AWS CloudTrail vs. Forcepoint CASB

It is necessary to enable [AWS] Cloudtrail when using AWS in a production environment, otherwise you will not have any idea what is happening within your accounts. Third party monitoring applications will all require [AWS] CloudTrail to be enabled as well. I would not recommend it solely as a monitoring tool, to get the most out of it you must send the logs elsewhere. Either to Cloudwatch logs or a third party product.

Incentivized

It is appropriate for medium to large-scale enterprises, especially the ones that have remote employees. The live-monitoring feature is extremely useful in this case. However, the implementation and initial processing are headache-inducing so you definitely need a dedicated IT team. Be warned though, that not only is their interface quite complex, their customer service is also extremely unhelpful so you won't be able to implement this or tackle any issues without a skilled team. But if that isn't an issue, this is definitely worth a try!

Incentivized

• API Log
• User activity tracking
• Real-time alerts

Incentivized

• Integration with Forcepoint DLP.
• Excellent in monitoring shadow IT.
• Cloud Monitoring can be conducted.
• UEBA is excellent.

Incentivized

• [In my experience] Cost can easily get out of control with multiple trails on full logging
• Logs can be difficult to decipher

Incentivized

• Better reports
• Better technical support
• Better integration with other solutions as proxy and onpremise DLP
• Did I say better support?

Incentivized

The platform is really good but needs a lot of customization and effort. Need to build an AI platform that will help in customizations.

Incentivized

The expertise is highly lacking in the implementation side.

Incentivized

I think in the end, CloudTrail has more features and you can dive deeper inside the logs so it depends on your usage and what you expect in the end to make the right choice, I would say that both tools are really useful and bring a lot of benefits to I.T. companies.

Incentivized

The interface of both the softwares is complex, but Forcepoint is certainly more complicated. But once you get past that, it is quite smooth and offers a lot of amazing features. It is one of the best options for remote security, although I would love to see more features - like encryption. The one place where it truly lacks is customer service, and since it has such an intricate implementation procedure, this one carries a lot of weight and needs to be improved to make this software even more accessible.

Incentivized

• Allows us to investigate any strange api actions
• Increases security
• Audit trail of changes made in AWS

Incentivized

• We are working on strategies to understand what to do with the information that CASB gave to us, it would be good if Forcepoint gives us a few key points but they haven't.

Incentivized