- The buyer wants Rapid7's current SIEM evolution rather than the legacy InsightIDR package identity: Rapid7 explicitly identifies Incident Command as the next evolution of the SIEM platform built on InsightIDR.
- A mid-market or enterprise SOC wants asset-based pricing and integrated exposure, threat, detection, investigation, and automation context: Current product and package pages establish asset-based tiers and a unified Command Platform workflow.
Security & Privacy / Security Information and Event Management (SIEM) Software
Rapid7 Incident Command Review, Pricing, Pros & Cons
Rapid7 Incident Command is the current AI-native SIEM and security operations successor built on the InsightIDR foundation.
Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Buying snapshot
Quick buying snapshot
A compact view of who this tool fits, what it costs, and what to confirm before choosing it.
- The organization needs a self-hosted SIEM or complete control of the SIEM storage plane: Incident Command is delivered through Rapid7's cloud Command Platform with hybrid collectors and agents.
- The buyer requires public package amounts and binding contract terms before technical sizing: Rapid7 publishes package capabilities and asset-based pricing but requires sales contact for binding commercial terms.
- Quote-based predictable asset-based pricing across Incident Command Essentials, Advanced, and Ultimate
- Paid amounts unverified — check official pricing
- Rapid7 provides a current start-free-trial action, but the public page does not establish the exact duration or complete Incident Command entitlement.
Product scope
Product functionality and purchase scope
This profile updates Rapid7 InsightIDR to its officially documented current successor, Incident Command, and evaluates the current Essentials, Advanced, and Ultimate SIEM packages.
Product checked: Aug 10, 2026
- Incident Command Essentials
- Incident Command Advanced
- Incident Command Ultimate
- SIEM collection, detection, investigation, reporting, and response
- Surface Command capabilities included with current Incident Command packages
- SOAR, AI triage, threat intelligence, EDR, NTA, and DFIR where assigned to the selected tier
- Legacy InsightIDR packaging as a separate new purchase
- Rapid7 Managed Detection and Response services
- Managed Threat Complete
- Exposure Command purchased separately
- Standalone vulnerability, application-security, cloud-security, or threat-intelligence products
Pricing plans
Rapid7 Incident Command pricing table
Pricing checked: Aug 10, 2026
Official factConfidence 100%1 linked source
Rapid7 publishes three asset-based packages and their capabilities. Amounts, asset bands, payment timing, minimum purchase, commitment duration, onboarding, and add-on terms require a quote.
Official pricing pagePricing cautions
- Legacy InsightIDR public prices are not current Incident Command prices: Historical third-party and cached InsightIDR amounts do not establish current package, asset band, payment timing, or contract terms.
- Package scope changes total cost: AI triage, deception, deeper intelligence, full XDR, endpoint and network protection, and DFIR are tier-dependent; MDR remains separate.
PlanPriceKey differencesBest for
Incident Command EssentialsSupporting pricing evidenceAmount unverified — check official pricing
- Core SIEM and attack-surface visibility: Included; Essentials entitlement.
Incident Command AdvancedSupporting pricing evidenceAmount unverified — check official pricing
- AI triage, deception, and threat intelligence: Included; Advanced entitlement.
Incident Command UltimateSupporting pricing evidenceAmount unverified — check official pricing
- Full XDR and embedded DFIR: Included; Ultimate entitlement.
Plan upgrade triggers
Verified plan boundaries that can change the required edition.
The SOC requires AI triage, deception technology, or the deeper threat-intelligence capabilities assigned to Advanced.
Supporting pricing evidenceThe organization requires the full XDR package, endpoint and network detection coverage, or embedded DFIR assigned to Ultimate.
Supporting pricing evidenceWhat is included, connected, or sold separately
Product scope
What is included, connected, or sold separately
Material capabilities are separated by their verified relationship to the target product.
Attack-surface visibilityRelationship not verified
Rapid7 documentation states that Surface Command is included with all current Incident Command packages.
Plan: Incident Command Essentials: Not verified · Incident Command Advanced: Not verified · Incident Command Ultimate: Not verifiedSurface Command
Former SIEM product identityRelationship not verified
InsightIDR is the documented foundation and predecessor identity; current commercial packaging uses Incident Command.
Rapid7 InsightIDR
Managed detection and responseRelationship not verified
MDR is a managed service and is not included in the self-managed Incident Command evaluation.
Rapid7 MDR
How the score is calculated
Scoring method
How the score is calculated
The score uses the category-specific buying dimensions below and their displayed weights.
This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.
- Evidence confidence
- 76%
- AI claim confidence
- 99%
- Required-field evidence status
- 100%
- Evidence freshness
- 54%
- Field traceability
- 100%
- Model agreement
- 94%
Why this confidence level
- Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
- Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
- 8 of 8 weighted claims have evidence links.
- 0 A1 documentary official sources and 5 A2 official product sources are linked.
- 4 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
- 4 weighted claims are past the review window.
- No blocking evidence conflict was identified.
Detection and correlation quality19%
81Security teams get behavioral detections and threat intelligence across all tiers, but accessing advanced AI-driven triage requires upgrading to the Advanced plan.
Investigation and threat hunting17%
82Teams can perform threat hunting, log search, and use timeline tools starting on the Essentials tier, while embedded DFIR capabilities require upgrading to the Ultimate tier.
Data collection and context16%
78The data pipeline is described as collecting hybrid log, endpoint, network, SaaS, and third-party telemetry into the cloud SIEM, supporting multi-domain context without separate public detail on pipeline transformation controls.
Response and security operations14%
81SOAR automation and cross-tool containment actions support in-platform response operations, while full XDR, endpoint and network protection, and embedded DFIR deepen response only on Ultimate.
Scale, retention, and performance14%
61Data retention and archiving entitlements are not publicly defined and require validation through custom quotes, which affects long-term storage planning.
Deployment, support, and total cost10%
62Predictable asset-based pricing helps control ongoing licensing costs, but total cost of ownership remains unverified upfront due to the lack of public pricing and onboarding details.
Integrations and detection content10%
75The system supports SaaS and third-party telemetry integrations alongside built-in detection rules, but the full breadth of the integration catalog remains unverified.
Public review signals
InsightIDR predecessor profiles show favorable user ratings
Four public profiles show generally favorable aggregates for InsightIDR or Rapid7 Next-Gen SIEM. These signals describe the foundation that preceded Incident Command and do not independently verify every current package feature.
Public review signals updated: Aug 10, 2026
G24.4/5
- Review count
- 74 reviews
- Source context
- Rapid7 Next-Gen SIEM on G2Documented product successor
Gartner Peer Insights4.4/5
- Rating count
- 409 ratings
- Source context
- InsightIDR on Gartner Peer InsightsDocumented product successor
PeerSpot4.2/5
- Review count
- 33 reviews
- Source context
- Rapid7 InsightIDR on PeerSpotDocumented product successor
TrustRadius8.4/10
- Reviews and ratings
- 49 reviews and ratings
- Source context
- InsightIDR on TrustRadiusDocumented product successor
Rapid7 Incident Command tag profile
Company size
- Mid-market
- Enterprise
Rapid7 Incident Command core capabilities
- Cloud SIEM with hybrid log, endpoint, network, SaaS, and third-party telemetry
- Behavioral detections, AI triage, attack-surface context, and threat intelligence
- Log search, investigation timelines, case workflows, and analyst guidance
- SOAR automation and cross-tool containment actions
- Three asset-based packages from core SIEM through full XDR and DFIR
Detailed strengths and purchase cautions
Why it is worth considering
- Unified security operations capabilities integrate threat hunting, attack-surface context, behavioral detections, and SOAR automation within a single cloud platform.
- Predictable asset-based packaging simplifies license planning across three tiers compared to traditional volume-based log ingestion models.
- Gradual feature scaling allows teams to access advanced AI triage and deception technology on the Advanced tier, or full endpoint, network, and DFIR capabilities on the Ultimate tier.
What to confirm before buying
- Lack of public numeric pricing, asset bands, or contract terms forces buyers to go through a direct sales cycle to establish total cost.
- AI triage, deception, XDR, and deep digital forensics are locked behind higher-tier packages, which can raise costs for teams needing these advanced features.
- Retention and archive entitlements are not publicly defined, requiring direct quote confirmation to verify compliance and long-term storage alignment.
Cross-model buying perspectives
Multi-AI review
Cross-model buying perspectives
Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.
AI assessment updated: Sep 21, 2026
Score comparisonGPTGeminixAIRange
Detection and correlation quality8480795
Investigation and threat hunting8182821
Data collection and context8375768
Response and security operations7885807
Scale, retention, and performance6660588
Integrations and detection content7975709
Deployment, support, and total cost6362603
siem log ingestion normalization8275787
siem correlation detection quality8480804
siem search investigation speed80707210
siem compliance reporting readiness6870682
siem scale cost operability74656212
- siem scale cost operability: 62–74 (12-point range)
- siem search investigation speed: 70–80 (10-point range)
- Integrations and detection content: 70–79 (9-point range)
GPTAI-assisted buyer perspective77
Rapid7 Incident Command fits buyers that want a cloud SIEM with hybrid telemetry collection, investigation workflows, behavioral detections, and automation, while accepting that current package pricing and several commercial terms are quote-only and that deeper AI, XDR, endpoint, network, and DFIR capabilities move by tier.
- Review confidence
- 77/100
Model details
- Strengths
- It supports cloud SIEM use with hybrid log, endpoint, network, SaaS, and third-party telemetry, which matches teams that need multiple data sources in one platform.
- It includes log search, investigation timelines, case workflows, and analyst guidance, which supports day-to-day SOC investigation work.
- It offers SOAR automation and cross-tool containment actions, which can support response operations that extend beyond alert review.
- It is packaged as three asset-based editions, which can help buyers map requirements to a core SIEM tier or higher tiers for broader security operations scope.
- Cautions
- Current public pages do not establish a binding numeric starting price, exact asset bands, payment timing, minimum purchase, or commitment duration, so commercial sizing requires a quote.
- AI triage, deception technology, deeper threat intelligence, XDR, endpoint protection, network protection, and embedded DFIR are tier dependent, so the buyer must check the exact edition fit.
- MDR is a separate service and is not part of the self-managed Incident Command product profile, so managed response buyers need a separate purchase path.
- Current retention and archive entitlements require quote confirmation, so long-retention buying decisions should not rely on the public package summary alone.
GeminiAI-assisted buyer perspective73
Rapid7 Incident Command is a unified, cloud-native SIEM built on the InsightIDR foundation that scales from core log search and behavioral detection to advanced XDR and DFIR workflows, though buyers must navigate custom asset-based quotes to verify exact pricing and retention limits.
- Review confidence
- 73/100
Model details
- Strengths
- Unified security operations capabilities integrate threat hunting, attack-surface context, behavioral detections, and SOAR automation within a single cloud platform.
- Predictable asset-based packaging simplifies license planning across three tiers compared to traditional volume-based log ingestion models.
- Gradual feature scaling allows teams to access advanced AI triage and deception technology on the Advanced tier, or full endpoint, network, and DFIR capabilities on the Ultimate tier.
- Cautions
- Lack of public numeric pricing, asset bands, or contract terms forces buyers to go through a direct sales cycle to establish total cost.
- AI triage, deception, XDR, and deep digital forensics are locked behind higher-tier packages, which can raise costs for teams needing these advanced features.
- Retention and archive entitlements are not publicly defined, requiring direct quote confirmation to verify compliance and long-term storage alignment.
xAIAI-assisted buyer perspective72
Cloud SIEM fit for mid-market and enterprise SOCs that want hybrid telemetry, behavioral detection, investigation workflows, and SOAR containment under asset-based packages, provided buyers confirm tier mapping for AI triage through XDR/DFIR and obtain a quote for retention and commercial terms.
- Review confidence
- 72/100
Model details
- Strengths
- Hybrid collection of log, endpoint, network, SaaS, and third-party telemetry supports unified cloud SIEM visibility across common enterprise sources.
- Behavioral detections, investigation timelines, case workflows, and analyst guidance can support SOC triage and investigation handoffs on the core platform.
- SOAR automation with cross-tool containment actions enables response actions from the same operations surface.
- Asset-based Essentials, Advanced, and Ultimate packages let buyers add AI triage, deception, deeper threat intelligence, XDR, endpoint and network protection, and embedded DFIR by edition rather than starting from a separate product line.
- Cautions
- No binding public numeric package prices, asset bands, payment timing, minimums, or commitment duration are established, so commercial sizing depends on a quote.
- AI triage, deception technology, deeper threat intelligence, full XDR, endpoint and network protection, and embedded DFIR are package-dependent rather than universal across all editions.
- Current retention and archive entitlements are not publicly established and require quote confirmation before storage planning.
- Self-hosted SIEM deployment is outside the supported model for this cloud product profile.
Research transparency
How this page was researched
A compact record of the evidence used, what was not tested, and which conclusions still need verification.
- Official sources
- 5
- Broad product review sources
- 4
- Marketplace and app-store sources
- 0
- Editorial sources
- 0
- Latest evidence check
- Aug 10, 2026
Research basis
Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.
Conflict handlingNo unresolved evidence conflict is currently recorded.
View research methodologyVerified findingsRapid7 provides a current start-free-trial action, but the public page does not establish the exact duration or complete Incident Command entitlement.
- Quote-based predictable asset-based pricing across Incident Command Essentials, Advanced, and Ultimate
- No binding public numeric starting price is verified for current Incident Command packages.
- Rapid7 publishes three asset-based packages and their capabilities. Amounts, asset bands, payment timing, minimum purchase, commitment duration, onboarding, and add-on terms require a quote.
- Cloud SIEM with hybrid log, endpoint, network, SaaS, and third-party telemetry Behavioral detections, AI triage, attack-surface context, and threat intelligence Log search, investigation timelines, case workflows, and analyst guidance SOAR automation and cross-tool containment actions Three asset-based packages from core SIEM through full XDR and DFIR
Verification notes and unresolved itemsRapid7 Incident Command is used as the current identity because Rapid7 describes it as the next evolution of InsightIDR.
- Current product, package, and capability claims use Incident Command sources.
- InsightIDR review aggregates and retention documentation are retained only as clearly labeled predecessor-foundation evidence.
Sources checked
Sources checked
Rapid7 Incident Command source links
SIEM data storage and retention FAQsRapid7Level A2Linked to 0 scored claimsChecked Aug 10, 2026
Incident Command overviewRapid7Level A2Linked to 1 scored claimChecked Aug 10, 2026
Rapid7 Incident Command packagesRapid7Level A2Linked to 4 scored claimsChecked Aug 10, 2026
Incident Command as the next evolution of InsightIDRRapid7Level A2Linked to 1 scored claimChecked Aug 10, 2026
Rapid7 Incident CommandRapid7Level A2Linked to 0 scored claimsChecked Aug 10, 2026
FAQ
Rapid7 Incident Command FAQ
Is InsightIDR still Rapid7's current SIEM package name?
Rapid7 now presents Incident Command as the next evolution of its SIEM platform built on the InsightIDR foundation.
What Incident Command packages are available?
Rapid7 currently lists Essentials, Advanced, and Ultimate, with progressively broader AI, threat-intelligence, XDR, endpoint, network, and DFIR capabilities.
Does Rapid7 publish a current Incident Command starting price?
No binding numeric amount was verified. The current public pages describe predictable asset-based pricing and direct buyers to request a quote.
Is Rapid7 MDR included in this product profile?
No. Managed detection and response is a separate service and is not treated as the self-managed Incident Command product.
Popular comparisons
Common Rapid7 Incident Command comparisons
Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.