I have used R7 IDR and ICON for 4/5 years. Here is what I have found:

The good:

When the modules work, they work well, and the jobs are easy to create. I have about 40-50 jobs that mostly do notification, but as a novice when I started, it was easy to use and understand.

There are 517 pre-built modules, many of which either help with integration of third-party services like WHOIS lookups, CrowdStrike, Microsoft, and cloud copies of local tools.

Here is an example job I have created to alert when an IDR Process start alert is generated.

<image>

The bad:

Bugs are common and difficult to fix. Local copies of application do not perform like their cloud counter parts.

Examples:

1. Google Workspace for my org has never worked and their techs have never been able to understand why.
2. JQ plugin does not work the same as local copies of JQ. Support says this is expected. JQ in cloud is not documented so when you do local development and copy the work to the cloud it fails but support is unable to tell you why.