Amazon GuardDuty vs. Trend Micro TippingPoint

In a multi-account/multi-tenant environment, GuardDuty often alerts us to possible malicious traffic before it becomes an issue. The ability to automatically enable GuardDuty creates baseline security which is crucial when an account is first created. It also helps greatly in environments where other users are able to create resources as often GuardDuty alerts us to insecure resources we did not know about. It can however sometimes be a little overzealous with its assessments alerting on benign activity which then requires suppression rules.

Incentivized

Great for large enterprises 10k users or more and as part of defense in depth. Medium and small business you are better off looking for a cheaper UTM solution that does it all in one. It comes down to cost, are you willing to fund the cost of breaking out IPS functionality or moving towards a unified solution?

Incentivized

• Monitors outgoing connections from AWS resources to known malicious hosts.
• Monitors incoming connection to AWS resources from known malicious hosts.
• Integrates with other centralized logging solutions.

Incentivized

• Tipping point had a very nice GUI interface that sat on top of snort rules. It was easy to access, had nice customization of dashboards and output to syslog for SIEM solutions.
• It was easy to configure rule sets, allow groups or singular allow/blocks or white-listing.
• Security rule sets could be tweaked up or down and allow/drops signatures could be configured to help increase performance.

Incentivized

• Does not have the ability to add any custom monitors.

Incentivized

• Biggest qualms I had with TippingPoint was that it was just a tad on the expensive side for what you get. Nowadays everything has gone UTM in firewalls and they do it all including IPS as part of the basic functionality so really, TP is losing a massive market share.
• Don't see a future in the roadmap with so many other vendors getting onto the "unified" wagon and adding IPS as part of their service and at a cheaper price.

Incentivized

Most other firewall UTM solutions, Cisco, Palo Alto, Fidelis, etc.

Incentivized

• GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.

Incentivized

• Negative cash flow, positive addition to our defense in depth strategy at one of the largest healthcare organizations in Georgia (at that time).

Incentivized