Rapid7 InsightIDR

What is Rapid7 InsightIDR?

Most cybersecurity detection is a struggle to separate the unusual from the merely uncommon. A decoy avoids that struggle entirely: nobody in the organization has a reason to touch it, so an interaction with one needs no tuning to be worth reading. That is why it sits well next to behaviour analytics rather than instead of it.

Rapid7 InsightIDR is a cloud-native SIEM and XDR that combines log management, User Behavior Analytics, deception technology, and automated response in a single platform.

Key differentiators:

• Cloud-native - no on-prem infrastructure
• UBA - behavioral anomaly detection
• Deception - built-in honeypots
• XDR capabilities - endpoint, cloud, network correlation

Solution Architecture

graph TB
    subgraph "Data Collection"
        A[Logs] --> E[InsightIDR Cloud]
        B[Endpoints] --> E
        C[Cloud Services] --> E
        D[Network] --> E
    end

    subgraph "Detection Engine"
        E --> F[Log Analytics]
        E --> G[UBA]
        E --> H[Attacker Behavior]
        E --> I[Deception Alerts]
    end

    subgraph "Response"
        F --> J[Alert]
        G --> J
        H --> J
        I --> J
        J --> K[Investigation]
        K --> L[Automated Response]
    end

User Behavior Analytics (UBA)

InsightIDR creates a baseline of user behaviors:

Monitored activities:

• Logins (time, location, device)
• Resource access
• Activity patterns
• Privilege escalation

Detected anomalies:

• Unusual login hours
• Login from new location
• Access to unusual resources
• Lateral movement

[Normal Behavior] --> [Baseline] --> [Anomaly Detection] --> [Risk Score]
                                            |
                                    [Contextual Alert]

Attacker Behavior Analytics (ABA)

Detecting attacker techniques mapped to MITRE ATT&CK:

Tactic	Example Detections
Initial Access	Phishing, brute force
Execution	PowerShell abuse, malicious scripts
Persistence	Registry modification, scheduled tasks
Privilege Escalation	Token manipulation, UAC bypass
Credential Access	Mimikatz, credential dumping
Lateral Movement	Pass-the-hash, RDP abuse
Exfiltration	Data staging, unusual transfers

Deception Technology

Built-in honeypots and traps:

Honeypots

• Honey Users - fake user accounts
• Honey Credentials - fake login credentials
• Honey Files - decoy files
• Honey Processes - trap processes

Deception Benefits

• Zero false positives - every alert is real activity
• Early detection - detection before escalation
• Attacker insights - information about attacker techniques

Data Sources

Log Sources

• Windows Events - Security, System, Application
• Active Directory - logins, changes
• Firewall logs - Fortinet
• Cloud logs - AWS CloudTrail, Azure, O365

Endpoint Data (Insight Agent)

• Process execution
• Network connections
• File modifications
• Registry changes

Network Data

• DNS queries
• DHCP leases
• Network flows

Automated Response

Automatic response actions:

[Detection] --> [Playbook Trigger] --> [Automated Action]
                                              |
                        +---------------------+---------------------+
                        |                     |                     |
                [Disable User]        [Isolate Endpoint]    [Block IP]

Available actions:

• Disable Active Directory user
• Isolate endpoint (via Insight Agent)
• Block IP on firewall
• Create ticket in ServiceNow/Jira
• Send notification (Slack, Teams, email)

Investigation & Forensics

Investigation Timeline

• Visual incident timeline
• Event correlation from multiple sources
• User and resource context

Log Search

• Fast log search
• LEQL (Log Entry Query Language)
• Saved searches and dashboards

Integrations

Identity

• Active Directory
• Azure AD
• Okta, Ping Identity

Cloud

• AWS CloudTrail
• Azure Activity Logs
• Google Cloud Audit Logs
• Microsoft 365

Endpoint

• Insight Agent (native)
• CrowdStrike, Carbon Black
• Microsoft Defender

Network

• Fortinet
• Cisco, Juniper

Who is it for?

Rapid7 InsightIDR is for organizations that:

• Seek cloud-native SIEM without on-prem infrastructure
• Need UBA for insider threat detection
• Want fast deployment (weeks, not months)
• Require automated response capabilities

Comparison with Competition

Feature	InsightIDR	Splunk	Microsoft Sentinel
Cloud-native	✅	Partial	✅
UBA built-in	✅	Add-on	✅
Deception	✅	❌	❌
Endpoint agent	✅	❌	Via Defender
Pricing	Per-asset	Per-GB	Per-GB

Deployment with nFlo

1. Log Source Inventory - log source inventory
2. Agent Deployment - Insight Agent deployment
3. Log Collection - log collection configuration
4. Detection Tuning - detection tuning
5. Deception Setup - honeypot configuration
6. Playbook Creation - response playbook creation
7. Training - SOC team training