AWS Security Hub gives users a comprehensive view of your high-priority security alerts and security posture across AWS accounts. With Security Hub, users have a single place that aggregates, organizes, and prioritizes security alerts, or findings, from multiple AWS services, such as Amazon GuardDuty, Amazon Inspector, Amazon Macie, AWS Identity and Access Management (IAM) Access Analyzer, and AWS Firewall Manager, as well as from AWS Partner solutions.
N/A
OpsGenie
Score 7.8 out of 10
N/A
OpsGenie is an IT monitoring and incident response platform for development and operations teams, providing alerts and schedule management escalations. OpsGenie is now part of Atlassian since the late 2018 acquisition.
AWS Security Hub is mainly for protecting your software, video games, web application, etc... from external digital threats. This is a must for all software out there that can afford it. This also require a decent amount of resources to mitigate problems so that the monitoring page isn't overloaded. So overall, a large amount of budget and manpower is required to maintain this product.
Incident response is well suited to OpsGenie, and this is where it really shines—whether it's an outage, a security incident, or similar. My experience is mostly with security, and it offers a great audit trail. It minimises the need to cut and paste from different platforms when creating reports and ensures that what was said and what was done (along with any evidence) is persisted and reflected in the incident detail.
Not easy to read past data, especially once it moves into Glacier deep storage
performance is somewhat sluggish ... other systems are much faster to analyze data
Doesn't always provide a remediation solution or suggested fix like other 3rd party tools like Qualys.
It's hard to get the initial configuration and enrollment completed as there's a lot of manual intervention for every configured rule that needs to be enabled
OpsGenie New Jira design has made it difficult for those not familiar with that style.
OpsGenie could benefit from nested escalation flows for team schedules. Creating a product alert that uses and Tech Schedule as well as an Incident Manager Schedule that already exists would create less overhead and ease management.
AWS always good with usability and same here for AWS Security Hub. A lot of good documentation is available to read and configure your own. We also started with looking at the videos and documentation to configure automation for our compliance checks. And to configure there are very less steps to be followed which is a very good thing for faster configuration.
In general terms OpsGenie is a well done tool for solving the alert incident management, the usability is super ok during the configuration and during the alert. The main opportunity I found is the reporting and analytics section which is a little difficult to understand at a first sight and the refresh is not automatic, some little frictions but frictions at all
AWS stacks up very similarly to Splunk but being that it's an AWS tool it is better able to natively monitor our AWS footprint, unlike splunk which requires an appliance and / or forwarding agent for it to work properly. The same can be said about some other tools like Dynatrace. Dynatrace has a much more pleasant user interface that the senior management seems to like more, but AWS Security Hub has better options, a more straightforward rules engine and is less expensive than both Splunk and Dynatrace
We also looked at PagerDuty but decided to go with OpsGenie as it had more features on the plan we needed compared to PagerDuty which would have required us to spend a lot more for what we felt were non-premium features. Everything felt like an add-on - automation for an additional $20 a user per month seemed like a lot on top of the base plan
Helped us track bugs and issues that came up during product launch periods which reduced overhead that normally came with needing to manually contact the right team members
Prevented last minute breaking issues from falling through the cracks, decreased time to fix by automatically alerting the team members and allowing the product and project teams to easily see what active alerts are in progress
