AWS Security Hub vs. Grafana OnCall

I don't think there's yet a perfect tool in this category of security and incident aggregators, but AWS Security Hub is an excellent tool for having visibility into our overall security posture. It is a great aggregator for many AWS services but also for third party security tools with which it integrates really well.

Incentivized

One of the greatest drawback in any big companies is that different teams within an IT departments do not know what the others do. The worst case scenario is than Service Desk doesn't know where the issue resolution is and can not provide business with estimation recovery time as well as any update about the root cause of an issue. Grafana OnCall is the best tool that solved this misscolaboration in our company.

Incentivized

• Alerting
• Aggregation, organization and prioritization of security alerts and events
• Third party integration

Incentivized

• Interface and information visualization
• Escalations process with useful IF, ELSE alerting logic
• Simple integration with wide list of data sources and using of webhooks for non-supported sources.

Incentivized

• Not easy to read past data, especially once it moves into Glacier deep storage
• performance is somewhat sluggish ... other systems are much faster to analyze data
• Doesn't always provide a remediation solution or suggested fix like other 3rd party tools like Qualys.
• It's hard to get the initial configuration and enrollment completed as there's a lot of manual intervention for every configured rule that needs to be enabled
• alerts are often times delayed

Incentivized

• Incident Response & Management for Developers Team (as well as tracking of an issue resolution process)
• Users alerting of issues with production systems

Incentivized

AWS Security Hub is it's own unique program that I have used. I haven't used anything similar to it and it was worth it to try out. However, for those that want to keep for long, it will be very heavy in term of budget and resource that they have to provide.

Incentivized

Unlike Grafana OnCall tool Splunk On-Call solution looks more complicated and noticeably inferior in the visualization of the information presented (UI is not user friendly). Alerts re-route process looks totally illogical and you need some time to get with it. However Splunk On-Call looks more featurable out-of-box and has iOS and Android apps while Grafana OnCall provides a general dashboard apps only.

Incentivized

• Since we have started using this, we could notice a drop of security issues

Incentivized

• Reducing services downtime.
• Better users loyalty as a result of improving of intra-departments collaboration.
• Reducing the load of Service Desk.

Incentivized