AWS GuardDuty Reviews

Name: AWS GuardDuty
Brand: Amazon Web Services (AWS)
Rating: 4.1 (22 reviews)

4.1 out of 5

22 reviews
91% willing to recommend

277 followers

What is AWS GuardDuty?

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

Get the AWS GuardDuty Buyer's Guide and find out what your peers are saying about AWS GuardDuty, Wiz, Prisma Cloud by Palo Alto Networks and more!

AWS GuardDuty is the #5 ranked solution in Cloud Workload Protection Platforms. PeerSpot users give AWS GuardDuty an average rating of 8.2 out of 10. Based on the analysis of the 22 most recent AWS GuardDuty reviews, the overall sentiment is positive, with a sentiment score of 7.9. (Among the highest in the category). AWS GuardDuty is most commonly compared to Wiz: AWS GuardDuty vs Wiz. AWS GuardDuty is popular among the large enterprise segment, accounting for 67% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 17% of all views.

Helped 823,875 peers since 2012

Featured reviews

Terence Dube

AWS Cloud Engineer at Standard Telephones and Cables

GuardDuty is limited to AWS environments. While incorporating Amazon Detective for detailed investigation can be useful, including more granular details in findings, such as specific user actions or historical comparisons, would be beneficial. Furthermore, managing global AWS environments requires setting up additional tools for viewing GuardDuty findings across multiple regions. A unified dashboard that aggregates findings across all regions without requiring manual aggregation could enhance convenience for users.

Read full review

Syeda Masarath Zaidi

DevOps Engineer at Cognizant

GuardDuty is extensive in terms of configuration and security compliance. It integrates with threat detection, offering end-to-end visibility. The best thing is that it notifies you immediately when something goes wrong, allowing quick response to threats. Our infrastructure is continuously monitored, safeguarding it against threats. Even internal threats are easy to identify. AWS monitors user behavior, which helps detect compromised credentials.

Read full review

Betika Brandon

Cloud Engineer at Epsilon

AWS GuardDuty helps by providing continuous threat detection and signaling potential threats. Its most valuable feature is continuous monitoring. The tool's integration with other AWS services has improved security. It provides continuous monitoring and intelligent threat detection, quickly signaling any issues. I would rate this improvement a seven out of ten. The solution's machine learning capabilities help identify threats by continuously collecting data such as IP addresses, user agents, API calls, and network traffic patterns. This data is used to train machine learning models, which can then identify normal activity patterns and detect variations that indicate security threats. AWS GuardDuty is crucial in identifying security threats in the AWS environment.

Read full review

AWS GuardDuty mindshare

As of December 2024, the mindshare of AWS GuardDuty in the Cloud Workload Protection Platforms (CWPP) category stands at 9.9%, down from 10.2% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Cloud Workload Protection Platforms (CWPP)

PeerAnalyst reports

Type	Title	Date
Category	Cloud Workload Protection Platforms (CWPP)	Dec 17, 2024	Download
Product	Reviews, tips, and advice from real users	Dec 17, 2024	Download
Comparison	AWS GuardDuty vs Prisma Cloud by Palo Alto Networks	Dec 17, 2024	Download
Comparison	AWS GuardDuty vs Wiz	Dec 17, 2024	Download
Comparison	AWS GuardDuty vs Microsoft Defender for Cloud	Dec 17, 2024	Download

Title	Rating	Mindshare	Recommending
Wiz	4.5	17.4%	100%	20 interviews Add to research
Prisma Cloud by Palo Alto Networks	4.2	15.9%	98%	108 interviews Add to research

Valuable Features

AWS GuardDuty offers valuable features such as centralized data collection, effective alert mechanisms, behavior analysis, and comprehensive threat detection. Users benefit from monitoring AWS accounts for malicious activity, leveraging logs like CloudTrail and VPC Flow Logs for security insights. It provides integrations, supports anomaly detection, uses machine learning for threat identification, protects S3 data events, and monitors EC2 instances. Its ease of use, cost-effectiveness, and continuous monitoring enhance AWS security.

"Overall, GuardDuty is a very easy-to-use tool, and I would recommend it even to those who are not tech-savvy."
"GuardDuty's comprehensive threat detection does not only monitor data - it also detects a wide range of security threats."
"GuardDuty is extensive in terms of configuration and security compliance."

Room for Improvement

AWS GuardDuty users suggest improvements such as a mobile version for remote access and better integration with other AWS services. More customer-focused features like automation, cost-efficiency, and enhanced threat intelligence are recommended. Users desire improved detection accuracy, insightful dashboards, and enhanced user interfaces. They also express a need for clearer cost projections and better technical support. Enhanced communication features, such as assigning findings to specific users, are also desired, along with better scalability for global environments.

"GuardDuty is limited to AWS environments."
"GuardDuty is limited to AWS environments."
"I would like to see more integration with other AWS provided services."

ROI

AWS GuardDuty offers a significant return on investment by providing threat detection and enhancing security posture. Its ability to detect threats early minimizes incidents and breaches, thus building customer trust and potentially attracting more business. Users express satisfaction with its performance in identifying and mitigating attacks. The improved response times due to quick notifications result in substantial time savings, showing its overall effectiveness in improving security and operational efficiency.

Pricing

AWS GuardDuty utilizes a pay-as-you-go pricing model, which many find competitively priced. Costs are generally based on data processed or events analyzed, starting around $1 per GB and decreasing with higher usage volumes. Licensing is integrated with AWS, and the service charges based on usage, allowing flexibility. While some view its pricing as high at larger scales, many smaller organizations find it manageable. Overall, its transparent, predictable model aligns with enterprise budgeting needs.

"The tool's licensing model is pay-as-you-go."
"80 percent of the customers are using AWS GuardDuty, and we recommend it due to its low cost, especially for small customers, ranging from five to ten dollars a month. In our policies, we enforce the usage of this service, making it a recommended practice for security."
"It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars."

Popular Use Cases

Organizations primarily use AWS GuardDuty for threat detection, monitoring cloud environments, and identifying anomalies such as suspicious activities, unauthorized access, and potential attacks. It aids in compliance by collecting logs and analyzing data sources like CloudTrail logs and VPC Flow Logs. AWS GuardDuty helps secure various AWS services by detecting vulnerabilities and providing actionable insights categorized by severity. It supports security teams to prioritize responses and monitors assets and workloads for abnormal activities and security risks.

Service and Support

AWS GuardDuty customer service and support receive mixed responses. Many find the support team responsive with quick resolutions, leveraging chat, phone, and web support. While the 24/7 availability is appreciated, occasional delays in phone support assignment are noted. Users rarely escalate issues, and enterprise plan users benefit from quicker service. Documentation is praised for clarity. Experiences vary due to inconsistencies in representative helpfulness, suggesting room for improvement despite a strong effort from AWS.

Deployment

AWS GuardDuty is generally easy to set up, often requiring just a few clicks. The setup process is quick, typically completed in a few minutes through AWS Management Console. Complexity might arise during integration with other systems or infrastructure as code. However, for most architectures, the deployment is straightforward and does not require extensive resources or training. Users find the tool intuitive, and it adapts well to rapid updates and changes within AWS environments.

Scalability

AWS GuardDuty receives positive feedback for its scalability, accommodating growing environments and increasing data volumes. It supports dynamic scaling across multiple accounts and adapts well to network changes. Despite initial challenges, it effectively meets scaling needs and is rated highly by users. Organizations benefit from its ability to handle numerous users without significant issues, making it adaptable for large and small firms. Its managed service nature eliminates concerns about infrastructure management.

Stability

AWS GuardDuty is praised for high stability, consistently operating without outages or significant performance issues. Many organizations successfully implement it within production environments, using it alongside Cloud Trail and CloudWatch for enhanced observability. Rated between eight and ten out of ten for stability, users appreciate its reliability. Some mention performance degradation and false positives, but these do not affect usability significantly. GuardDuty's machine learning-backed capabilities and responsive analytics further enhance stability perceptions.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our AWS GuardDuty Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

Government

Healthcare Company

Retailer

Insurance Company

Energy/Utilities Company

Comms Service Provider

University

Educational Organization

Media Company

Non Profit

Transportation Company

Construction Company

Real Estate/Law Firm

Legal Firm

Outsourcing Company

Recreational Facilities/Services Company

Wholesaler/Distributor

Pharma/Biotech Company

Performing Arts

Hospitality Company

Consumer Goods Company

Logistics Company

Marketing Services Firm

Sports Company

Compare AWS GuardDuty with alternative products

Learn more about AWS GuardDuty

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services