My main use case for Rapid7 MDR involves points in our infrastructure level, specifically all infrastructure level. A specific example of how I'm using Rapid7 MDR at the infrastructure level is that it helped us identify and investigate unusual internal activities such as suspicious login attempts and abnormal server-to-server communication. The 24/7 monitoring and alerting enabled our team to quickly validate the threat, contain the affected assets, and reduce the response time significantly compared to manual monitoring. Rapid7 MDR's threat detection and response capability improves our security operation efficiency by providing continuous monitoring, expert analysis, and timely incident guidance, helping us to reduce response times.
Chief Revenue Officer at a computer software company
Real User
Top 5
Oct 13, 2026
My main use case for Rapid7 MDR is that I was selling and positioning this solution to mid-market customers that had a global footprint and obviously needed security to lock down all of their endpoints and manage them through AI and a 24/7 SOC team located throughout the globe. A specific example of how one of my customers used Rapid7 MDR in their environment includes a customer in the auto financing credit space located in Utah who were looking for a solution that would allow them to monitor all of their endpoints globally, including anyone located in the US or outside of the US, and manage their entire network using software. That is how they were leveraging Rapid7 MDR to monitor their network and all their endpoints, also leveraging the global security operations center that has offices throughout the globe.
Director of Cybersecurity and Compliance at a consultancy with 11-50 employees
Real User
Top 10
Oct 6, 2026
My main use case for Rapid7 MDR is log collection and alerting. I have a specific example of how I use it for log collection and alerting, such as sending all logs and creating custom alerts, including Duo fraud alerts.
My main use case for Rapid7 MDR is providing protection where manual intervention from the company side is almost zero, which is essential for maintaining effective security. The main point is knowing that someone is managing, not only selling, the complete solution we deployed and are fond of, and that is the backbone of our use case.
My main use case for Rapid7 MDR is to monitor incidents and ensure our applications are secured. I also want to make sure we are proactive in identifying threats. I use Rapid7 MDR daily as part of our security process. My workflow starts on a day-to-day basis by checking the dashboard for overnight alerts to see if there are any incidents and to investigate them. If there is any incident that needs to be escalated to my SOC team, I handle that accordingly. It is mainly to monitor the applications 24/7 for any incidents or alerts. We also use Rapid7 MDR to investigate user activities. We also use Rapid7 MDR for threat hunting with custom queries and for reports on a weekly and monthly basis to find how many incidents have occurred and to get all those details.
My primary use case of Rapid7 MDR is to do 24/7 threat monitoring and managed detection and response. We use it to identify suspicious activity across endpoint, network, and cloud environments and investigate the alerts and reduce false positive alerts through analysis. One of the examples was we used Rapid7 MDR to detect a suspicious malware activity or PowerShell activity on a user's device. Rapid7 MDR can correlate that endpoint element with network authentication and identification, and it finds if it has suspicious activity and then escalates it with details. The alert had already been validated and with context, we were able to isolate the affected endpoint, investigate the user's activity, and confirm the incident. At the same point, Rapid7 MDR filtered several benign administrative activities such as PowerShell execution, which significantly allowed us to focus on genuine threats. Overall, Rapid7 MDR helps us to strengthen our security operations by providing continuous monitoring, high quality threat detection, and expert analysis support. The contextual investigation and actionable recommendations have improved our SOC response and allowed the SOC team to focus on high priority activities rather than spending time on false positive alerts.
I use Rapid7 MDR for security monitoring and easy onboarding and deployment. We primarily use Rapid7 MDR for threat detection and incident response, where it helps us to investigate deeply into those incidents.
Our use case is to measure our compliance score. We measure our compliance status with CIS benchmarks implemented via Intune and Defender, which was a request from management.
Security Analyst at a tech vendor with 10,001+ employees
Real User
Top 20
Mar 26, 2026
Rapid7 MDR serves as our endpoint security solution. When we receive an alert from Rapid7 MDR, we check the logs of the endpoints that are managed on the client side, which provides us with richer information for the tickets. The enrichment that Rapid7 MDR generates for the client is greater than with other tools, and this has had a big impact. Everything works very well with Rapid7 MDR. One day we had an incident related to an attack where Rapid7 MDR detected social engineering in a Teams chat, for which we received a notification by email. By correlating the events in Rapid7 MDR, we identified that it was a call from an unauthorized tenant within the organization.
I can describe many use cases for Rapid7 MDR, as there are multiple times when a person's PC gets compromised. There is an attacker behavior analysis, ABA, which is already part of the specific Rapid7 MDR XDR solution. We define a specific set of built-in rules in the MDR services and remap those rules according to our infrastructure for specific use cases. We also deal with multiple phishing emails that we receive, and Rapid7 MDR is effective in identifying those specific use cases. In the Fintech sector, we encounter many anomalies from different servers that are publicly exposed on the internet, and Rapid7 MDR provides very beneficial use cases that eliminate the need to write custom use cases. We can define the logic in predefined use cases such as Attacker Behavior Analysis and User Behavior Analytics. Additionally, when onboarding any log sources, there is a RegEx parser designed for parsing every log source on the built-in platform, making it quite user-friendly.
The typical use case for Rapid7 MDR is that it is highly valued. It is not so bad, but competition with EDR is tough. Rapid7 MDR does not position itself as EDR or XDR, so it is rather a SIEM type solution, which makes it different from CrowdStrike, SentinelOne, or Microsoft. They are not in the competition listing of EDR products.
Rapid7 MDR is a leading service offering transparency, integration, incident response, and proactive security. It is designed for efficient SIEM and EDR integration to facilitate threat detection, making it effective for organizations of all sizes.Renowned for robust threat detection, Rapid7 MDR combines transparency, automation, and integration. It provides excellent incident response, vulnerability management, AI-driven log queries, and significant time savings. Despite competitive...
My main use case for Rapid7 MDR involves points in our infrastructure level, specifically all infrastructure level. A specific example of how I'm using Rapid7 MDR at the infrastructure level is that it helped us identify and investigate unusual internal activities such as suspicious login attempts and abnormal server-to-server communication. The 24/7 monitoring and alerting enabled our team to quickly validate the threat, contain the affected assets, and reduce the response time significantly compared to manual monitoring. Rapid7 MDR's threat detection and response capability improves our security operation efficiency by providing continuous monitoring, expert analysis, and timely incident guidance, helping us to reduce response times.
My main use case for Rapid7 MDR is that I was selling and positioning this solution to mid-market customers that had a global footprint and obviously needed security to lock down all of their endpoints and manage them through AI and a 24/7 SOC team located throughout the globe. A specific example of how one of my customers used Rapid7 MDR in their environment includes a customer in the auto financing credit space located in Utah who were looking for a solution that would allow them to monitor all of their endpoints globally, including anyone located in the US or outside of the US, and manage their entire network using software. That is how they were leveraging Rapid7 MDR to monitor their network and all their endpoints, also leveraging the global security operations center that has offices throughout the globe.
My main use case for Rapid7 MDR is log collection and alerting. I have a specific example of how I use it for log collection and alerting, such as sending all logs and creating custom alerts, including Duo fraud alerts.
My main use case for Rapid7 MDR is providing protection where manual intervention from the company side is almost zero, which is essential for maintaining effective security. The main point is knowing that someone is managing, not only selling, the complete solution we deployed and are fond of, and that is the backbone of our use case.
My main use case for Rapid7 MDR is to monitor incidents and ensure our applications are secured. I also want to make sure we are proactive in identifying threats. I use Rapid7 MDR daily as part of our security process. My workflow starts on a day-to-day basis by checking the dashboard for overnight alerts to see if there are any incidents and to investigate them. If there is any incident that needs to be escalated to my SOC team, I handle that accordingly. It is mainly to monitor the applications 24/7 for any incidents or alerts. We also use Rapid7 MDR to investigate user activities. We also use Rapid7 MDR for threat hunting with custom queries and for reports on a weekly and monthly basis to find how many incidents have occurred and to get all those details.
My primary use case of Rapid7 MDR is to do 24/7 threat monitoring and managed detection and response. We use it to identify suspicious activity across endpoint, network, and cloud environments and investigate the alerts and reduce false positive alerts through analysis. One of the examples was we used Rapid7 MDR to detect a suspicious malware activity or PowerShell activity on a user's device. Rapid7 MDR can correlate that endpoint element with network authentication and identification, and it finds if it has suspicious activity and then escalates it with details. The alert had already been validated and with context, we were able to isolate the affected endpoint, investigate the user's activity, and confirm the incident. At the same point, Rapid7 MDR filtered several benign administrative activities such as PowerShell execution, which significantly allowed us to focus on genuine threats. Overall, Rapid7 MDR helps us to strengthen our security operations by providing continuous monitoring, high quality threat detection, and expert analysis support. The contextual investigation and actionable recommendations have improved our SOC response and allowed the SOC team to focus on high priority activities rather than spending time on false positive alerts.
I use Rapid7 MDR for security monitoring and easy onboarding and deployment. We primarily use Rapid7 MDR for threat detection and incident response, where it helps us to investigate deeply into those incidents.
Our primary use cases focus on threat detection and network-related security concerns, with an emphasis on cybersecurity-related areas.
Our use case is to measure our compliance score. We measure our compliance status with CIS benchmarks implemented via Intune and Defender, which was a request from management.
Rapid7 MDR serves as our endpoint security solution. When we receive an alert from Rapid7 MDR, we check the logs of the endpoints that are managed on the client side, which provides us with richer information for the tickets. The enrichment that Rapid7 MDR generates for the client is greater than with other tools, and this has had a big impact. Everything works very well with Rapid7 MDR. One day we had an incident related to an attack where Rapid7 MDR detected social engineering in a Teams chat, for which we received a notification by email. By correlating the events in Rapid7 MDR, we identified that it was a call from an unauthorized tenant within the organization.
I can describe many use cases for Rapid7 MDR, as there are multiple times when a person's PC gets compromised. There is an attacker behavior analysis, ABA, which is already part of the specific Rapid7 MDR XDR solution. We define a specific set of built-in rules in the MDR services and remap those rules according to our infrastructure for specific use cases. We also deal with multiple phishing emails that we receive, and Rapid7 MDR is effective in identifying those specific use cases. In the Fintech sector, we encounter many anomalies from different servers that are publicly exposed on the internet, and Rapid7 MDR provides very beneficial use cases that eliminate the need to write custom use cases. We can define the logic in predefined use cases such as Attacker Behavior Analysis and User Behavior Analytics. Additionally, when onboarding any log sources, there is a RegEx parser designed for parsing every log source on the built-in platform, making it quite user-friendly.
The typical use case for Rapid7 MDR is that it is highly valued. It is not so bad, but competition with EDR is tough. Rapid7 MDR does not position itself as EDR or XDR, so it is rather a SIEM type solution, which makes it different from CrowdStrike, SentinelOne, or Microsoft. They are not in the competition listing of EDR products.
We use it for our security and virtual center security. It helps us investigate incidents and physical issues.
We use the solution in our security operation center. We use the tool to provide more visibility into the security operation center.