AWS GuardDuty Reviews

The most valuable features of AWS GuardDuty, according to the reviews, include:

1. Discovers suspicious users and checks their login locations and API calls.

2. Collects and correlates all data on the back end.

3. Consumes multiple log sources, such as AWS CloudTrail and VPC Flow Logs, to analyze traffic for security anomalies.

4. Threat detection feature provides timely notifications and helps monitor for malicious activity.

5. Monitors AWS accounts across multiple accounts without additional costs.

6. Fulfills networking and auditing requirements by providing additional logs.

7. Provides threat response and remediation capabilities.

8. Serves as a single system for data collection and alerts.

• "AWS GuardDuty helps by providing continuous threat detection and signaling potential threats. Its most valuable feature is continuous monitoring. The tool's integration with other AWS services has improved security. It provides continuous monitoring and intelligent threat detection, quickly signaling any issues. I would rate this improvement a seven out of ten."
• "The product has automated protection powered by AI/ML, which is now far more powerful than before. It uses AI/ML in its detection algorithm, providing fast and quick results."
• "With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavior or traffic patterns right away, which is great for staying on top of potential security risks."

The reviews for AWS GuardDuty suggest several areas for improvement.

1. Integration with new services: Users express the need for GuardDuty to be integrated with additional services like QuickSight, Managed Airflow, AppFlow, and MWAA. This integration would save time and make it more convenient for users.

2. Automatic patching and mapping: The process of patching and mapping alerts sent to email is currently manual. Users would like GuardDuty to automate this process, making their job easier. They also suggest that alerts sent to the mailbox should be in a human-readable format instead of JSON.

3. Enhanced threat intelligence: Users feel that GuardDuty could be better enriched with threat intelligence data. They recommend leveraging the internal AWS threat intelligence team to stay up-to-date with new attacks, security vulnerabilities, and exploitations.

4. Cost management: Some users find the cost of GuardDuty to be a pain point, especially when monitoring a large number of accounts. 

5. Dashboard analytics and recommendations: Users desire an overall dashboard analytics function in GuardDuty that provides insights into the current environment. They also suggest the inclusion of best practices, recommendations, and sample code configurations for implementing new features. Additionally, they would like to see more security analytics, reporting, and monitoring, along with cost projections associated with new features.

6. Mobile version and visualization: Remote workers would benefit from a mobile version of GuardDuty for monitoring and fixing issues. Users also request a pane to visualize all seven layers of security in the next release.

• "The product needs to improve its cost-efficiency since it is expensive."
• "There is currently no consolidated dashboard for AWS GuardDuty. It would be helpful if they could provide a dashboard based on severity levels (high, medium, low) and offer insights account-wise, especially for users utilizing automation structures."
• "One improvement I would suggest for AWS GuardDuty is the ability to assign findings to specific users or groups, facilitating better communication and follow-up actions."