Name: Amazon GuardDuty
Rating: 9.9 (4 reviews)
Author: Amazon AWS

Help Desk

Web and Video Conferencing

Customer Support

Cross-Browser Testing

Development

Student Management

Education

Business Intelligence (BI)

Collaboration

Demand Planning

Enterprise Asset Management

Knowledge Management

Policy Management

Enterprise

Accounting

Invoicing

Finance and Accounting

Applicant Tracking

Corporate Learning Management

HR Management

Payroll

Talent Intelligence

Talent Management

Time Tracking

Workforce Analytics

Workforce Management

Human Resources

Cloud Cost Management

Cloud Management

Cloud Storage

Data Catalog

Data Center Networking

Data Center Outsourcing (USA)

Data Integration

Data Lakehouse

Embedded Database

Fraud Detection

Function as a Service (FaaS)

Integration Platform as a Service (iPaaS)

Managed IT Service

Mobile Identity

Network Attached Storage

Network Performance Monitoring

Observability

Output Management

Platform-as-a-Service (PaaS)

Rack Servers

Server Management

Tape Storage

Value Stream Management

WAN Optimization

Information Technology

A/B Testing

Account-Based Marketing (ABM)

Ad Serving & Retargeting

All-in-One Marketing

Click Fraud

Contact Management

Content Management

Data Cleansing

Email Marketing

Marketing Automation

Mobile Analytics

Product Sampling

Social Media Management

Survey & Forms Building

Web Analytics

Marketing

Project Management

Video Conferencing

Professional Services

Customer Relationship Management (CRM)

Predictive Sales Analytics

Sales

Database Security

GDPR Compliance

Security

Civil Engineering

Computer-Aided Manufacturing (CAM)

Laboratory Information Management

Lease Management

Legal Case Management

Spreadsheet

Vendor Neutral Archive (VNA)

eDiscovery

Vertical-Specific

medium

large

Microsoft Sentinel (formerly Azure Sentinel) is designed as a birds-eye view across the enterprise. It is presented as a security information and event management (SIEM) solution for proactive threat detection, investigation, and response.

Azure Sentinel

100 GB per day

200 GB per day

300 GB per day

400 GB per day

500 GB per day

More than 500 GB per day

Microsoft Sentinel

Security Information and Event Management (SIEM)

Centralized event and log data collection

Correlation

Event and log normalization/management

Deployment flexibility

Integration with Identity and Access Management Tools

Custom dashboards and workspaces

Host and network-based intrusion detection

Data integration/API management

Behavioral analytics and baselining

Rules-based and algorithmic detection thresholds

Response orchestration and automation

Reporting and compliance management

Incident indexing/searching

Log retention

Microsoft

AWS Trusted Advisor is an online tool that provides users real time guidance to help provision resources following AWS best practices. Trusted Advisor checks help optimize AWS infrastructure, increase security and performance, reduce overall costs, and monitor service limits. Whether establishing new workflows, developing applications, or as part of ongoing improvement, the recommendations provided by Trusted Advisor are designed to help keep solutions provisioned optimally.

AWS Trusted Advisor

Amazon AWS

Prisma Cloud, from Palo Alto Networks (based on technology acquired with Evident.io, or the Evident Security Platform) is presented as a comprehensive Cloud Native Security Platform (CNSP) that delivers full lifecycle security and full stack protection for multi- and hybrid-cloud environments. The solution is dedicated to reducing attack surface and checking for vulnerabilities against known or custom signatures of threats and provides daily risk reports, and also detects what users were responsible for risk and provides remediation suggestions.

Palo Alto Networks Prisma Cloud

Cloud-Native Application Protection Platforms

Aporeto Cider Security Evident.io Palo Alto Networks Prisma Cloud Redlock twistlock

Palo Alto Networks

small

Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) is a holistic, cloud delivered endpoint security solution that includes risk-based vulnerability management and assessment, attack surface reduction, behavioral based and cloud-powered next generation protection, endpoint detection and response (EDR), automatic investigation and remediation, managed hunting services, rich APIs, and unified security management.

Standalone

Academic

Microsoft Defender for Endpoint

Endpoint Security

Windows Defender Advanced Threat Protection

Anti-Exploit Technology

Endpoint Detection and Response (EDR)

Centralized Management

Hybrid Deployment Support

Infection Remediation

Vulnerability Management

Malware Detection

Hexadite Microsoft Defender ATP Microsoft Defender for Endpoint Windows Defender Advanced Threat Protection

Trend Micro Cloud One Workload Security (formerly Deep Security) is cloud security software suite, from Trend Micro, for hybrid cloud environments and virtualization security.

Trend Micro Cloud One - Workload Security

Cloud Computing Security

Deep Security Trend Micro Cloud One - Workload Security

Trend Micro

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of an AWS account. With CloudTrail, users can log, continuously monitor, and retain account activity related to actions across  AWS infrastructure. CloudTrail provides event history of AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. In addition, you can use CloudTrail to detect unusual activity in AWS accounts. These capabilities help simplify operational analysis and troubleshooting.

AWS CloudTrail

Lacework is a cloud-native application protection platform offered as-a-Service; delivering build-time to run-time threat detection, behavioral anomaly detection, and cloud compliance across multicloud environments, workloads, containers, and Kubernetes.

Lacework

Top Rated 2023

Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) for Azure, on-premises, and multicloud (Amazon AWS and Google GCP) resources.

Microsoft Defender for Cloud

Azure Security Center Microsoft Defender for Cloud

Alert Logic delivers managed detection and response (MDR) with comprehensive coverage for public clouds, SaaS, on-premises, and hybrid environments. Alert Logic is a HelpSystems brand since the 2022 acquisition announced in March.

Alert Logic Managed Detection and Response

Managed Detection and Response (MDR)

Alert Logic Alert Logic Managed Detection and Response Alert Logic Network Threat Detection Alert Logic Threat Manager

Fortra

CloudFront is the content delivery network (CDN) from Amazon Web Services.

First 10TB

Next 40TB

Next 100TB

Next 350TB

Next 524TB

Next 4PB

Over 5PB

Amazon CloudFront

Content Delivery Networks (CDN)

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads.

Amazon GuardDuty

Intrusion Detection Systems (synonymous with Intrusion Prevention Systems, or IPS) are designed to protect networks, endpoints, and companies from more advanced cyberthreats and attacks. The systems aim to repel intruders or, failing that, reduce attacker dwell time and minimize the potential for damage and data loss.

Intrusion Detection

Likelihood to Recommend

Amazon strives to be Earth's most customer-centric company where people can find and discover virtually anything they want to buy online. By giving customers more of what they want - low prices, vast selection, and convenience - Amazon continues to grow and evolve as a world-class e-commerce platform.

Founded by Jeff Bezos, the Amazon.com website started in 1995 as a place to buy books because of the unique customer experience the Web could offer book lovers. Bezos believed that only the Internet could offer customers the convenience of browsing a selection of millions of book titles in a single sitting. During the first 30 days of business, Amazon fulfilled orders for customers in 50 states and 45 countries - all shipped from his Seattle-area garage.

Amazon's evolution from Web site to e-commerce partner to development platform is driven by the spirit of innovation that is part of the company's DNA. The world's brightest technology minds come to Amazon.com to research and develop technology that improves the lives of shoppers and sellers around the world.

Reviews

TrustRadius is a technology and business research firm based in Austin, Texas. The company is known as a review platform for verified B2B technology and software reviews through a proprietary algorithm and human verification.

TrustRadius

Home

Intrusion Detection Systems

Azure App Service

Azure Blob Storage

Backblaze B2 Cloud Storage

We have a multi-tenant AWS environment with dozens of AWS account all managed under control tower. We use GuardDuty on every AWS account and it has been incredibly useful for monitoring the security of our AWS accounts.

Product Usage

Pros and Cons

Monitors outgoing connections from AWS resources to known malicious hosts.
Monitors incoming connection to AWS resources from known malicious hosts.
Integrates with other centralized logging solutions.

Things done well

Does not have the ability to add any custom monitors.

Things done poorly

In a multi-account/multi-tenant environment, GuardDuty often alerts us to possible malicious traffic before it becomes an issue.  The ability to automatically enable GuardDuty creates baseline security  which is crucial when an account is first created.   It also helps greatly in environments where other users are able to create resources as often GuardDuty alerts us to insecure resources we did not know about.  It can however sometimes be a little overzealous with its assessments alerting on benign activity which then requires suppression rules.

The automatic and AWS managed threat detection.
The ability to integrate with other centralized logging solutions.

Most Important Features 3.4.21

GuardDuty has helped us prevent possible security incidents multiple times which could have caused substantial damage.

Return on Investment

Azure App Service, Azure Blob Storage, Backblaze B2 Cloud Storage

Other Software Used

Senior System Administrator

Amazon GuardDuty 2022-05-13 08:51:46

Operating Systems	Unspecified
Mobile Application	No

Amazon GuardDuty

Overview

What is Amazon GuardDuty?

GuardDuty is a must have for AWS environments

Product Details

What is Amazon GuardDuty?

Amazon GuardDuty Technical Details

Comparisons

Compare with