Amazon GuardDuty vs. Datadog

In a multi-account/multi-tenant environment, GuardDuty often alerts us to possible malicious traffic before it becomes an issue. The ability to automatically enable GuardDuty creates baseline security which is crucial when an account is first created. It also helps greatly in environments where other users are able to create resources as often GuardDuty alerts us to insecure resources we did not know about. It can however sometimes be a little overzealous with its assessments alerting on benign activity which then requires suppression rules.

Incentivized

A one-stop solution for everything you need. Multiple functionalities are tailored to meet specific business needs. Logs are essential for any business, and Datadog manages logs effectively. Rum sessions are something new to me and have given us a new perspective on how to reverse engineer issues that we see for our customers.

Incentivized

• Monitors outgoing connections from AWS resources to known malicious hosts.
• Monitors incoming connection to AWS resources from known malicious hosts.
• Integrates with other centralized logging solutions.

Incentivized

• Create Dashboards as per application, environments, and Custom metrics in one panel.
• Log aggregation, one-stop Application monitoring tools for the whole infrastructure.
• Playbooks, SLA definition, success and error quotas, request visualizations.
• DB monitoring, Serverless stack monitoring.
• Alerting of Production incidents so we can quickly resolve the issues on time.

Incentivized

• Does not have the ability to add any custom monitors.

Incentivized

• Alert windows cause lag in notifications (e.g. if the alert window is X errors in 1 hour, we won't get alerted until the end of the 1 hour range)
• I would appreciate more supportive examples for how to filter and view metrics in the explorer
• I would like a more clear interface for metrics that are missing in a time frame, rather than only showing tags/etc. for metrics that were collected within the currently viewed time frame

Incentivized

Datadog's user interface is quite friendly and easy to navigate. With menus clearly categorized, and ability to bookmark important dashboards, one can easily find what they're looking for. For dashboards, ability to move and resize visualizations and group them, is really helpful to organize dashboards. Automatic suggestions from Datadog for important visualizations based on the metrics and logs would provide another level of ease of use.

Incentivized

The support team usually gets it right. We did have a rather complicate issue setting up monitoring on a domain controller. However, they are usually responsive and helpful over chat. The downside would be I don’t think they have any phone support. If that is important to you this might not be a good fit.

Incentivized

I selected Datadog because of its features and the wide range of integration support. As I already told it supports more that 600+ integrations which helps and organization to keep everything in a single place and also its AI feature which is reducing the time for root cause analysis. Its custom dashboards features which helps us to visualize the data in a more attractive way.

Incentivized

• GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.

Incentivized

• Saved us (time & money) from developing our own monitoring utilities that would pale in comparison
• Alerts allow us to remedy issues before our customers even know about them
• Tracking resource usage over time allows us to better plan for future needs, before it becomes a pain-point.

Incentivized