AWS GuardDuty Reviews

It's a malware detection service. It's an intelligent malware and security event detection service from AWS.

The out-of-band malware detection from the EBS volumes. It's really cool. No agents or anything needed, it automatically finds and correlates based on malware.

Cost changes. It's very expensive. If you turn on every feature, it's more than most commercial vendors. For smaller orgs, that doesn't make sense.

I have been using it for two years now. It is an offering in the AWS. 

It is a stable product. 

My company have five to six admins using this solution. 

The initial setup was easy. It was a one-click deployment.

For smaller organizations, it is not expensive. 

If you have a large organization or already have similar tools, it might not be necessary. But for most, GuardDuty is the go-to.

For me, I still use GuardDuty. I see a lot of good correlations built up by AWS support.

Don't add all the features at once. Go step-by-step, or you'll end up with a very high cost and turn off the system.

It can get very expensive. If you turn on every feature, it can turn into hundreds of thousands of dollars.

Overall, I would rate the solution an eight out of ten. 

We are only using it for a client's requirements; we are simply building it and selling it to the client.

Amazon GuardDuty is used on private infrastructure for our clients. The application is not publicly accessible; it is hosted internally.

GuardDuty has been used to set the CloudWatch alarms. Assume that both scans are detected, or something similar, we have just enabled CloudWatch alarms for those use cases so that any such use case is detected. The alert will be triggered, and we have configured and integrated Amazon GuardDuty with all of the other seven accounts to have the central HPU.

The correlation back end is the solution's most valuable feature. Like in the backend, it is collecting all the data, which I think is pretty interesting, and coordinating everything, which is another good thing.

While sending the alerts to the email, they are not being patched. we have to do the patching and mapping manually. If GuardDuty could include a feature to do this automatically, it will make our job easier. That is something I believe can be improved.

For example, suppose you want to know when an alert is sent to your mailbox. The information is in JSON format. It would be helpful if that could be sent to the mailbox in a human-readable format.

I believe it can be improved in a variety of ways. If we can build our own use cases instead of using Microsoft Sentinel alone, that would be ideal.

I have been using Amazon GuardDuty for two to three years.

I have used it for the last 12 months.

Amazon GuardDuty is a stable product.

Amazon GuardDuty is scalable.

We have not had any issues that required us to contact the GuardDuty AWS vendor. It's straightforward and effective.

The initial setup is straightforward. We simply click on the app, and that's it.

The deployment can be done in a few minutes. We don't have to spend a lot of time there. It will take some time, to integrate everything one by one, which is why we did it manually, otherwise everything else was straightforward.

Pricing is determined by the number of events sent. It's fine, and it's not a problem from our perspective.

My recommendation is to go for the master setup that will be beneficial to you.

There are some limitations where we cannot modify use cases to meet our needs; we must do additional work, such as setting up CloudWatch alarms and SNS, and things are not patched. There are some restrictions. I'll just suggest that you have some skilled resources with patching knowledge.

It's good, I would rate Amazon GuardDuty a seven out of ten.

We use the tool for threat detection. AWS includes AI features as well. AWS GuardDuty gives us reports. 

AWS GuardDuty needs to be more customer-oriented. 

I have been working with the tool for three years. 

The tool is stable. 

AWS GuardDuty is scalable. We used the tool bi-weekly. 

I have not contacted customer support yet. 

The tool's setup is easy. You don't need any additional learning or resources to do it. You just need to enable AWS GuardDuty. The tool's deployment got completed in two to three minutes. 

The tool has no subscription charges. 

AWS GuardDuty is automated and gives alerts whenever there is an intrusion. AWS has a SMS service and you can get notifications through it if you subscribe. We have not encountered any performance issues. I would rate the tool a nine out of ten. 

Amazon GuardDuty is an AWS Managed Service. The product finds information related to potential security risks and detects our environment related findings. It is a service that helps administrators find anomalies in their environment, rectify those issues and make the environment more secure and safe.

For example, consider some S3 buckets; we have X server access login disabled and certain configurations which are recommended that we are not following that are certain IAM user regulates such as monitoring from the background. Amazon GuardDuty will give us anomaly data for that particular IAM user, advising that certain activity was suspicious.

In our environment, the most valuable feature is discovering the anomalous sign users because we have configured single sign-on in our environment, but there are some IAM users. Since our environment is cloud-based and accessible from the internet, we like the ability to check where the user has logged in from and what kind of API calls that user is doing. Finding anything suspicious with AWS recommendations is helpful.

Amazon GuardDuty is limited to certain services. The solution has to be integrated with new services that AWS adds like QuickSight, Managed Airflow, AppFlow and MWAA. By being integrated with these services, it would be handy for users and save time.

I have been using Amazon GuardDuty for six months.

Amazon GuardDuty is service based not user-based. I can have a number of users in my system because the user management is turning the different services in AWS AIM direct access management.

We have four users of the solution. It is used by system administrators, cloud administrators, and architects. 

Amazon GuardDuty is an extra security measure. We have other security measures also implemented in our environment, such as our on-premise environment and network related securities. 

The initial setup of Amazon GuardDuty is fairly easy without much complexity.

Licensing of GuardDuty is part of the AWS license. The pricing model is pay as you go and is based on the number of events per month. When you first look at the price it seems reasonable but if you look at it holistically the cost can be improved.

At a very basic level, Amazon GuardDuty is a good tool. If you are looking for advanced security that would provide higher checks to secure their environment, this may not be enough. 

Certain checks only related to the AWS environment are good, but if you are integrated with other services like Salesforce or MuleSoft it is not a good solution.

I would rate GuardDuty a six out of 10 overall. 

We have over 1,000 employees, and we monitor their activity through AWS GuardDuty.

The solution's user interface could be improved because it will help users to understand multiple options. Currently, we have multiple options on AWS GuardDuty, which may confuse new users.

I have been using AWS GuardDuty for two years.

We faced some issues with AWS GuardDuty because sometimes we don't get proper loss from the solution.

I rate the solution an eight out of ten for stability.

I rate the solution ten out of ten for scalability.

The solution’s initial setup is not very difficult.

We have a whole bunch of information on various things in AWS GuardDuty.

Overall, I rate the solution a nine out of ten.

My company uses AWS GuardDuty to develop the software and provide services to clients. I use the solution to monitor the service on the AWS workload or AWS instance and monitor threats or vulnerabilities.

AWS GuardDuty is easy to use and configure. I use AWS GuardDuty to check whether we are under attack or not. The solution will detect abnormalities in the AWS workload and alert us so that we can monitor and take action.

I work in a bank, and it would be good if AWS GuardDuty could be integrated with other monitoring and detection tools we use. The operation team can use a single desktop to monitor.

I have been using AWS GuardDuty for less than one month.

In my department, around seven to eight users are using AWS GuardDuty.

I previously used Google Cloud for three to four years. AWS GuardDuty has more features and can be customized more than Google Cloud.

I have heard that the solution's price is quite high. Sometimes, they need to fine-tune the service on AWS. For example, Amazon Simple Storage Service (S3) is used for static content because it is cheaper.

Overall, I rate AWS GuardDuty an eight out of ten.