Amazon GuardDuty vs. AWS CloudTrail

In a multi-account/multi-tenant environment, GuardDuty often alerts us to possible malicious traffic before it becomes an issue. The ability to automatically enable GuardDuty creates baseline security which is crucial when an account is first created. It also helps greatly in environments where other users are able to create resources as often GuardDuty alerts us to insecure resources we did not know about. It can however sometimes be a little overzealous with its assessments alerting on benign activity which then requires suppression rules.

Incentivized

Most probably it would be suitable for Finance industries, where security is at the head of the table. However, in our case for E-commerce, it's also quite suitable, since we have quite a significant amount of data and usage of AWS services. Especially with usage of AWS services, AWS CloudTrail comes into play as a heavy plus. For instance, troubleshooting any issues in AWS services is really nice. Therefore, it would be less appropriate with a small amount of AWS service usage and some basic web hosting.

Incentivized

• Monitors outgoing connections from AWS resources to known malicious hosts.
• Monitors incoming connection to AWS resources from known malicious hosts.
• Integrates with other centralized logging solutions.

Incentivized

• Logs details
• Easy implementation
• Great support

Incentivized

• Does not have the ability to add any custom monitors.

Incentivized

• Delay
• User interface, must send logs elsewhere to view them

Incentivized

For this specific functionality, I am not aware of any other product that can do what [AWS] Cloudtrail does. We did not evaluate any other products.

Incentivized

• GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.

Incentivized

• Saved us from purchasing and managing 3rd party solutions
• Satisfies Security/Governance requirements
• No upkeep/maintenance

Incentivized