BluSapphire vs. Rapid7

The architecture is built upon strategic acquisitions, enabling a bolt-on approach over time. The system is flexible, allowing for the ingestion of third-party logs and the construction of analytics. However, there are limitations in threat detection across multiple layers of the organization's IT landscape. Threat response heavily relies on playbook which is a big limitation considering current threat landscape and overall assets expected within organisation.

The deployment of Collectors and sensor VMs is essential. For seamless operations, Rapid7 Agent is essential. Typically, one site deployment takes less than a week. There are high volume of change requests to facilitate communication between Rapid7 agents and components in their cloud.

Initially a vulnerability management system, Rapid7 shifted strategically to focus on threat detection. This involved incorporating SIEM functionality through acquisitions. While these additions provided SIEM, UBA, and EDR capabilities, it's important to note that they are essentially bolted on, which may impact their effectiveness.The NTA capability is limited to DPI and signature matching, essentially functioning as an IDS. However, advanced attackers easily bypass firewalls and IDS systems. Additionally, with over 95% of traffic being encrypted, the system is rendered ineffective.What is needed is the ability to identify subtle malicious signals early and proactively contain threats. This can be achieved through the implementation of Network Behavior Anomaly Detection (NBAD), a capability that Rapid7 currently lacks.

Rapid7 boasts excellent analytics capabilities and also supports third-party log ingestion. However, storing the data for a longer time frame is a challenge considering cost involved. The larger the data set, the better the value of analytics.

Analysts are typically assigned to execute IR within an hour post incident. However, there is limited flexibility to directly respond to client devices using automation through their SOAR functionality. The effectiveness of SOAR heavily relies on the playbook framework rather than being intelligent enough to respond to each attack scenario. This often results in significant manual intervention required for response, which is both time-consuming and ineffective.

The SIEM-driven XDR capability heavily relies on integrating third-party threat detection functionalities to identify malicious signals throughout the IT landscape. However, these third-party threat detection systems primarily share "Alert Data" and do not provide access to the raw data they analyze for identifying anomalies. As a result, the ability to triage across the organization becomes limited, creating vulnerabilities in the XDR framework and compromising the overall effectiveness of the system.

Hunts are only performed on ingested log data, which limits the overall scope of the hunt. There is also a risk of overlooking important artifacts if the log data is not completely collected, especially considering that a majority of logs are never stored in the data lake. It's important to note that threat hunts are not real-time and do not rely on behavioral analysis.

No functionality to fetch live forensics post Incident Response / remediation compromising on assurance.

Service is super rigid when it comes to monitoring and managing 3rd party devices.

While the claim is unlimited storage - be very careful, the pricing is purely asset based with a fair data consumptin policy attached. In security, the more data - more visibility. With that, you'll start seeing surprise overage as a bill.

Contracts are always annual & hence, you’re locked in.

Deployment of Sensor, Agent and collector closes in 7 Days time. Alert streamlining takes 1.5 months.

Rigid working with competetor products / solutions.

Moderate, platform offers coverage around End point, User behavior with basic Network visiblity.

Data unavailable