Who does what
Provider
- Monitor and investigate contracted detections
- Execute configured containment and eligible remediation
- Provide remote incident response within scope
Your team
- Maintain agents, sources and permissions
- Handle detections outside managed coverage
- Complete remaining corrective work and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- SaaS Applications
Details
Service scope
Best for Teams wanting MDR, Rapid7 SIEM and vulnerability context in one workflow
Monitoring entitlement
Essential needs an add-on for third-party monitoring; Advanced includes two products and Ultimate four. The selected sources must be activated.
Response requirements
Active Response needs supported tools and permissions. The Rapid7 Agent remains required even when another EDR performs containment.
Remediation limits
Enabled Active Remediation targets eligible commodity-malware remnants after quarantine. Broader corrective work and recovery remain with you.
Full service analysis
Rapid7 Managed Threat Complete combines MDR on Rapid7 SIEM with exposure context, configured endpoint and account containment, and remote incident response. Enabled Active Remediation can remove eligible malware remnants. You maintain telemetry, permissions and excluded detections, and complete recovery and actions outside those workflows.
- Your team owns
- Deploying and maintaining agents, collectors, sources and response permissions
- Triaging custom or contextual detections outside managed coverage
- Responding to information requests, completing corrective actions and restoring business operations
Response beyond isolation
Active Remediation can remove eligible malware remnants after successful quarantine. It is a bounded workflow, not universal cleanup. Customers still implement other corrective actions and maintain the permissions and connectivity needed for execution.
Ingestion versus monitoring
A log source in Rapid7 SIEM is not automatically a managed detection source. Custom and contextual rules can stay with your team. Third-party alert monitoring is separately entitled, and selected products must be activated before SOC coverage starts.
Connected-tool workflow
The May 2026 service terms describe both in-SIEM third-party triage and configured bidirectional alert synchronization. Confirm the exact connector and enabled workflow; neither universal source-system closure nor universal one-way operation is a safe assumption.
Incident-response handover
Remote incident response covers eligible in-scope incidents. If you appoint another response firm, Rapid7 provides a structured handover and then returns to monitoring. Agree this process with your insurer and incident lead before a breach.
Pricing & contract
$73,000 / 12 months
300 assets AWS Marketplace starting contract. Advanced lists $111,000 and Ultimate $175,000, each starting at 500 assets. Confirm entitlements and private-offer terms.
AWS Marketplace · Essential starting contract for 300 assets
- Billing
- Per-asset, Tiered, Custom
Tradeoffs & buying questions
Strengths
-
Documented endpoint and account containment
Active Response documents direct endpoint and account containment.
-
Exposure context and remote incident response
The service combines exposure context with remote incident investigation.
-
Scoped public marketplace contract prices
Marketplace contracts provide scoped price and quantity examples.
Considerations
-
Coverage is narrower than all ingested SIEM data
Not all ingested data or custom detections receive SOC triage.
-
Third-party alerts require package entitlement
Third-party monitoring counts and activation vary by package.
-
Response depends on agents, permissions and connectivity
Containment and remediation require maintained agents, permissions and connectivity.
Ask before buying
- Which detection rules and third-party products will the SOC manage?
- Which response and remediation actions are enabled, and who handles failures?
- What package, asset count and additional services does the quote include?
Customer feedback
Customers value
-
July–August 2026 MDR reviewers on PeerSpot and AWS value validated investigations, incident context and analyst support
Reported concerns
-
August 2026 AWS customer accounts request more flexible dashboards, reports and detection rules
Integrations
Platform / SIEM
- Rapid7 SIEM (InsightIDR)
Endpoint
- Rapid7 Agent
- Microsoft Defender for Endpoint
- CrowdStrike Falcon
3 more integrations
- SentinelOne
- Carbon Black Cloud
- Cisco Secure Endpoint
Common questions
Does Rapid7 execute response actions?
Yes, with enabled and configured Active Response. Active Remediation can also remove eligible commodity-malware remnants after quarantine. Your team handles unsuccessful actions and work outside that scope.
Will the SOC investigate every alert in Rapid7 SIEM?
No. Managed coverage depends on rule category, source eligibility and package entitlements. Custom and contextual detections can require initial triage by your team.
What does the public price cover?
AWS Marketplace lists a 12-month Essential contract at $73,000, starting at 300 assets. Advanced and Ultimate start at 500 assets with different prices. Confirm package, add-ons and private-offer terms.
Company details
- Headquarters
- Boston, Massachusetts
- Founded
- 2000