# Wazuh vs Rapid7 InsightIDR: which do AI models recommend for SIEM, October 2026

IT AI Recommendation Index, October 2026 Edition, SIEM platforms. Zero of fourteen models named Wazuh first on the direct prompt; four named Rapid7 InsightIDR. Page: https://it-ai-index.com/security/siem-platforms/wazuh-vs-rapid7-insightidr/

| | First-choice share | Rank | Negative rate | Labels | Models naming it |
|---|---|---|---|---|---|
| Wazuh | 21% | #2 of 15 | 24% | 21 | 13 of 14 |
| Rapid7 InsightIDR | 17% | #3 of 15 | 6% | 34 | 14 of 14 |

## The direct prompt, model by model

- Claude Haiku 4.5: rapid7 insightidr first (first choices: Rapid7 InsightIDR) (alternatives: LogRhythm, ManageEngine Log360, Microsoft Sentinel)
- Perplexity Sonar: rapid7 insightidr first (first choices: Rapid7 InsightIDR) (alternatives: LogRhythm, ManageEngine Log360, Stellar Cyber Next-Gen SIEM)
- DeepSeek V4 Flash: rapid7 insightidr first (first choices: Microsoft Sentinel, Rapid7 InsightIDR) (alternatives: CrowdStrike Falcon Next-Gen SIEM, Elastic Security, Google Security Operations, Stellar Cyber Next-Gen SIEM)
- Muse Glimmer 30B: rapid7 insightidr first (first choices: Rapid7 InsightIDR, Sumo Logic Cloud SIEM) (alternatives: Elastic Security, ManageEngine Log360, Securonix Unified Defense SIEM)
- Gemini 3.5 Flash: neither first, one named (first choices: Blumira) (alternatives: Huntress Managed SIEM, Microsoft Sentinel, Rapid7 InsightIDR)
- Grok 4.1 Fast: neither first, one named (first choices: Microsoft Sentinel) (alternatives: LogRhythm NextGen, Rapid7 InsightIDR)
- Qwen 3.7 Flash: neither first, one named (first choices: LogRhythm) (alternatives: ManageEngine Log360, Microsoft Sentinel, Rapid7 InsightIDR, Sumo Logic Cloud SIEM)
- GLM 4.7 FlashX: neither first, one named (first choices: Microsoft Sentinel) (alternatives: Elastic Security, FortiSIEM, ManageEngine Log360, Rapid7 InsightIDR, Splunk Enterprise Security, Sumo Logic Cloud SIEM)
- GPT-6 Luna: neither first, one named (first choices: Microsoft Sentinel) (alternatives: Google Security Operations, Rapid7 InsightIDR)
- GPT-5.4 mini: neither named (first choices: Microsoft Sentinel) (alternatives: Google Security Operations, Splunk Enterprise Security)
- Mistral Small: neither named (first choices: Microsoft Sentinel) (alternatives: Exabeam, LogRhythm, Sumo Logic Cloud SIEM)
- Llama 4 Maverick: neither named
- Kimi K2: neither named (first choices: Microsoft Sentinel) (alternatives: LogRhythm, Sumo Logic Cloud SIEM)
- MiniMax M2.5: neither named (first choices: Microsoft Sentinel) (alternatives: Exabeam, LogRhythm)

## What the models said about Wazuh

- "Open-source self-build solutions (such as Wazuh or Graylog with custom rules) are generally not recommended unless you have at least two dedicated SIEM engineers" (Mistral Small, negative prompt, soft negative)
- "others advise skipping them depending on your needs, particularly for enterprise environments where robust support is critical" (MiniMax M2.5, negative prompt, soft negative)
- "Platforms like Elastic, Wazuh, and Security Onion are incredibly capable but demand significant engineering hours." (Gemini 3.5 Flash, negative prompt, soft negative)
- "If you have in-house engineering capacity and <50 GB/day ingest, Wazuh / Security Onion self-hosted is the lowest cash outlay." (Muse Glimmer 30B, budget prompt, first choice)
- "Wazuh is the most complete open-source SIEM available, combining SIEM and XDR capabilities with lightweight agents" (Claude Haiku 4.5, budget prompt, first choice)

## What the models said about Rapid7 InsightIDR

- "Avoid commercial SIEMs like Rapid7 InsightIDR ($2,500+/month)" (Kimi K2, budget prompt, hard negative)
- "eliminates cloud-only platforms such as ... Rapid7 Incident Command" (Perplexity Sonar, negative prompt, soft negative)
- "Rapid7 InsightIDR - Combines SIEM, UEBA, and SOAR capabilities in a single cloud-native platform with asset-based pricing that eliminates ingest anxiety" (Claude Haiku 4.5, direct prompt, first choice)
- ""Best for: Mid-sized organizations that want a cloud-native SIEM with integrated MDR capabilities, fast deployment and strong endpoint visibility"" (Muse Glimmer 30B, paraphrase prompt, first choice)
- "The Best All-Rounder: Rapid7 InsightIDR ... widely considered the best fit for mid-sized organizations" (Qwen 3.7 Flash, paraphrase prompt, first choice)

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category. Comparisons are drawn for the top eight products in each category. Published under CC BY 4.0; the output is the models' output, and nothing here is a recommendation by the index.