AWS CloudTrail vs. Lacework

It is necessary to enable [AWS] Cloudtrail when using AWS in a production environment, otherwise you will not have any idea what is happening within your accounts. Third party monitoring applications will all require [AWS] CloudTrail to be enabled as well. I would not recommend it solely as a monitoring tool, to get the most out of it you must send the logs elsewhere. Either to Cloudwatch logs or a third party product.

Incentivized

Lacework is well suited for behavioral analysis. One thing to consider thought is in the early stages there will be quite a bit of noise generated by Lacework. There will be a higher volume alerts generated initially - until a good baseline is generated. Overall Lacework is good with alert handling - integration with Slack is good.

Incentivized

• API Log
• User activity tracking
• Real-time alerts

Incentivized

• Easy to set-up the agent in cloud workloads.
• Easy integration with ticketing and messaging tools.
• Detailed visibility of all our container workloads across multiple accounts.

Incentivized

• [In my experience] Cost can easily get out of control with multiple trails on full logging
• Logs can be difficult to decipher

Incentivized

• UI can be complicated and hard to know where to click to find information.
• Ability to create and manage cases or tickets from events that trigger.

I think in the end, CloudTrail has more features and you can dive deeper inside the logs so it depends on your usage and what you expect in the end to make the right choice, I would say that both tools are really useful and bring a lot of benefits to I.T. companies.

Incentivized

Compared to Sysdig Falco (the free open-source IDS), Lacework helps security teams by providing actionable alerts and a user-friendly interface that gives you an overview of all workloads being monitored, and detailed insights into these workloads if needed. Falco requires you to build your own integration and interface around it, including a mechanism to whitelist certain alerts. This made it harder for the security team to focus their time on potential intrusions.

Incentivized

• Allows us to investigate any strange api actions
• Increases security
• Audit trail of changes made in AWS

Incentivized

• Being a FinTech company, financial institutions who partner with us want to know that we are appropriately maintaining a Security, Risk and Compliance program that maintains a level of comfort for their vendor management. Lacework gives us the ability to monitor and maintain a level of security for our infrastructure that puts our partners at ease, reduces the revenue cycle for new partners and opens doors to the future.