Amazon GuardDuty vs. Azure Network Watcher

In a multi-account/multi-tenant environment, GuardDuty often alerts us to possible malicious traffic before it becomes an issue. The ability to automatically enable GuardDuty creates baseline security which is crucial when an account is first created. It also helps greatly in environments where other users are able to create resources as often GuardDuty alerts us to insecure resources we did not know about. It can however sometimes be a little overzealous with its assessments alerting on benign activity which then requires suppression rules.

Incentivized

Azure Network Watcher is well suited to monitor or diagnose logs for azure virtual network, managing connection/relationship between virtual networks. Diagnose network traffic, network traffic etc. Overall, it is appropriate to use in monitoring, diagnostic and logging activities for resources in azure virtual network. It is mainly used in infrastructure as a service component.

Incentivized

• Monitors outgoing connections from AWS resources to known malicious hosts.
• Monitors incoming connection to AWS resources from known malicious hosts.
• Integrates with other centralized logging solutions.

Incentivized

• View resources and theri relationship
• Diagnose network routing problems
• View security rules for a network interface

Incentivized

• Does not have the ability to add any custom monitors.

Incentivized

• More granular visualization through the Azure Network. Ex. Seeing NSG Flow through each Hop.
• Allow for more capabilities to view Connectivity through On-Premise Networks.

Incentivized

Azure Network Watcher can help with resources in the Cloud if this device is able to send traffic. We are using Azure Network Watcher in cases Solarwinds can't cover easily like API to load balancers & additional testing.

Incentivized

• GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.

Incentivized

• Positive impact as it helps in setting up critical alerts
• Monitoring network, hardware
• Customizable reports can be set which helps in business objective

Incentivized