AWS CloudTrail vs. Microsoft Defender for Cloud Apps

It is necessary to enable [AWS] Cloudtrail when using AWS in a production environment, otherwise you will not have any idea what is happening within your accounts. Third party monitoring applications will all require [AWS] CloudTrail to be enabled as well. I would not recommend it solely as a monitoring tool, to get the most out of it you must send the logs elsewhere. Either to Cloudwatch logs or a third party product.

Incentivized

It is well suited if your team is working with Microsoft tools and Azure services. but if you are using other cloud service providers and don't want to spend efforts in learning integration with third-party software then this is not a great fit for you. overall we are very satisfied with the product. If your corporation with Microsoft tools then I would recommend it.

Incentivized

• API Log
• User activity tracking
• Real-time alerts

Incentivized

• Detect threats based on user activity logs.
• Set manual and automatic alert remediation.
• Implement activity policies.
• Detect threats based on user activity logs.

Incentivized

• [In my experience] Cost can easily get out of control with multiple trails on full logging
• Logs can be difficult to decipher

Incentivized

• In the event of Cloud traffic it is not easy to monitor and identify attacks.
• Difficult to protect unmatched Cloud devices.

Incentivized

I have not utilized actual support but the Sales and Product teams have been super helpful in moving our implementation forward and showing us the best practices.

Incentivized

I think in the end, CloudTrail has more features and you can dive deeper inside the logs so it depends on your usage and what you expect in the end to make the right choice, I would say that both tools are really useful and bring a lot of benefits to I.T. companies.

Incentivized

Microsoft Defender for Cloud Apps was chosen primarily due to its ability to work perfectly within our mostly M365 environment. Given that this was an added feature of our E5 license, we chose to dive into it and use it due to it's good visibility into user actions and the ability to tie all M365 actions together into one place. We did not see similar visibility with other tools that we vetted

Incentivized

• Allows us to investigate any strange api actions
• Increases security
• Audit trail of changes made in AWS

Incentivized

• Cloud App Security saves us thousands of dollars finding and rectifying apps security issues
• Identity Security Posture helps the organization identity stay in shape, saving thousands of dollars on security consultations
• The cost of suffering a breach cannot be quantified, CAS helps minimize the chances of the attackers succeeding, with excellent historical logging for most operations

Incentivized