Rapid7 InsightConnect

We used rapid7 insight connect to connect our vuln management platform, insight M, to our Jira and Slack for ticket/project creation and notifications. I found both of the integrations as pre-built modules that I could customize for our environment so was able to get them up and working quickly and effectively. This enabled me to replicate and improve ticketing and alerting workflows that I had previously built in Tenable's Security Center platform by allowing for interaction with the vuln management tool from Slack. Now our devs and sysadmins could pull up device or application vuln info from Slack and would be notified via slack of changes to any devices or apps they owned, assuming they were being scanned by the vuln management tool.

• Integration
• Automation
• Ease of use

• The automation and integration we set up in the dev cycle helped us provide evidence in audits
• The automation and integration we set up in the dev cycle helped us fix vulns in our software prior to implementation thus increasing our security
• Automations save massive time and headache's between infosec and devs

Snyk, Splunk SOAR (Security Orchestration, Automation and Response) (formerly Phantom), Sensu, by Sumo Logic and SonarQube

Splunk Enterprise Security (ES), CrowdStrike Falcon Endpoint Protection, Splunk SOAR (Security Orchestration, Automation and Response) (formerly Phantom)

We use it to detect odd/bad behavior, to be able to respond and take action quickly<div>It's a wonderful tool to stop suspicious behavior or block it</div>

• Easy interface
• Quick detection of suspicious behavior
• Easy to fix problems
• Wonderful integration to set up monitoring

• Safer comoany
• Hippa compliant
• Secure network
• Secure web place

Sophos Rapid Response

Microsoft 365 (formerly Office 365), BeyondTrust Remote Support (formerly Bomgar), BitLocker Drive Encryption

In our environment Rapid7 InsightConnect is used our virus protection solution. We utilize it to monitor our technical landscape and reduce the risk of any virus attacks and patch vulnerabilities. With its scanning and automation features we are able to rely on it to uphold security in our IT environment and continue to improve our security posture with the many new vulnerabilities surfacing daily.

• Vulnerability scans.
• Real time monitoring against threats and other security deficiencies.
• Discovery scans to make sure any new devices in our environment get added to its protection policies.

• During quarterly security assessments we are able to use Rapid7's reporting to present how good or bad we are doing in our InfoSec department.
• It has allowed us to be scaleable in managing our virus protection as we are able configure the type of protection we want which saves us resources and money down the line.
• All of our endpoints remain secure and updated with the latest security definitions allowing us to focus on other aspects of the technical landscape.

CrowdStrike Falcon Endpoint Protection

VMware Carbon Black EDR, Amazon Web Services, Nortridge Loan System

Rapid7 Insight Connect is a very powerful and scalable vulnerability assessment tool that allows us to perform a thorough network scan. Deep scanning of our network, including the cloud and virtualized infrastructure, allows us to identify threats at all points and in all three of these environments. The most important aspect of this system is that it eliminates all of our weaknesses.

• Easy learning
• Secure portfolio tools
• Internal/operational efficiencies should be created.

• Scans for newer vulnerabilities require additional support due to the increased risk posed by long dwell times.
• Violations stopped at 4% per month and growing.
• Compatibility with networks that may improve in the future.

We use Rapid7 InsightConnect to automate various aspects of security in our IT department. We don't have the staff to constantly monitor everything 24/7. This has given us the ability to identify and remedy various malware attacks, along with automating the process after hours. Phishing emails have been reduced to a minimum as well.

• Email scanning for phishing attempts.
• Checking for vulnerabilities through plugins.
• Ability to isolate/resolve issues with no user intervention.

• Cost was higher than the competitors, but worth it
• No need to hire additional staff to maintain it
• We haven't been hit with ransomware as a result

Splunk SOAR (Security Orchestration, Automation and Response) (formerly Phantom) and Palo Alto Networks Cortex XSOAR (formerly Demisto)

Windows Server, Microsoft Azure Active Directory, Meditech Expanse Population Health