GuardDuty is a must have for AWS environments
Use Cases and Deployment Scope
We have a multi-tenant AWS environment with dozens of AWS account all managed under control tower. We use GuardDuty on every AWS account and it has been incredibly useful for monitoring the security of our AWS accounts.
Pros
- Monitors outgoing connections from AWS resources to known malicious hosts.
- Monitors incoming connection to AWS resources from known malicious hosts.
- Integrates with other centralized logging solutions.
Cons
- Does not have the ability to add any custom monitors.
Most Important Features
- The automatic and AWS managed threat detection.
- The ability to integrate with other centralized logging solutions.
Return on Investment
- GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.
Other Software Used
Azure App Service, Azure Blob Storage, Backblaze B2 Cloud Storage