5 Things We Love And Hate About AWS GuardDuty

LOVE

1. GuardDuty is not just a replacement for Snort or similar NIDS. GuardDuty analyzes network traffic via VPC Flow Logs but also digs deeper by inspecting AWS CloudTrail and Route53 logs as well.

2. GuardDuty has a very simple user interface that does not overwhelm even when dealing with tens of thousands of findings. However if you want to be able to see GuardDuty findings across multiple AWS accounts, you will need a platform like Cloudaware. Especially if you’re looking to make GuardDuty findings routable and actionable.

3. Ease of deployment and non-intrusiveness. Just like about everything else at AWS, GuardDuty is very easy to deploy. Pull our your credit card and flip the switch.

HATE

4. Fact that it is not free. I don’t understand why AWS is charging for this service. While Security Center from Microsoft Azure does not map directly to GuardDuty, it is pretty close and it is free. It should free and enabled by default. It took AWS almost 2 years to realize that CloudTrail should be enabled by default and we hoped that they have learned that lesson already.

5. Fact that it is not real-time. VPC Flow Logs and CloudTrail can be as much as 30 minutes behind what has actually happened in your account. While the delay itself is not so bad, it makes adding any kind of IPS functionality almost pointless. It like firing your air defense missles 30 minutes after a raid.

By the way here is a quick demo of Cloudaware integration with GuardDuty.

Find out more about Cloudaware here.