XDR vendors are moving to apply artificial intelligence in their solutions. Rapid7 MDR is currently weak in AI solutions and intelligence, which is concerning. It is also somewhat delayed compared to many vendors such as CrowdStrike, SentinelOne, or Microsoft, who are heading in such directions.

I have worked with Rapid7 MDR for approximately three years.

I would rate the stability of Rapid7 MDR rather high, approximately six or eight out of ten.

I would rate the scalability of Rapid7 MDR very high on a scale of one to 10, approximately eight.

The technical support from Rapid7 MDR is adequate, rating approximately six out of ten. The lower tier support is not very good. Additionally, Japanese customers require Japanese representatives as the support is primarily in English.

Neutral

The initial setup of Rapid7 MDR is relatively easy because it integrates everything. However, the complete setup process is challenging due to the numerous modules involved. This includes cloud deployment, on-premises implementation of network devices, data collection, and agent installation. Implementation is manageable for existing Rapid7 customers, but it can be very challenging for new customers.

I have knowledge of CrowdStrike solutions as a competitor, though not direct experience.

I would recommend Rapid7 MDR to others, but this market is changing quickly due to artificial intelligence. I cannot say it is the best solution for customers as the market is evolving, with new solutions emerging and existing vendors improving their offerings in the near future.

Overall, I would rate Rapid7 MDR a seven out of ten. Once customers can implement it, it becomes a good solution for them, though implementation remains a significant consideration.

Rapid7 MDR is our managed service that serves as our SOC and represents our starting point in utilizing a solution for cybersecurity. Rapid7 MDR is the primary use case for our company's SOC.

The consulting and monthly consulting and reporting are very useful features that we find most valuable.

Having a dedicated cybersecurity advisor through Rapid7 MDR helps us align our cybersecurity strategy to the up-to-date measurements and controls that we can take, which impacts how we align our security program with business needs.

With a very small IT operations team, we have experienced a positive impact from Rapid7 MDR. In the past, we had much effort to handle incidents, and now with the SOC on our side, the process is more streamlined, and we are much faster than before.

My impression of the Risk-Aware Detection features is positive; they work well for us.

We are starting to get into the AI solutions from Rapid7 MDR for our SIEM, but we are in the very beginning stages, focusing on AI-assisted Risk-Aware Investigation workflows.

We are using the integrated MDR for Microsoft environments feature. Up to now, it works well regarding its detection and response capabilities for Microsoft-centric environments.

Now we have a clear view of what has happened in our tenant, which has impacted our incident recovery process positively; before, we did not have this view. We have many signals, so we can control them and check if we are on the right path or if it is just a false incident, and it works very well. In the last several months, we have seen more than we have seen in the previous two years.

AI is present, and I think Rapid7 MDR could add good reporting, more reporting, and perhaps more templates in the future to make the product even better.

Since the beginning of the year, we have been using this tool.

Rapid7 MDR works really well; we are completely satisfied with it. It is a nice service and I believe we have everything we need. From my perspective, I have no improvements to suggest. There is much more we have to discover.

I do not think there are scalability issues regarding extending usage in the future.

When ten is the best, I would rate their technical support at a ten.

We have Rapid7 IVM and SIEM, and we are still using them. We have now added Rapid7 MDR as a service, which reflects our previous positive experience with Rapid7 solutions.

I cannot speak to how the initial setup was because we had Rapid7 IVM and SIEM before, and that setup occurred before my time. The setup for Rapid7 MDR was very simple because we already had half of the infrastructure in place.

We evaluated many other solutions for various situations, but ultimately we chose Rapid7 MDR because of the price and the service, which were perfect for us.

I find the pricing reasonable and competitive.

Rapid7 MDR is hybrid regarding whether it is on-premises, cloud-based, or hybrid.

I purchased Rapid7 MDR through our IT supplier.

Five people, at most, are working with the product in our company, indicating the usage is currently pretty limited.

The interface is very handy and user-friendly.

I would say Rapid7 MDR is popular; Rapid7 is a well-known name in my region.

I would rate this product a ten out of ten.

We use it for our security and virtual center security. It helps us investigate incidents and physical issues.

We've filled in crucial gaps we had with our previous solution. This was a key factor in choosing Rapid7 during the selection process. The ROI is already starting to show, too.

We saw specific cost reductions. We used to pay extra for external user insight and availability management in our old setup. Now, that's all included in Rapid7, which saves us money and simplifies management.

The integrations are a big plus. We can easily onboard log sources and transition from our previous MSSP without any hassle. We don't have any major issues and it has good ease of use for resource onboarding a breeze.

There are potential improvements in reports and dashboards.

We have been using it for a couple of months. It replaced SecureWorks in my current environment. We used SecureWorks MDR in my previous role.

It is a stable solution.

Our previous solution was limited by events per second or other load restrictions. With Rapid7, we can send as many logs as we want. We're not limited by any event or check numbers. It's very flexible and scalable, unlike our previous setup.

The support is quite responsive. We often jump on calls for onboarding assets and custom configurations like log forwarding. We haven't needed much beyond that.

Positive

The setup was definitely straightforward. Onboarding and integrations were a breeze.

We started by selecting a vendor, in this case, External Call.com. They handled a lot of the initial and out-of-box configuration and setup, and their consultants took care of the rest of the process. Everything was smooth and efficient in the business sense. The deployment took about six months.

As long as the collectors are running in the cloud, there's not much maintenance required. We decided to keep the programming on-premise, but that's a separate decision.

We saw an ROI. We saw specific cost reductions. We used to pay extra for external user insight and vulnerability management in our old setup. Now, that's all included in Rapid7, which saves us money and simplifies vulnerability management.

It's reasonable compared to our previous solution. We conducted a cost-benefit analysis and based on that it met our needs and usage, so we are satisfied with the price. 

Rapid7 works well for us and meets our current needs. It's a solid eight out of ten. However, it depends on your organization's cybersecurity roadmap. 

For example, if your long-term plan is to have an on-premise security team, then Rapid7 might not be the best fit. 

We don't have on-premise capabilities and rely solely on the cloud, so it works for us. But other organizations might need that on-premise option. So, it really depends on their cybersecurity roadmap.

My company is also implementing Rapid7 MDR for database security. When comparing it with other solutions like ductless systems, Rapid7 stands out specifically for MDR network protection and response.

Rapid7's MDR service offers several strong points. Firstly, it excels in incident response. Rapid7 focuses not only on incident detection but also on response, aiming to minimize false positives effectively. This capability is crucial for reducing unnecessary alerts and ensuring that responses are targeted and efficient.

Additionally, Rapid7's MDR service extends beyond just incident response. It includes features for vulnerability assessment and vulnerability management, which are essential for proactive security measures. These features help in identifying and managing potential risks before they can be exploited.

I have been using Rapid7 MDR for three years. We are the vendor of this solution.

The product is stable. I rate the solution’s stability a nine out of ten.

The scalability is high. It is suitable for enterprise businesses. I rate the solution’s scalability a seven out of ten.

Support is excellent.

Positive

The initial setup is straightforward. To install the Rapid7, sensor and pull off kit, we only need less than a day.

I rate the initial setup an eight or nine out of ten, where one is difficult, and ten is easy.

We have a very nice pricing. It is flexible.

Rapid7 MDR leverage AI highly to enhance threat detection and response capabilities.

Overall, I rate the solution an eight out of ten.

We use the solution in our security operation center. We use the tool to provide more visibility into the security operation center.

It is a good solution. It's not a black box. Our security operations center has similar access to the console that we have access to. It's very open. The product has automation workflows. It has around 5000 detections in it. I trust the solution.

The product is continuously developing. Whenever something new comes out, the product is upgraded. We can also bring in community threat feeds. The product allows us to customize our alerts. Log query searching has come a long way. It doesn’t require us to code anymore. We can just type in what we are looking for.

We can also deploy our agents. The good thing about agents is that we can use the automation workflow to disable user accounts. We can also make it disable and quarantine an asset. These features are provided right out of the box. The workflows do not cost us more money.

The product should provide full transparency in security operations. I want to see what's exactly going on on the other side. I want to know what is happening, what my security operations center is doing, and whether they are working for me.

I have been using the solution for four to five years for two to three different companies.

The nice thing about MDR is that we have a number to call. If there's something major or risky, we have a telephone number for that group.

Positive

I have used Arctic Wolf. We switched to Rapid7 MDR because we didn’t get a lot of insight from Arctic Wolf, and it provided a lot of false positives.

I rate the ease of setup a seven out of ten. It is not bad. It takes a little bit more time. It will probably take three weeks to get the product up and running, especially by the time we deploy all the agents.

We need four people to deploy the solution. It includes server, network, security, and desktop experts.

The product is not overly priced. We can buy products for a cheaper price, but we will not get as much technology.

I trust the tool with my network. Overall, I rate the product a nine out of ten.