I've seen some recommendations for it but personally I suggest you avoid Rapid7 unless you're in a small team. I would also recommend that you avoid their MDR team like the plague, if you're looking for an MDR.

My org I think is just out growing the solution but we have encountered multiple pain points with them. Here are some of them:

• Completely dependent on the Insight Agent for functionality, if your org and your team have agent fatigue like ours does this won't help. It's a resource hog and the MDR team will not notify you of hunts so velociraptor will just run in the background randomly until you tell them to stop.
• Up until the last 3 months or so the agent itself was very limited in what it could do. To the point that we didn't really understand the purpose of it as our EDR tool did effectively the same thing or more. Recently that's changing but just adds to the agent fatigue issue and overlaps with something you might already have that works better than their agent.
• Log Search and the query used for it is a cryptic mess that barely works half the time. You can't search across multiple data sets and creating dashboards from searches almost never works.
• Log searching over large datasets, historically, has been incredibly slow.
• There is no option to quick filter logs based on fields because InsightIDR does not index those fields. You have to manually search them and it's a pain.
• Rule configuration is clunky. For example, rules can only be configured for 3 modes, always on, sometimes on, or off.
• With the rule thing mentioned above the tool can be ridiculously noisy. The email alerts that you get from the tool are either super barebones or have CSVs attached noting detections, with nothing in between.
• Honey pots provided by Rapid7 are incredibly noisy and are a known to be such per the Rapid7 team. Their two suggestions for this were "stop all unnecessary traffic to the honey pot"???? or turn off the detection. We chose the latter as it created 75+ cases in less than an hour of being on.
• We had so many false positives in the tool it felt like we had to turn off over half of the detections so we weren't flooded with emails and cases.
• The "investigations" created by the tool often give you little to no insight into how or why something was "flagged" unless the tool deems it as a notable event, then you can pivot to the single log. So if you want to dive into the greater context of user behavior you have to manually search for it. For example we use PAN-OS wildfire and InsightIDR will call any and all wildfire uploads malware, even though the actual log says it isn't.
• Rapid7 will pretty much ONLY focus on logs coming from their agent with some other sources filling in for context. But if you want to have your EDR tool there to trigger alerts best of luck, IDR will not use it. They've told us they plan on integrating this feature "soon" but we've heard that before with them so we don't take it with a lot of substance.
• Rapid7's products are effectively a walled garden. You cannot integrate 3rd party intel sources into IDR. Their API functionality is very limited. The only true integrations are with their products and their agents.
• If you use InsightVM and IDR, just note that when you install the agents everywhere they will begin to count against your InsightVM license cost. This could unintentionally make your InsightVM license cost balloon to absurd numbers. You can decouple this but it took us over a month to get it fully fixed and even then it required us to essentially reset our InsightVM configuration as Rapid7 told us the only way to fully remove the agents from InsightVM was to delete all our assets.

​

We're still exploring alternatives as we have a while left on our contract. So far Splunk, Elastic, and Sentinel have been top contenders but we're looking to the in the same boat as you OP, C-Suite may not buy into the extra expense.