AWS CloudTrail vs. Cisco TrustSec vs. VMware AppDefense (discontinued)

It is necessary to enable [AWS] Cloudtrail when using AWS in a production environment, otherwise you will not have any idea what is happening within your accounts. Third party monitoring applications will all require [AWS] CloudTrail to be enabled as well. I would not recommend it solely as a monitoring tool, to get the most out of it you must send the logs elsewhere. Either to Cloudwatch logs or a third party product.

Incentivized

• Control access to critical enterprise resources by business role, device type, and location, so policy changes can be made without redesigning the network.
• Easily manage access control and segmentation while maintaining compliance.
• Create and manage policies in an easy-to-use matrix.
• Reduce the need for costly network re-architecture by automating firewall rules and access control list (ACL) administration.

Incentivized

Being a VMware product, AppDefense has the advantage of compatibility with all of the VMware product feature updates and patches ( ESXi, NSX, vCenter, etc.). Paired with Carbon Black, it's resource overhead is well-tuned compared to traditional antivirus products.

Incentivized

• API Log
• User activity tracking
• Real-time alerts

Incentivized

• Reduce operational expenses by simplifying network segmentation and defining security groups based on business roles, not IP addresses.
• Limit the impact of a data breach by quickly isolating and containing threats using technology already in your network.

Incentivized

• I think that the AppDefense approach is clever and sets it apart from other products. Having a baseline of normal behavior that I can see is something I haven't seen in another product before.
• AppDefense doesn't overload my systems with performance draining agents.
• AppDefense integrates with VMWare products I have or plan to purchase.
• Access to AppDefense support has been better than any other VMWare products.

Incentivized

• [In my experience] Cost can easily get out of control with multiple trails on full logging
• Logs can be difficult to decipher

Incentivized

• Help and solutions if needed, support

Incentivized

• PowerShell functionality.
• Sorting results in some areas are not applicable.
• Email alerting through AppDefense Manager does not exist, but support has said it is a feature to come.

Incentivized

The product is still quite new, and there seems to be a lack of technical information available for both the E.U. and support staff. That being said, the support staff that I have worked with have always been very knowledgeable and ensure that they see a ticket through to completion.

Incentivized

I think in the end, CloudTrail has more features and you can dive deeper inside the logs so it depends on your usage and what you expect in the end to make the right choice, I would say that both tools are really useful and bring a lot of benefits to I.T. companies.

Incentivized

We have several security applications, but none exactly like VMware AppDefense. That is one of the reasons I like it, as it seems to take a different angle on monitoring and protection. The other apps monitor different things, but one thing AppDefense seems to have over them is a streamlined interface and not a lot of false positives.

Incentivized

• Allows us to investigate any strange api actions
• Increases security
• Audit trail of changes made in AWS

Incentivized

• Reduction in IT operational costs

Incentivized

• As with everything now, automation is key. AppDefense effectively monitors the activity on all our VMs, freeing administrators to work on more projects
• Makes it much easier to diagnose issues when system are not running as intended

Incentivized