Rapid7 InsightIDR

The implementation process for Rapid7 InsightIDR is designed to be straightforward and efficient, leveraging its cloud-native architecture and guided setup tools. Below is a detailed breakdown of the steps involved and the estimated timeline:

1. Preparation (Before Day 1)

• Set Up Service Accounts: Create or designate a service account to collect log data for InsightIDR. Ensure it has the necessary permissions for accessing event sources like Active Directory, DNS, and network logs.
• Provision Resources: Allocate hardware or virtual resources for the InsightIDR Collector and Network Sensor. Supported environments include Linux-based systems (e.g., Ubuntu, RHEL, CentOS).

• Plan Deployment: Develop a deployment plan based on organizational needs, including the number of endpoints, event sources, and compliance requirements.

2. Days 1–15: Initial Setup

• Install the Collector:
  • Download the InsightIDR Collector from the platform’s portal.
  • Install it on a designated server or virtual machine. The Collector acts as a central hub for ingesting logs from various sources.

  • Activate the Collector by entering an activation token generated during installation.

• Deploy Insight Agents:
  • Install Insight Agents on all endpoints (Windows, Linux, Mac) to collect live system information such as asset identification, running processes, and logs.

  • Use token-based or certificate-based installers to deploy agents via methods like Group Policy Objects (GPOs) for Windows environments.

• Configure Event Sources:
  • Set up core event sources such as Active Directory, DNS, LDAP, and endpoint logs.

  • Use auto-configuration tools provided in the platform to simplify integration with supported technologies.

• Verify Connectivity:

  • Ensure that all components (Collector, Agents, Event Sources) are connected to the InsightIDR platform over appropriate ports (e.g., port 443 for cloud communication).

3. Days 16–45: Data Exploration

• Log Search Setup:
  • Start exploring log data to gain insights into network activity and detect anomalous events.

  • Use visual search capabilities and pre-built dashboards to monitor key security controls.

• Fine-Tune Configurations:
  • Adjust detection rules (e.g., User Behavior Analytics or Attacker Behavior Analytics) to align with organizational needs.

  • Set up compliance dashboards and reports for frameworks like PCI DSS or HIPAA.

4. Days 46–90: Advanced Features

• Expand Monitoring Footprint:
  • Enable additional features like File Integrity Monitoring (FIM), Network Traffic Analysis (NTA), and deception technology (honeypots).
• Custom Dashboards & Alerts:
  • Create custom dashboards tailored to specific business requirements.
  • Define custom detection rules to address unique threats in your environment.
• Knowledge Transfer:

  • Train security teams on using features like incident investigation workflows, log searches, and reporting tools.

5. Ongoing Maintenance

• Regularly update agents and collectors to ensure compatibility with new features.

• Perform periodic health checks using Rapid7’s Health Check Services to verify system configuration and optimize performance.

Estimated Timeline

• Small Environments: Implementation can be completed within a few days (1–3 days) if minimal customization is required.
• Medium to Large Environments: Full deployment typically takes up to 90 days, including initial setup, data exploration, fine-tuning configurations, and enabling advanced features.

Rapid7 InsightIDR offers extensive customization options to meet specific business needs. Here are the key areas of customization:

1. Custom Detection Rules

• Users can create custom detection rules to monitor specific activities or threats unique to their organization. These rules can be scoped by event type and refined further by selecting specific logs or log sets.
• Up to 50 custom detection rules can be created per organization by default, with the option to increase this limit upon request.

• Examples include configuring rules for log inactivity, log pattern detection, or log change detection.

2. Detection Rule Modifications

• Built-in detection rules can be modified to better suit organizational needs. Users can adjust Rule Actions (e.g., creating investigations or alerts), set priorities, and add exceptions for specific scenarios.

• Managed Detection and Response (MDR) customers can work with Rapid7’s SOC team to fine-tune detection rules for their environment.

3. Custom Dashboards and Reports

• InsightIDR allows users to build custom dashboards using pre-built visualization cards from the Card Library or by creating new cards via the Card Builder. This enables organizations to tailor dashboards for specific metrics or compliance requirements.

• Reports can also be customized by editing section names, descriptions, and layouts. Users can generate reports in formats like HTML or CSV and schedule them for regular distribution.

4. Event Source and Network Settings

• Organizations can configure event source settings (e.g., IP addresses, credentials) and customize network policies based on business groups or zones. This includes tagging domains for phishing detection and setting up static/unmanaged IP ranges.

5. Role-Based Access Control

• User roles and permissions can be tailored to ensure that only authorized personnel have access to critical features like creating detection rules or modifying dashboards.

These customization capabilities allow InsightIDR to align with diverse security requirements across industries, ensuring flexibility and adaptability.

Rapid7 InsightIDR pricing is transparent and modular, but additional costs may arise based on usage and organizational requirements:

1. Setup Fees

• Organizations may incur internal costs for deployment resources or third-party integrations.

2. Subscription Costs

• Pricing is asset-based:
  • InsightIDR Essential: Starts at $3.82 per asset per month.
  • InsightIDR Advanced: Starts at $6.36 per asset per month.
  • InsightIDR Ultimate: Starts at $8.21 per asset per month.

• A minimum of 500 assets is required for subscription, which may make it less accessible for smaller businesses.

3. Maintenance Costs

• Subscriptions include a "Fair Use Monthly Data Policy" that scales with asset tiers. While there is no throttling based on data consumption, organizations exceeding their data limits may need additional plans, which could incur extra costs.

4. Support Charges

• Standard customer support is included in all subscriptions (regionally available between 8 AM–6 PM).

• Advanced support options (e.g., Managed Detection and Response) are priced separately under the Managed Threat Complete offering

5. Add-On Costs

• Additional costs may apply if organizations require:
  • Increased limits for custom detection rules.
  • Integration with other Rapid7 products like InsightVM or InsightConnect.
  • Long-term data retention beyond the default period.

Overall, while there are no hidden setup fees, total costs depend on the number of assets monitored, additional data usage, and optional services like MDR or advanced support plans.

Rapid7 InsightIDR provides extensive training and support options to help new users effectively deploy and use the platform. These include:

1. Training Options

• On-Demand Training: Self-paced e-learning modules available through the Rapid7 Academy, covering product features, deployment, and best practices.
• Instructor-Led Training:
  • Virtual instructor-led courses (1–2 days) with access to a virtual lab environment for hands-on practice.
  • Workshops such as "Getting Started with InsightIDR" (1-hour sessions) focus on installation, configuration, and foundational event source setup.
• Certification Programs:
  • Certification exams, such as the InsightIDR Certified Specialist exam, validate product knowledge and expertise.
• Deep Dive Webcasts: Free sessions led by product teams that explore advanced features like detection rule customization and investigation management.

• Custom Training: Tailored training programs for organizations with specific objectives or requirements.

2. Support Options

• Documentation: Comprehensive guides and FAQs are available for deployment, troubleshooting, and advanced configurations.
• Customer Support:
  • Standard support is available regionally from 8 AM–6 PM.
  • Advanced support options include Managed Detection and Response (MDR) services for proactive threat monitoring and response.

• Community Resources: Access to forums, webcasts, and workshops for peer learning and expert advice.

These training and support resources ensure that users can quickly onboard and maximize the value of InsightIDR.

Rapid7 InsightIDR employs robust security measures to ensure the confidentiality, integrity, and availability of customer data:

1. Data Encryption

• All data is encrypted in transit using TLS protocols and at rest using AES-256 encryption.

• Public key cryptography is used for secure communication between collectors and the cloud platform.

2. Access Controls

• Strict access controls enforce role-based permissions to limit data access to authorized personnel only.

• Two-factor authentication (2FA) is mandatory for accessing production systems, with options like YubiKeys or app-generated passcodes.

3. Data Tokenization

• Customer log data is tokenized using unique UUIDs to isolate it from other customers’ data within the platform.

4. Secure Infrastructure

• The platform is hosted on Amazon Web Services (AWS), leveraging its secure infrastructure for data storage and processing.

• Rapid7 continuously monitors its AWS accounts for risks like insecure configurations or public exposure of sensitive resources.

5. Vulnerability Management

• Rapid7’s internal environments are scanned regularly using its own tools (e.g., InsightVM) to identify and remediate vulnerabilities promptly.

6. Compliance

• The platform adheres to industry standards such as FIPS 140-2 encryption algorithms where applicable.

These measures ensure that customer data remains secure while enabling reliable threat detection and response capabilities.

Frequency of Updates

1. Monthly Product Updates:
   • Rapid7 InsightIDR releases updates on a monthly basis, typically at the end of each month. These updates include new features, performance improvements, bug fixes, and enhancements to existing functionalities.

   • For example, updates were released on November 29, October 31, and September 30 in 2024, showcasing consistent monthly updates.

2. Agent Updates:

   • Insight Agents receive regular updates to improve log collection capabilities, expand operating system support, and enhance security posture. These updates are managed separately from the core platform and can be applied automatically or manually based on organizational preferences.

3. Content Updates:

   • Content updates (e.g., new detection rules or threat intelligence) occur continuously and are applied automatically to ensure the platform stays up-to-date with emerging threats and vulnerabilities.

Update Management

1. Automatic Updates:
   • By default, InsightIDR applies product updates automatically to minimize disruption and ensure users always have access to the latest features.

   • Organizations can configure their update schedules to align with business operations, such as applying updates during non-business hours.

2. Agent Update Strategies:
   • Administrators can choose between automatic updates (to apply the latest version immediately) or locking agents to specific versions for stability.

   • Throttling controls allow organizations to limit the rate of concurrent agent updates to manage bandwidth usage effectively.

3. Change Management:

   • All updates undergo a rigorous review, testing, and approval process before being deployed to production environments. This systematic approach ensures that changes do not disrupt service integrity.

4. Release Notes:
   • Detailed release notes accompany every update, outlining new features, fixes, and improvements. These notes are accessible via Rapid7’s documentation portal.

Data Ownership

1. Customer Ownership:
   • Customers retain full ownership of their data collected and processed by InsightIDR. This includes log data from event sources, detections, alerts, investigations, and reports.

   • InsightIDR does not collect customer data beyond what is configured for event sources unless explicitly authorized.

2. Data Tokenization:

   • All customer log data is tokenized using unique UUIDs to isolate it from other customers’ data in Rapid7’s multi-tenant cloud environment.

Data Portability

1. Export Options:
   • Customers can export log data and reports in various formats (e.g., CSV) for use in other systems or for compliance purposes.

   • Log Search data can be archived to an external Amazon S3 bucket for long-term storage beyond the default retention period of 13 months.

2. Retention Periods:
   • By default, log data is retained for 13 months within InsightIDR’s Log Search feature.

   • Customers can purchase extended retention plans or set up daily archiving to their own storage solutions (e.g., Amazon S3 buckets).

3. Access During MDR Services:

   • For customers using Rapid7’s Managed Detection and Response (MDR) services, full access to their data within InsightIDR is maintained alongside MDR monitoring capabilities.

Data Privacy and Security

• Data is encrypted in transit (TLS) and at rest (AES-256). Public key cryptography ensures secure communication between collectors and the cloud platform.
• Strict access controls prevent unauthorized access to customer data.

Rapid7 InsightIDR is designed to be highly scalable, allowing organizations to adjust their usage as their needs evolve. Here are the key terms and details:

1. Cloud-Native Scalability

• InsightIDR is a cloud-native solution hosted on AWS, enabling rapid scaling of resources such as CPU, memory, storage, and networking capacity to meet enterprise demands.
• Organizations can scale up or down without needing to manage on-premises infrastructure, making it ideal for dynamic environments.

2. Asset-Based Pricing

• InsightIDR pricing is based on the number of assets monitored (e.g., servers, desktops, laptops). The cost per asset decreases as the number of assets increases across pricing tiers.
• Customers can easily add or remove assets to align with organizational growth or downsizing.

3. Data Usage Policies

• All subscriptions include a Fair Use Monthly Data Policy that scales with asset tiers. Rapid7 does not throttle data usage but works with customers to create reasonable plans for additional data consumption if needed.

4. Flexible Subscription Adjustments

• Customers can contact Rapid7's Customer Success Managers (CSMs) or Account Executives (AEs) to update their subscriptions and accommodate changes in asset counts.
• Scaling is supported across distributed environments, including remote employees and multiple office locations.

5. Automatic Scaling Features

• The platform automatically adjusts performance requirements (e.g., processing power) based on usage demands, ensuring consistent functionality during periods of high activity.

These terms ensure that organizations can seamlessly adapt InsightIDR to their changing security needs while maintaining cost efficiency and operational flexibility.

Contract Renewal Terms

1. Automatic Renewal:
   • InsightIDR subscriptions automatically renew annually unless otherwise specified in the order form.
   • Customers must provide written notice at least 30 days before the subscription's anniversary date to opt out of auto-renewal.
2. Price Adjustments:
   • Rapid7 reserves the right to adjust subscription rates, introduce new charges, or change usage policies upon providing written notice (via email) at least 60 days before the end of the current subscription term.
3. Renewal Invoicing:
   • Renewals are invoiced at the rate specified in the applicable order form unless changes are communicated in advance.

Cancellation Terms

1. Termination by Either Party:
   • Either party may terminate the agreement with 30 days' written notice if there are no active subscription terms.
   • Immediate termination is allowed in cases of material breach if not resolved within 30 days or if one party ceases operations (e.g., bankruptcy).
2. Refund Policy:
   • If Rapid7 fails to restore functionality due to a breach of its service warranty, customers may terminate their subscription and receive a pro-rata refund for the unused portion of the term.
3. Post-Termination Obligations:
   • Upon termination, customers must stop using the service and delete all associated content from their systems.
   • Rapid7 will retain customer data for up to 90 days after termination before permanently deleting it.

These terms provide flexibility for customers while ensuring clear guidelines for renewals and cancellations.

Rapid7 InsightIDR complies with several key industry standards and frameworks to ensure robust security and regulatory alignment:

1. ISO 27001 Certification

• InsightIDR is part of Rapid7’s Information Security Management System (ISMS), which is ISO 27001 certified.
• This certification ensures adherence to international standards for managing information security risks.

2. PCI DSS Compliance

• InsightIDR helps organizations meet Payment Card Industry Data Security Standard (PCI DSS) requirements by:
  • Centralizing log management (Requirement 10).
  • Monitoring access control policies (Requirements 7.1, 7.3).
  • Providing file integrity monitoring (Requirement 11.5).

3. HIPAA Compliance

• The platform supports healthcare organizations by providing tools for monitoring access to sensitive data and detecting unauthorized changes to critical files, aligning with HIPAA regulations.

4. SOC 2 Compliance

• Hosted on AWS infrastructure, InsightIDR benefits from AWS’s SOC 2 compliance reports, ensuring secure handling of customer data.

5. GDPR Readiness

• Rapid7 ensures that customer data is processed securely and transparently in compliance with General Data Protection Regulation (GDPR) requirements.

6. IRAP Assessment

• Rapid7 has completed an Information Security Registered Assessors Program (IRAP) assessment at the PROTECTED level for its cloud solutions, ensuring compliance with Australian government security standards.

7. Other Frameworks Supported

• NIST Cybersecurity Framework
• CIS Controls
• SOX (Sarbanes-Oxley Act)

InsightIDR also provides pre-built compliance dashboards and reports for these frameworks, enabling organizations to streamline audits and demonstrate adherence efficiently.