I have used ELK Logstash previously. The main difference is ELK Logstash is we have to host it. I have not noticed any major differences between the two.

We were using CloudWatch before. One of our clients suggested we move to Rapid7. They were already using it, so they told us that Rapid7 was very good. So we moved to Rapid7. We didn't do much research when we moved to Rapid7.

We used to use SecureWorks as our MSSP for everything from end point protection to infrastructure monitoring. To say we weren't happy with them would be probably an understatement. We felt we were overpaying, and getting less than we should. What they tried to sell us on and say they could do, they couldn't. They said they could do true end to end correlation and visibility on all your assets, and that just didn't happen until we got Rapid7 and got their products. It was IDR, Ops and really combining the two. But even just Ops by itself gave us more visibility and better alerting than we had with SecureWorks.

One of the things I didn't like about them is that there was a lot of false positives. You would try to tune them, you'd try to work with their associates to try and get things customized to your environment, and it just never seemed to really work properly. Whereas with Ops and IDR and our other ones, we've been able to get it to a point where we don't have alert fatigue, and false positives. I don't really have to worry about that anymore, where it used to be kind of a headache.

SCCM. That product was not easy to use.

I had a previous solution, and I switched to Rapid7 insightOps due to management and costs.

We had Nagios and WhatsUp Exchange Monitor. We removed Nagios because the hidden costs were too high. We were quite happy with WhatsUp, mainly because we have a couple of very expert engineers. InsightOps is head and shoulders above the rest.