Datadog vs. Palo Alto Networks Advanced Threat Prevention

As per my experience, Datadog is best suited for complex, cloud-native environments where unified observability is critical, as it integrates seamlessly with AWS and Azure. Moreover, it provides deep visibility into latency and error rates. Datadog pricing is less appropriate for Startups with a tight budget and for organizations needing advanced incident management.

Incentivized

Palo Alto NTP is an appropriate suite of protection for any enterprise environment or anyone that truly needs some serious perimeter protection in a one-stop, all-in-one unit. There are no modules or add-ons or clunky interfaces to deal with it; everything works out of one management plane, licensing, implementation, monitoring. updating, etc. As a network admin, that is immensely valuable to me. Additionally, I get real-time reporting on all the stuff NTP is catching, and it is nothing to shirk at. The real value in NTP comes in only after you begin doing SSL-decryption, however, to truly inspect the traffic. Short of that, you are just seeing a bunch of encrypted data and the NTP suite of tools isn't going to avail you. NTP plus decryption, though, is invaluable!

Incentivized

• The thing which Datadog does really well, one of them are its broad range of services integrations and features which makes it one step observability solution for all. We can monitor all types of our application, infrastructure, hosts, databases etc with Datadog.
• Its custom dashboard feature which helps us to visualize the data in a better way . It supports different types of charts through those charts we can create our dashboard more attractive.
• Its AI powered alerting capability though that we can easily identify the root cause and also it has a low noise alerting capability which means it correlated the similar type of issues.

Incentivized

• The threat engine has constant updates for important threats.
• Wildfire helps supplement the Threat engine to help protect against 0 day threats.
• The way the threat engine can be added at different levels to different zones and policies helps to ensure business essential traffic can have policies that are tuned to ensure traffic will flow.

Incentivized

• In my experience, .NET Tracing Agent caused severe and untraceable performance issues
• In my opinion, usage and billing structures were opaque and surprising
• In my experience, documentation was incomplete, contradicting or sometimes completely wrong, even for common infrastructure (AWS Fargate)
• I feel support was unhelpful at times, and bounced us back and forth to other teams
• In my opinion, multiple methods of sample rate control were ineffective, adding to excessive usage and cost

Incentivized

• Cost is high, but it is a premium product
• Endpoints are still vulnerable.
• TAC engineers aren't always equipped with ATP knowledge

Incentivized

Definitely will not revisit after our issues and, in my opinion, poor support.

Incentivized

There are so many features that it can be hard to figure out where you need to go for your own use case. For example, RUM monitoring us buried in a "Digital Experience" sidebar setting when this is one of our key use cases that I sometimes struggle to find in the application. It appears that ECS + Fargate monitoring was recently released which is great because we had to build a lambda reporting solution for ephemeral task monitoring. But this new feature was never on my radar until I starting clicking around the application.

Incentivized

The reason to give ATP this rating is it specialises in detecting command control traffic whose primary role is to identify unusual outbound traffic patterns which blocks the command control communication and notifies to different security team to take necessary actions. ATP Global protect holds the responsibility of inspecting all the inbound and outbound traffic going to and from corporate system regardless of the network they are on. ATP plays a major role to identify the threats that blocks threats that could lead to data breach also it identifies any malicious file enter the system will be blocked proactively

Incentivized

The support team usually gets it right. We did have a rather complicate issue setting up monitoring on a domain controller. However, they are usually responsive and helpful over chat. The downside would be I don’t think they have any phone support. If that is important to you this might not be a good fit.

Incentivized

Documentation was difficult to work through, rollout was catastrophic (completely outage)

Incentivized

Our logs are very important, and Datadog manages them exceptionally well. We frequently use Datadog services for our investigations. Use case: Monitor your apps, infrastructure, APIs, and user experience.


Key features:


Logs, metrics, and APM (Application Performance Monitoring)


Real-time alerting and dashboards


Supports Kubernetes, AWS, GCP, and other integrations


RUM (Real User Monitoring) and Synthetics





✅ Best for backend, server, and distributed systems monitoring.

Incentivized

Having used Palo Alto Firewalls for years, implementing threat protection was the next step in perimeter security. Works much better than the few competitors I have personally used. Frequent content updates occur which may impact some policy rules, but that is normal across most vendors.

Incentivized

• Saved us (time & money) from developing our own monitoring utilities that would pale in comparison
• Alerts allow us to remedy issues before our customers even know about them
• Tracking resource usage over time allows us to better plan for future needs, before it becomes a pain-point.

Incentivized

• After adding PA Threat Protection, we are now getting our network traffic completely inspected.
• We are now applying security checks and scans like AV scan and Anti Spyware checks.
• This is also giving visibility into threat and attack vectors that are using vulnerabilities and exploits to enter our environment.

Incentivized