Shane

Lewis

Yes.

Rapid7 InsightIDR (the SIEM underpinning MTC Advanced) can ingest and correlate data from CrowdStrike, Mimecast, and Netskope via native event sources, and it can ingest Graylog output via syslog/CEF (Graylog forwards to a Rapid7 Collector)

Yes.

Rapid7 InsightIDR (which powers MTC Advanced) can enrich alerts with threat intelligence and contextual data, and it can also leverage telemetry from integrated platforms like CrowdStrike, Mimecast, Netskope, and Graylog.

Here’s how:

Threat Intelligence Enrichment

Rapid7 Threat Intelligence Feed:

InsightIDR automatically applies Rapid7’s curated threat intelligence to alerts, including indicators of compromise (IOCs), attacker TTPs, and behavioural analytics.

Third-Party Intelligence:

You can ingest external threat feeds (STIX/TAXII, custom lists) and apply them to detection rules for enrichment.

Contextual Data from Integrated Platforms:

CrowdStrike:

Endpoint telemetry (process, hash, user context) and Falcon detections are correlated with InsightIDR’s user and asset data. This adds device-level context to alerts.

Mimecast:

Email security events (URL clicks, attachment scans, impersonation attempts) enrich user activity timelines and phishing investigations.

Netskope:

Cloud app usage and web proxy logs provide context for risky SaaS behaviour and data exfiltration alerts.

Graylog:

Any log forwarded via syslog/CEF can be normalized and attributed to users/assets, adding depth to investigations.

Rapid7 InsightIDR (and the MTC Advanced service built on it) uses a combination of analytics, automation, and human expertise to prioritize alerts and minimize false positives.

Here is how:

Behavioral Analytics & Attacker Methodology:

Alerts are based on MITRE ATT&CK-aligned detection rules and behavioral patterns rather than simple signatures.

This reduces noise from benign activity and focuses on tactics, techniques, and procedures (TTPs) that indicate real compromise.

User & Asset Attribution:

InsightIDR correlates logs from multiple sources (endpoint, network, email, cloud) and ties them to specific users and assets.

This context helps distinguish legitimate activity from suspicious behaviour, reducing false positives.

Threat Intelligence Enrichment:

Rapid7 applies curated threat intelligence to alerts, scoring indicators based on global prevalence and known malicious associations.

High-confidence IOCs and patterns are prioritized, while low-confidence signals are suppressed or flagged for review.

Alert Scoring & Prioritization:

Alerts are ranked by severity, confidence, and impact:

Critical: Active attacker behaviour or confirmed compromise.

High: Strong indicators of malicious activity.

Medium/Low: Requires additional context or investigation.

SOC analysts review and validate high-severity alerts before escalation.

Machine Learning & Baseline Modelling:

InsightIDR builds baselines for normal user and asset behaviour.

Deviations (e.g., unusual logins, privilege escalation) trigger alerts only when statistically significant, reducing false positives.

SOC Analyst Triage:

In MTC Advanced, Rapid7’s 24x7 SOC team manually validates alerts before notifying you.

They combine automated scoring with human judgment, ensuring only actionable incidents reach your team.

Custom Detection Tuning:

You can adjust detection rules, whitelist known safe behaviours, and create custom alerts tailored to your environment.

Rapid7 & blueAPACHE advisors help fine-tune these rules during onboarding and posture reviews.

The Rapid7 Service we offer would replace the Greylog SIEM as the Rapid7 solution is underpinned by the IDR SIEM. blueAPACHE cannot provide SOC services on a Greylog based SIEM but can assist in an uplift to a highly supported Enterprise Grade SIEM.

If you wish to keep Greylog, we will have the solutions coexist as follows:

1. Forward from Graylog → Rapid7 Collector using syslog/CEF on dedicated ports. InsightIDR then normalizes, attributes (user/asset), and correlates across endpoint, network, email, and cloud sources.

2. Benefit: keep current Graylog dashboards while gaining Rapid7 MDR SOC, behavioural detections, and 13‑month searchable retention in InsightIDR.

Typical adds core attribution sources (AD/LDAP, DHCP/DNS/VPN/Firewall) to improve correlation efficacy inside InsightIDR.