Amazon GuardDuty vs. Palo Alto Networks Advanced URL Filtering

In a multi-account/multi-tenant environment, GuardDuty often alerts us to possible malicious traffic before it becomes an issue. The ability to automatically enable GuardDuty creates baseline security which is crucial when an account is first created. It also helps greatly in environments where other users are able to create resources as often GuardDuty alerts us to insecure resources we did not know about. It can however sometimes be a little overzealous with its assessments alerting on benign activity which then requires suppression rules.

Incentivized

Because of it's complexity, Palo may not be well suited for a small organization that may not have dedicated networking staff. But for a mid to large-sized enterprise, Palo shines.

Incentivized

• Monitors outgoing connections from AWS resources to known malicious hosts.
• Monitors incoming connection to AWS resources from known malicious hosts.
• Integrates with other centralized logging solutions.

Incentivized

• Threat Detection and Prevention (Malwares, Un-Authorized Access)
• Out of the box patterns for threat detection
• Built in and Updated identification patterns
• Unified Dashboard/Alerting on anomaly

Incentivized

• Does not have the ability to add any custom monitors.

Incentivized

• Steep learning curve
• The top-down URL filtering match can sometimes be tricky and requires some expertise in setting up the desired policy

Incentivized

Palo support is excellent, and I have never had to wait when contacting them for support. One of the best support teams in the business, in my opinion.

Incentivized

Palo Alto is a much much better product. detailed options and controls, more visibility, and usability. Better performance and durability.

Incentivized

• GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.

Incentivized

• We stopped to looking for external content filtering after acquiring PA URL Filtering
• The dynamic updates help us to mitigate security issues caused by BAD URLs
• Palo Alto Networks Advanced URL Filtering is helping us to achieve the high reliability of the Network

Incentivized