Rapid7 InsightIDR vs Wazuh comparison

Comparison Buyer's Guide

Executive Summary

We performed a comparison between Rapid7 InsightIDR and Wazuh based on real PeerSpot user reviews.

Find out in this report how the two Security Information and Event Management (SIEM) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Rapid7 InsightIDR vs. Wazuh Report (Updated: June 2024).

Buyer's Guide

Rapid7 InsightIDR vs. Wazuh

June 2024

Download the complete report

Helped 787,061 peers since 2012

Categories and Ranking

Microsoft Defender XDR

Market share comparison

As of June 2024, in the Security Information and Event Management (SIEM) category, the market share of Microsoft Defender XDR is 1.6% and it increased by 10.6% compared to the previous year. The market share of Rapid7 InsightIDR is 4.0% and it increased by 25.5% compared to the previous year. The market share of Wazuh is 26.3% and it increased by 84.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Security Information and Event Management (SIEM)

Unique Categories:

Endpoint Detection and Response (EDR)

8.4%

Extended Detection and Response (XDR)

23.3%

User Entity Behavior Analytics (UEBA)

13.1%

Log Management

20.2%

Featured Reviews

David Shlingbaum

IT Development Manager, Architect, Developer at a recreational facilities/services company with 1-10 employees

May 27, 2024

It gives you reports and updates about the latest hotfixes and zero-day vulnerabilities

We're a small business. Defender XDR gives us a centralized security solution for monitoring our servers and some user PCs. We have around 30 machines, 10 of which are servers. Defender XDR saves the security team time by telling us what patches to apply. We also get preemptive notes about things…

Read full review

reviewer1938444

Security Solution Engineer II at a security firm with 501-1,000 employees

Aug 12, 2022

Quick to deploy and helpful in detecting and responding to security incidents before there is a big outage

I used it in my previous company. We were the integrator of the solution, and also a partner of Rapid7 at the time. We used it for security monitoring and also for analytics. We used it for our own company, and like an MSSP, we sold this to our customers. So, we did security monitoring for our…

Read full review

Muhammad Muaaz Bin Zaka

Software Engineer at a computer software company with 1,001-5,000 employees

Jun 15, 2023

Good for file integrity monitoring

There is room for improvement in Wazuh, but it's possible they are already working on it. The only challenge we faced with Wazuh was the lack of direct support. They charge for support, whether it's five days a week or seven days a week. We don't expect it to be free because revenue is generated through the support they provide. In future releases, I would like to see a feature. There is one feature we observed in a premium tool in the industry called Dynatrace. It provides automatic relations between different devices and components. For instance, if you receive a web login request, Dynatrace can trace and show you the path it takes from the firewall to the switch, then to the Apache server, the actual job application, and finally back to the client. It intelligently correlates all the components involved in a single event. If Wazuh could include this feature, where all the components are integrated, it would automatically relate them for any activity in your environment.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We also use Microsoft Sentinel, Defender for Cloud, Defender for Identity, and Microsoft Defender for Cloud Apps. They are all integrated and it was very easy to integrate them. In my experience with the integrations, it was just a click of a button and things were integrated. It's just a button."

"My clients like Defender's file integrity monitoring. They're monitoring Windows and Linux system files."

"The summarization of emails is a valuable feature."

"It has been great for us. Previously, we didn't have a solution to protect us, especially from malware, whereas now, we are getting protection up front, especially from the malware attacks coming through emails or endpoints."

"The attack simulation is excellent; initially, this feature wasn't very robust, but Microsoft improved what we could achieve with it. We can now customize our practice phishing emails and include our company logo, for example. Attack simulation also helps integrate with third-party solutions where applicable and provides an overview of our security architecture through testing. The summary includes areas for improvement in our protection and what steps we need to take to get there."

"Many people don't realize that Microsoft Azure, Exchange Online, and the security and compliance portal all sync together. For instance, within the Azure portal you can set security restrictions and policies to help secure your tenants... The good part of it is that these products have already been integrated. When you sign on as an admin you have global admin rights and that gives you access to all these features."

"The incident threat response and its ability to facilitate effective remediation against threats are the standout features."

"Microsoft 365 Defender is simple to upgrade."

More Microsoft Defender XDR pros

"Another very important part of insightIDR is the ability to collect data from endpoint devices via agent software. With a large remote workforce, this allows visibility into the endpoints that are connected to the internet, but not to the corporate network."

"The technical support is a solid 10 out of 10 as they take the time to answer any questions or problems which may arise in a reasonable time frame."

"Features for user behavior analytics and the rules for attack review are good."

"The solution provides satisfying native integration features"

"The ability to ingest Office 365 log files, then process them into events and display them on a map."

"I rate Rapid7 nine out of 10 for affordability"

"Great coverage of all systems within our network from endpoint to firewall."

"User behavioral analytics allows us to pinpoint abnormal or suspicious behavior among millions of events every day."

More Rapid7 InsightIDR pros

"The tool is stable."

"Wazuh has very flexible and robust features."

"Wazuh is free and easy to use. It is also adjustable, and we can use it on the cloud and on-premises."

"The product’s interface is intuitive."

"It's stable."

"The most valuable feature of Wazuh is the ELK for doing an investigation."

"Integrates with various open-source and paid products, allowing for flexibility in customization based on use cases."

"I like Wazuh because it is a lot like ELK, which I was already comfortable with, so I didn't have to learn from scratch."

More Wazuh pros

Cons

"The management and automation of the cloud apps have room for improvement."

"There are still some components, such as vulnerability management within the vendor product, where improved integration would be beneficial."

"The price could be better. It'll also help if they can continuously update and upgrade the solution. Every day there's a new virus uploaded into the network, and we have to keep updating it to identify all these things."

"In the future, it would be beneficial for Microsoft to consider making the product more user-friendly or simplified for those who are interested in using it. Currently, it requires a high level of technical expertise, making it challenging for beginners or less experienced individuals."

"The data recovery and backup could be improved."

"The user interface of Microsoft 365 Defender could improve. They could make it simpler."

"The Defender agent itself is more compatible with Windows 10 and Windows 11. Other than these two lines, there are so many compatibility issues. Security is not only about Microsoft. The core technical aspects of it are quite good, but it would be good if they can better support non-Microsoft solutions in terms of putting the agents directly into VMware and other virtualization solutions. There should be more emphasis on RHEL and other operating systems that we use, other than Windows, in the server category."

"The interface could be improved. For example, if you want to do a phishing simulation for your employees, it can take a while to figure out what to do. The interface is a bit messy and could be updated. It isn't too bad, but doing some things can be a long process."

More Microsoft Defender XDR cons

"The solution's XDR agents cannot compete with the XDR solutions out there yet."

"Sometimes, it is hard to get the right queries to use. Currently, the tool lacks a pre-made set of queries."

"I would like to see more development in InsightIDR towards building their SIEM solution and converting it to XDR."

"Customised alert recipients need to be added to allow better first-line action and quicker response. Configurable honeypots would be a welcome addition."

"The product allows us to make only 30 custom rules."

"InsightIDR's integration with other solutions could be improved. Also, I'd like more control from the portal over what's happening on the endpoint side. For example, when I see an attack on an endpoint, I want to be able to stop it from the portal."

"InsightIDR is only available in a cloud version. Some of our customers prefer an on-prem solution because they want to manage the security within their environment."

"Currently, it lacks the functionalities provided by Rapid7's User Behavior Analytics (UBA)."

More Rapid7 InsightIDR cons

"Log data analysis could be improved. My IT team has been looking for an alternative because they want better log data for malware detection. We are also doing more container implementation also, so we need better container security, log data analysis, auditing and compliance, malware detection, etc."

"The biggest part that's missing is threat intelligence. It isn't inbuilt, and if a sudden incident occurs, we don't get that feedback inside the SIEM tool. That's a big gap, I see. It would be better if we could get the threat intelligence feeds integrated with the SIEM tools. That would help us push value solutions to the clients in a big way."

"The technical support can be improved. Wazuh has some bugs that need to be fixed. It would be good if we can have automation with respect to incidence responses."

"Wazuh could improve the detection, it is not detecting all of the attacks. Additionally, it is lacking features compared to other solutions."

"Alerts should be specific rather than repeatedly triggered by integrating multiple factors. This issue needs improvement to create a more efficient alert system."

"The tool does not provide CTI to monitor darknet."

"We would like to see more improvements on the cloud."

"Wazuh doesn't cover sources of events as well as Splunk. You can integrate Splunk with many sources of events, but it's a painful process to take care of some sources of events with Wazuh."

More Wazuh cons

Pricing and Cost Advice

"All I can say again is the E5 gives you all the capabilities that it offers. It also gives Office 365 and one terabyte of storage. All in all, the E5 license model makes sense. There are some people who say it's quite costly, but rather than paying different vendors, it makes sense to go all in with Microsoft if you've got that licensing. From that perspective, it's cost-effective, but I can't comment much on that."

"Sometimes 365 Defender is expensive, but it can be moderate, depending on the organization's size and the license type. We're satisfied with the cost because it gives us a product that protects our entire environment with DLP. To compromise some cost, of course, we are to complete the most secure environment."

"The license cost for a year is approximately forty-four thousand, and this annual saving is a significant factor in our decision to switch."

"While Microsoft Defender XDR carries a higher cost, its ease of use compared to Defender may justify the investment."

"I believe that the pricing of the licensing is fair."

"I believe the pricing is fair and acceptable. I consider it to be reasonable and satisfactory."

"The pricing of Microsoft 365 Defender is definitely on the costly side, but with the features and services that Microsoft provides, such as the seamless integration of all the Defender tools, while the price is on the higher side, there is no alternative."

"The licensing fee for Microsoft 365 Defender is fair."

More Microsoft Defender XDR pricing and cost advice

"It is more reasonably priced than other vendors."

"The pricing of the solution depends on the user. But there is a yearly licensing cost."

"It is on a yearly basis. For our own company, for about 250 users, it was 16,000 euros a year."

"Accurately predict your licensing counts as this is a subscription based product."

"Licensing is straightforward. If, for some reason, you don’t meet the minimum licensing requirements, there is a third-party managed service that can help."

"The pricing is good, and it is not very expensive."

"I rate Rapid7 InsightIDR's price a four on a scale of one to ten, where one is cheap, and ten is expensive."

"Rapid7 InsightIDR charges us based on the endpoints we connect to."

More Rapid7 InsightIDR pricing and cost advice

"When I contacted customer care, they mentioned bundling options, that I found to be overall affordable."

"Wazuh is open-source, but you must consider the total cost of ownership. It may be free to acquire, but you spend a lot of time and effort supporting the product and getting it to a point where it's useful."

"Wazuh is totally free and open source. There are no licensing costs, only support costs if you need them."

"My client uses the open-source version of Wazuh."

"They have a good pricing strategy for market expansion."

"Wazuh is a good tool, but the open-source version has scalability limitations."

"Wazuh is an open-source tool, which means it is freely available for use."

"There is not a license required for Wazuh."

More Wazuh pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Security Information and Event Management (SIEM) solutions are best for your needs.

See recommendations

787,061 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

17%

Financial Services Firm

10%

Government

Manufacturing Company

Computer Software Company

15%

Manufacturing Company

Financial Services Firm

Government

Computer Software Company

17%

Comms Service Provider

Government

Financial Services Firm

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Microsoft 365 Defender?

Microsoft Defender XDR provides strong identity protection with comprehensive insights into risky user behavior and p...

See all answers

What is your experience regarding pricing and costs for Microsoft 365 Defender?

Microsoft Defender XDR is expensive, especially for the full suite functionality. However, when compared to buying mu...

See all answers

What needs improvement with Microsoft 365 Defender?

Improving scalability, especially for very large tenants, could be beneficial for Microsoft Defender XDR. Additionall...

See all answers

What SOC product do you recommend?

For tools I’d recommend: -SIEM- LogRhythm -SOAR- Palo Alto XSOAR Doing commercial w/o both (or at least an XDR) is a...

See all answers

What do you like most about Rapid7 InsightIDR?

During simulations or demonstrations, the tool generates alerts, providing details such as the specific application, ...

See all answers

What is your experience regarding pricing and costs for Rapid7 InsightIDR?

We chose Rapid7 because of its price. IBM QRadar charges us based on data storage. Rapid7 InsightIDR charges us based...

See all answers

What do you like most about Wazuh?

Integrates with various open-source and paid products, allowing for flexibility in customization based on use cases.

See all answers

What needs improvement with Wazuh?

I have built some rules that produce duplicate alerts two or three times. Therefore, these rules should be consolidat...

See all answers

What is your primary use case for Wazuh?

We use Wazuh for the onboarding of both Windows and Linux machines, as well as for firewall and SIM configuration. Th...

See all answers

Comparisons

CrowdStrike Falcon vs Microsoft Defender XDR

Compared 45% of the time

Microsoft Defender for Cloud vs Microsoft Defender XDR

Compared 15% of the time

Microsoft Purview Compliance Manager vs Microsoft Defender XDR

Compared 5% of the time

Trend Vision One vs Microsoft Defender XDR

Compared 3% of the time

Microsoft Sentinel vs Microsoft Defender XDR

Compared 2% of the time

More Microsoft Defender XDR Competitors

Darktrace vs Rapid7 InsightIDR

Compared 15% of the time

Microsoft Sentinel vs Rapid7 InsightIDR

Compared 13% of the time

Splunk Enterprise Security vs Rapid7 InsightIDR

Compared 8% of the time

Rapid7 InsightVM vs Rapid7 InsightIDR

Compared 7% of the time

IBM Security QRadar vs Rapid7 InsightIDR

Compared 4% of the time

More Rapid7 InsightIDR Competitors

Elastic Security vs Wazuh

Compared 15% of the time

Security Onion vs Wazuh

Compared 14% of the time

AlienVault OSSIM vs Wazuh

Compared 11% of the time

Splunk Enterprise Security vs Wazuh

Compared 10% of the time

SentinelOne Singularity Complete vs Wazuh

Compared 2% of the time

More Wazuh Competitors

Product Reports

Buyer's Guide

Microsoft Defender XDR

May 2024

Download Microsoft Defender XDR product report

Buyer's Guide

Rapid7 InsightIDR

May 2024

Download Rapid7 InsightIDR product report

Buyer's Guide

Wazuh

May 2024

Download Wazuh product report

Also Known As

Microsoft 365 Defender, Microsoft Threat Protection, MS 365 Defender

InsightIDR

No data available

Learn More

Microsoft

Rapid7

Wazuh

Overview

Microsoft Defender XDR is a comprehensive security solution designed to protect against threats in the Microsoft 365 environment.

It offers robust security measures, comprehensive threat detection capabilities, and an efficient incident response system. With seamless integration with other Microsoft products and a user-friendly interface, it simplifies security management tasks.

Users have found it effective in detecting and preventing various types of attacks, such as phishing attempts, malware infections, and data breaches.

Watch the Microsoft demo video here: Microsoft Defender XDR demo video.

Parsing hundreds of trivial alerts. Managing a mountain of data. Manually forwarding info from your endpoints. Forget that. InsightIDR instantly arms you with the insight you need to make better decisions across the incident detection and response lifecycle, faster.

Wazuh is an enterprise-ready platform used for security monitoring. It is a free and open-source platform that is used for threat detection, incident response and compliance, and integrity monitoring. Wazuh is capable of protecting workloads across virtualized, on-premises, containerized, and cloud-based environments.

It consists of an endpoint security agent and a management server. Additionally, Wazuh is fully integrated with the Elastic Stack, allowing users the ability to navigate through security alerts via a data visualization tool.

Wazuh’s agent can run on many different platforms, and is lightweight. It can successfully perform the tasks needed to detect threats in order to trigger responses automatically.
Wazuh manages the agents, can analyze agent data, and can scale horizontally.
Elastic Stack is where alerts are indexed and stored.

Wazuh Capabilities

Some of Wazuh’s most notable capabilities include:

Intrusion detection: Wazuh’s agents can detect hidden files, cloaked processes, or unregistered network listeners, as well as inconsistencies in system call responses. Wazuh’s server component uses a signature-based approach to intrusion detection, using its regular expression engine to analyze collected log data and look for indicators of compromise.
Log data analysis: Wazuh can read operating system and application logs, and securely forward them to a central manager for rule-based analysis and storage.
Integrity monitoring: File integrity monitoring can help identify changes in content, ownership, permissions, and attribute of files. Wazuh’s file integrity monitoring can be used in conjunction with threat intelligence.
Vulnerability detection: Wazuh agents can identify well-known vulnerable software so you can see where your weak spots are and take action before an attack can exploit them.
Configuration assessment: System and application configurations are monitored to make sure they are compliant with security policies. Periodic scans are used to detect applications that are known to be vulnerable, insecurely configured, or unpatched.
Incident response: Wazuh responds actively when active threats need to be addressed. It can perform countermeasures like blocking access to a system when a threat source is identified.
Regulatory compliance: Wazuh includes the security controls required to be compliant with industry regulations and standards.
Cloud security: Wazuh’s light-weight and multi-platform agents are commonly used to monitor cloud environments at the instance level. In addition, Wazuh helps monitor cloud infrastructure at an API level.
Security for containers: With Wazuh, you have increased security visibility into hosts and containers, allowing for easier detection of threats, anomalies, and vulnerabilities.

Wazuh Benefits

Some of the most valued benefits of Wazuh include:

No vendor lock-in
No license costs
Uses lightweight, multi-platform agents
Free community support

Wazuh Offers

Annual support and maintenance
Assistance with deployment and configuration
Training and instructional hands-on courses

Reviews From Real Users

"It's very easy to integrate Wazuh with other environments, cloud applications, and on-prem applications. So, the advantage is that it's easy to implement and integrate with other solutions." - Robert C., IT Security Consultant at Microlan Kenya Limited

“The MITRE ATT&CK correlation is most valuable.” - Chief Information Security Officer at a financial services firm

Sample Customers

Accenture, Deloitte, ExxonMobil, General Electric, IBM, Johnson & Johnson and many others.

Liberty Wines, Pioneer Telephone, Visier

Information Not Available

Buyer's Guide

Rapid7 InsightIDR vs. Wazuh

June 2024

Free Report: Rapid7 InsightIDR vs. Wazuh

Find out what your peers are saying about Rapid7 InsightIDR vs. Wazuh and other solutions. Updated: June 2024.

DOWNLOAD NOW

787,061 professionals have used our research since 2012.

See our Rapid7 InsightIDR vs. Wazuh report.

See our list of best Security Information and Event Management (SIEM) vendors and best Extended Detection and Response (XDR) vendors.

We monitor all Security Information and Event Management (SIEM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.