Question 1

Is Incident Command the same product as InsightIDR?

Accepted Answer

Yes. Rapid7 announced Incident Command on 29 July 2025 and showcased it at Black Hat that August. It is the same SIEM, repositioned around AI-native security operations, with agentic investigation workflows built from Rapid7's own SOC playbooks added to the existing detection, investigation and response capability. The naming is genuinely messy and worth understanding before you go shopping. Rapid7's marketing pages say Incident Command. Its technical documentation still reads "SIEM (InsightIDR)" in many places. Gartner evaluated it as InsightIDR in the 2025 Magic Quadrant. Third-party review sites carry both names, sometimes on separate pages with different review counts. If you are comparing figures across sources, check which name each one used, because you may otherwise think you are looking at two products. For buyers this has one practical consequence: when you search for reviews, pricing data or community discussion, search both names. Most of the accumulated practitioner knowledge on the internet still sits under InsightIDR, because the product carried that name from 2015 to 2025. The rename does not change your contract, your deployment or your data, and existing customers were moved to the new branding without action required. There is no functional split between the names either — there is no "legacy InsightIDR" and "new Incident Command" running in parallel. It is one product with one codebase and two names in circulation, and Rapid7 will eventually retire the old one from the documentation.

Question 2

How much does Incident Command cost?

Accepted Answer

Rapid7 does not publish a list price for Incident Command. It is quote-only, priced per monitored asset with volume discounts beginning above 500 assets, on annual subscription terms. The pricing model deserves more attention than the number. Rapid7 meters by asset, not by data ingested, which is the opposite of how most SIEM platforms bill. An asset is a host running a workstation or server operating system that has reported data within the last thirty days. Practically, this means adding a verbose log source does not increase your licence cost — a genuinely different budget dynamic from ingestion-priced competitors, where teams routinely under-log to control spend. For actual figures, the most reliable public data comes from Rapid7's own AWS Marketplace listings, which publish twelve-month prices for up to 500 assets with thirteen-month retention: roughly $21,479 for Essentials, $33,682 for Advanced and $46,149 for Ultimate. That works out to approximately $43, $67 and $92 per asset per year respectively. Third-party trackers circulate figures like $5.89 per asset per month, but these are estimates from pricing aggregators, not Rapid7 list prices, and they do not reconcile cleanly with the marketplace rates. Treat them as directional only. One contradiction to resolve during negotiation: Gartner describes the licensing as including unlimited ingestion, while the packaged marketplace SKUs carry explicit monthly data allowances of 0.5 to 0.8 TB by tier. Ask Rapid7 directly what happens if you exceed the allowance on your specific contract, and get the answer in writing. Buying through TechBag, you are quoted and invoiced in INR with GST, and we negotiate the asset band, the tier and the renewal uplift on your behalf.

Question 3

Can Incident Command meet CERT-In requirements for an Indian company?

Accepted Answer

Partially, and the gap is important enough that we raise it before the demo rather than after. CERT-In's 2022 Directions, in force since 28 June 2022, impose two obligations relevant here. The first is reporting specified cyber incidents to CERT-In within six hours of noticing them. The second is maintaining logs of all ICT systems for a rolling 180 days, with those logs maintained within Indian jurisdiction. On the six-hour reporting obligation, Incident Command genuinely helps. It detects and raises investigations quickly, timestamps everything, and gives you the evidence needed to make a report. If you add Rapid7 MDR, the contractual SLAs commit to beginning investigation of a critical alert within fifteen minutes and telephoning you within thirty minutes of identifying an incident, which comfortably supports a six-hour reporting window. Note that the legal obligation to report always sits with your Indian entity, never with Rapid7 — CERT-In's own FAQ states the duty is neither transferable nor capable of being indemnified away. On the 180-day log retention obligation, the answer is no, not on its own. Rapid7's platform operates in five regions — the United States, Canada, Europe, Japan and Australia — and there is no India region. Advanced and Ultimate tiers retain logs for 180 days, so the duration requirement is met, but the location requirement is not. Your logs will sit in Tokyo or another foreign region. One nuance worth knowing, because it cuts against our own interest in selling you a second system: CERT-In's May 2022 FAQ, at Q35, states logs may be stored outside India provided the obligation to produce them to CERT-In is met in reasonable time. So a strict reading of Direction (iv) and CERT-In's own clarification do not perfectly agree, and many Indian organisations close the gap by keeping their source logs on-premises anyway and treating the SIEM as a copy. The sector rules are where it turns clear-cut: IRDAI's 2023 guidelines take up the 180-day rule, and an insurer must say yes to a yes/no audit-annexure question on whether its ICT infrastructure logs reside in India. If that is you, use Data Exporter to maintain an in-India store, or choose a SIEM with an India region.

Question 4

How does Incident Command compare with Microsoft Sentinel and Splunk?

Accepted Answer

These are the two platforms Rapid7 most often loses to at the top end, and the comparison is genuinely situational rather than a matter of one being better. Microsoft Sentinel wins decisively if your estate is standardised on Microsoft 365 and Azure. First-party Microsoft logs — Entra ID sign-ins, Microsoft 365 audit, Defender XDR alerts — ingest free, which changes the economics materially for exactly the sources a SOC watches most. It has Azure regions in India, including Central India, which answers the residency question Rapid7 cannot. Against that, it is priced per gigabyte ingested, so noisy third-party sources such as firewalls and proxies are where the bill escalates, and the Azure portal experience retires on 31 March 2027 so a Defender-portal migration is work you must scope. Splunk wins large, complex, multi-vendor enterprises. SPL is the deepest search language in the category, the content and integration ecosystem is the largest, and it runs on-premises or in the cloud. It is also the most expensive option in the category by a wide margin, SOAR is a separate product, and an untuned Splunk is the most costly log archive in existence. It assumes you have engineers. Incident Command's argument against both is narrow but real: per-asset rather than per-gigabyte pricing, detection content Rapid7 writes and maintains, and a single agent shared with vulnerability management. If you have a detection-engineering function, buy Splunk. If you are a Microsoft shop with E5, buy Sentinel. If you are a mid-market team who needs working detections next month and a budget line that does not move, Incident Command is frequently the better answer — provided residency does not disqualify it. We sell all three.

Question 5

What are the real limitations I should know before buying?

Accepted Answer

Six, in the order they tend to matter. First, no India data region — covered above, and for many regulated Indian buyers this alone decides the question. Second, cloud-only. There is no on-premises deployment at any price, so an air-gap or on-premises mandate rules it out entirely; for that requirement look at Elastic Security, LogRhythm or Wazuh. Third, analytical depth. Gartner's cautions name the absence of supervised machine learning and custom deep-learning models. If your team wants to build sophisticated correlation logic, they will hit the ceiling. Fourth, the 200 custom detection rule cap. It is a default rather than a hard limit and can be raised on request, but ask for the higher limit in writing during negotiation rather than assuming. Fifth, reporting. Reports group by one field at a time, which sounds minor until an auditor asks for user and destination together and the answer is an Excel export. Test your actual required reports during the proof of concept. Sixth, the agent runs hot on high-event systems — busy database and application servers specifically — so test there rather than on a quiet desktop, and size Collectors on x86-64 hosts because ARM and Graviton are unsupported. One more thing that is not a limitation but is regularly misunderstood: Incident Command is a SIEM, not a managed service. Nobody at Rapid7 is watching your alerts unless you buy Managed Threat Complete. If overnight coverage is what you actually need, price that instead.

Question 6

Why buy Incident Command through TechBag?

Accepted Answer

The licence price is the same; what changes is the advice around it and the paperwork underneath it. We will tell you when not to buy it. We sell Splunk, Microsoft security, Elastic and Wazuh alongside Rapid7, so we have no incentive to push this when your E5 licences already make Sentinel cheaper, or when your mandate rules out a cloud-only SIEM. Given that residency is the single most common reason a Rapid7 SIEM deal fails in India, we establish that answer before you invest weeks in an evaluation rather than after. On pricing, this product is quote-only, so there is no list to benchmark against and a buyer negotiating one of these every three years is at a structural disadvantage. We negotiate the asset band, the tier and — critically — the renewal uplift, which Rapid7 states at around three percent a year but which customers commonly report at seven to ten percent when nobody fixed it contractually in advance. We also get the ingestion-allowance contradiction resolved in writing, because "unlimited ingestion" and a 0.5–0.8 TB monthly packaged allowance cannot both be true of your contract. Indian commercials: INR invoicing from an Indian entity, GST charged correctly and available as input credit, no foreign remittance and no Form 15CA/CB. And we size the proof of concept against your real estate — your noisiest database servers, your actual asset count — because agent behaviour and Collector sizing only show their true shape at your scale.

Dimension	Ingest-priced SIEM	Incident Command
Pricing axis	Per GB ingested — grows on its own	Per monitored asset — grows with the estate
Verbose logging	Every new source moves the invoice	The licence does not move
Detection content	Your engineers write and tune it	Rapid7 writes and maintains it
Useful alerts	After months of tuning	Within days, on maintained content
High-confidence alerts	Probabilistic, needs triage	Deception decoys that almost never misfire
Deployment	Cloud, on-prem or hybrid	Cloud only — no on-prem option
Honest caveat	—	200 custom-rule cap; no India region
Best fit	—	500–5,000 endpoints, no SIEM engineer

Dimension	Rapid7	Tenable	Qualys	CrowdStrike	Microsoft
Position	Mid-market platform: exposure, SIEM and MDR on one agent	The strongest scanner in the category	Cloud-native, lowest operational overhead	The endpoint and MDR benchmark	Near-free at the margin with E5
Pricing axis	Per monitored asset — not per GB ingested	Per asset, quote-led	Per asset, reported ~$199–250/yr	$25–45 per endpoint/month for Falcon Complete	Bundled into E5 licensing
Vulnerability management	InsightVM — published price, Active Risk scoring	219,000+ plugins, dedicated OT product	Cloud-native, native patching included	Exposure module if you already run Falcon	Weak on non-Microsoft OS and network devices
SIEM	Challenger in the 2025 MQ — not a Leader	Not a SIEM vendor	Not a SIEM vendor	Falcon Next-Gen SIEM	Sentinel — a Leader
MDR	Frost Radar Leader; VM and unlimited IR bundled in	Not an MDR vendor	Managed services available	Falcon Complete — the benchmark	Defender Experts
Deployment	SIEM and MDR cloud-only; InsightVM console is yours	Cloud or on-premises	Cloud-native only	Cloud-native only	Azure-hosted
India data residency	NO India region — InsightVM console is the exception	Region options; verify for your product	India platform, Pune-engineered	Verify per product	Azure India regions
The thing to plan around	No India region; agent mandatory; FY26 guided down	Priced above Rapid7 at most tiers	Support quality rated well; scanning less deep	The most expensive option here	Only economic if you already hold E5
Best fit	Mid-market wanting VM, SIEM and MDR from one vendor	Deepest scanning, or operational technology	Lowest operational overhead, native patching	Best-in-class endpoint and managed response	Microsoft-standardised estates with E5

Rapid7 Incident Command

The Rapid7 platform family

Quick facts

Understand SIEM economics before you buy it

What is it?

An ingest-priced SIEM vs Incident Command — the honest table

The five pieces of the platform

Rapid7 Agent

Collector

Insight Network Sensor

Insight Platform

Data Exporter

Twelve capabilities. Collect, detect, respond.

Third-party log ingestion

Agent telemetry

Suricata network monitoring

Cloud and SaaS event sources

User behaviour analytics

Attacker behaviour analytics

Maintained detection rules

Honeypots and honey credentials

Embedded threat intelligence

LEQL log search

Playbooks and SOAR

Agentic investigation workflows

Watch Rapid7 Incident Command in action

Rapid7 Incident Command

Rapid7 InsightIDR 3-Min Overview

Detections that work without a detection team.

Per-asset pricing makes the budget predictable

The detections work without a detection-engineering team

Deception delivers genuinely high-confidence alerts

One agent and one console across detection and vulnerabilities

The honest caveat: it will frustrate a sophisticated detection team

The honest positioning

The numbers behind the platform

What your Rapid7 Incident Command rollout looks like

Scoping and the residency check

Collector and agent deployment

Source onboarding and tuning

Operationalisation

The review scoreboard

Quick poll — what’s driving your evaluation?

Where everyone sits — the grids

TechBag Security-Platform Grid

Depth × Breadth

Rapid7 Incident Command vs the field

Does Rapid7 Incident Command fit you?

Choose Incident Command if…

Choose Splunk if…

Choose Microsoft Sentinel if…

Choose Elastic Security or Wazuh if…

Choose Managed Threat Complete if…

Assets or gigabytes — which meter suits you?

Three ways to consume it

Essentials

Advanced

Ultimate

Buy it for less — TechBag pricing beats list

Get an India-ready quote

The 8 questions to ask every SIEM vendor

Questions buyers ask

Ready to evaluate Rapid7 Incident Command?