AWS GuardDuty vs Threat Stack Cloud Security Platform comparison

AWS GuardDuty vs. Threat Stack Cloud Security Platform

Download the complete report

Helped 814,763 peers since 2012

Categories and Ranking

SentinelOne Singularity Clo...

Featured Reviews

Andrew W

VP - Information Technology at a financial services firm with 201-500 employees

Aug 29, 2024

Tells us about vulnerabilities as well as their impact and helps to focus on real issues

Looking at all the different pieces, it has got everything we need. Some of the pieces we do not even use. For example, we do not have Kubernetes Security. We are not running any K8 clusters, so it is good for us. Overall, we find the solution to be fantastic. There can be additional education components. This may not be truly fair to them because of what the product is going for, but it would be great to see additional education for compliance. It is not a criticism of the tool per se, but anything to help non-development resources understand some of the complexities of the cloud is always appreciated. Any additional educational resources are always helpful for security teams, especially those without a development background.

Read full review

Betika Brandon

Cloud Engineer at Epsilon

May 21, 2024

Enhances the security of AWS infrastructures and applications, ensuring compliance with regulations like HIPAA

AWS GuardDuty helps by providing continuous threat detection and signaling potential threats. Its most valuable feature is continuous monitoring. The tool's integration with other AWS services has improved security. It provides continuous monitoring and intelligent threat detection, quickly signaling any issues. I would rate this improvement a seven out of ten. The solution's machine learning capabilities help identify threats by continuously collecting data such as IP addresses, user agents, API calls, and network traffic patterns. This data is used to train machine learning models, which can then identify normal activity patterns and detect variations that indicate security threats. AWS GuardDuty is crucial in identifying security threats in the AWS environment.

Read full review

Skyler Cain

Software Development Manager at Rent Dynamics

Sep 26, 2021

SecOps program for us, as a smaller company, is amazing; they know what to look for

They could give a few more insights into security groups and recommendations on how to be more effective. That's getting more into the AWS environment, specifically. I'm not sure if that's Threat Stack's plan or not, but I would like them to help us be efficient about how we're setting up security groups. They could recommend separation of VPCs and the like - really dig into our architecture. I haven't seen a whole lot of that and I think that's something that, right off the bat, could have made us smarter. Even as part of the SecOps Program, that could be helpful; a quick analysis. They're analyzing our whole infrastructure and saying, "You have one VPC and that doesn't make a lot of sense, that should be multiple VPCs and here's why." The architecture of the servers in whatever cloud-hosting provider you're on could be helpful. Other than that, they should continue to expand on their notifications and on what's a vulnerability. They do a great job of that and we want them to continue to do that. It would be cool, since the agent is already deployed and they know about the server, they know the IP address, and they know what vulnerability is there, for them to test the vulnerability and see if they can actually exploit it. Or, once we patch it, they could double-check that it can't be. I don't know how hard that would be to build. Thinking on it off the top off my head, it could be a little challenging but it could also be highly interesting. It would also be great if we could test a couple of other features like hammering a server with 100 login attempts and see what happens. Real test scenarios could be really helpful. That is probably more something close to what they do with the SOC 2 audit or the report. But more visualization of that, being able to test things out on our infrastructure to make sure we can or can't hit this box could be interesting.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Our organization is growing steadily, so our infrastructure is expanding, and we're managing more technical resources. Singularity Cloud Security helps us track our resources so that we don't get lost in the overwhelming volume of things and ensures we follow best practices. The solution gives us better visibility into our resources and enables faster resolution."

"PingSafe offers an intuitive user interface that lets us navigate quickly and easily."

"It has a user-friendly dashboard that I can access without any difficulty."

"It is scalable, stable, and can detect any threat on a machine. It uses artificial intelligence and can lock down any virus."

"The management console is highly intuitive to comprehend and operate."

"PingSafe can integrate all your cloud accounts and resources you create in the AWS account, We have set it up to scan the AWS transfer services, EC2, security groups, and GitHub."

"The UI is very good."

"Singularity Cloud Workload Security provides us with better security detection and more visibility. It is another resource that we can use to detect vulnerabilities in our company's systems. For example, it can help us detect new file processes that we are not familiar with, which could be used by attackers to exploit our systems. Singularity Cloud Workload Security can also help us diagnose and analyze data to determine whether it is malicious or not. Singularity Cloud Workload Security is like another pair of eyes that can help us protect our systems from cyberattacks."

More SentinelOne Singularity Cloud Security pros

"What we found most valuable in Amazon GuardDuty is its threat detection feature, especially because we were monitoring a huge number of AWS accounts, so we needed a solution that would monitor for any kind of malicious activity. The monitoring aspect of the solution was great because it gave us timely notifications if and when anything happened, and Amazon GuardDuty helped keep us on our toes to make sure we took action right away."

"The correlation back end is the solution's most valuable feature."

"It is a highly scalable solution since it is a service by AWS. Scalability-wise, I rate the solution a ten out of ten."

"With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavior or traffic patterns right away, which is great for staying on top of potential security risks."

"The solution will detect abnormalities in the AWS workload and alert us so that we can monitor and take action."

"The most valuable features are the single system for data collection and the alert mechanisms."

"The out-of-band malware detection from the EBS volumes. It's really cool. No agents or anything needed, it automatically finds and correlates based on malware."

"One of the advantages of cloud services is the ability to use them on demand. There's minimal installation involved; you can check the latest offerings and make new deployments while dismantling the previous ones. This approach keeps you ahead of potential services, showcasing the agility of AWS."

More AWS GuardDuty pros

"It has been quite helpful to have the daily alerts coming to my email, as well as the Sev 1 Alerts... We just went through a SOX audit and those were pivotal."

"With Threat Stack, we quickly identified some AWS accounts which had services that would potentially be exposed and were able to remediate them prior to release of products."

"The rules are really great. They give us more visibility and control over what's being triggered. There's a large set of rules that come out-of-the-box. We can customize them and we can create our own rules based on the traffic patterns that we see."

"Threat Stack has connectivity."

"There has been a measurable decrease in the meantime to remediation... because we have so many different tech verticals already collated in one place, our ability to respond is drastically different than it used to be."

"An important feature of this solution is monitoring. Specifically, container monitoring."

"It is scalable. It deploys easily with curl and yum."

"Every other security tool we've looked is good at containers, or at Kubernetes, is good at AWS, or at instance monitoring. But nobody is good at tying all of those things together, and that's really where Threat Stack shines."

More Threat Stack Cloud Security Platform pros

Cons

"There's an array of upcoming versions with numerous features to be incorporated into the roadmap. Customers particularly appreciate the service's emphasis on intensive security, especially the secret scanning aspect. During the proof of concept (POC) phase, the system is required to gather logs from the customer's environment. This process entails obtaining specific permissions, especially in terms of gateway access. While most permissions for POC are manageable, the need for various permissions may need improvement, especially in the context of security."

"I would like additional integrations."

"We are getting reports only in a predefined form. I would like to have customized reports so that I can see how many issues are open or closed today or in two weeks."

"PingSafe takes four to five hours to detect and highlight an issue, and that time should be reduced."

"A beneficial improvement for PingSafe would be integration with Jira, allowing for a more streamlined ticketing system."

"The main area for improvement I want to see is for the platform to become less resource-intensive. Right now, it can slow down processes on the machine, and it would be a massive improvement if it were more lightweight than it currently is."

"After closing an alert in Cloud Native Security, it still shows as unresolved."

"We had a glitch in PingSafe where it fed us false positives in the past."

More SentinelOne Singularity Cloud Security cons

"One improvement I would suggest for AWS GuardDuty is the ability to assign findings to specific users or groups, facilitating better communication and follow-up actions."

"AWS GuardDuty needs to be more customer-oriented."

"An improvement would be to have a mobile version where remote workers can log in and monitor and fix issues."

"The solution's user interface could be improved because it will help users to understand multiple options."

"Some of the pain points in Amazon GuardDuty was the cost. When compared to some of the other services, depending on how many we had to monitor, if we had a huge range of accounts, as our accounts increased, we had a cost factor that came into play. Sometimes there were issues, for example, with findings that came up, we wanted to add notes and there were issues back then where notes couldn't be entered properly. If we wanted to leave a note such as "Okay, we have assessed this and this is how we feel", or "This is a false positive", Amazon GuardDuty wasn't allowing us to do that. Even with the suppression of certain findings, there was some issue that we had faced at one time. Those were some of the pain points of the solution."

"I work in a bank, and it would be good if AWS GuardDuty could be integrated with other monitoring and detection tools we use."

"For me, I would say just the presentation of findings, like the dashboards and other stuff, could be improved a bit."

"Improvement-wise, Amazon GuardDuty should have an overall dashboard analytics function so we could see what's in the current environment, and then in addition to that, provide best practices and recommendations, particularly to provide some type of observability, and then figure out the login side of it, based on our current environment, in terms of what we're not monitoring and what we should monitor. The solution should also give us a sample code configuration to implement that added feature or feature request. What I'd like to see in the next release of Amazon GuardDuty are more security analytics, reporting, and monitoring. They should provide recommendations and additional options that answer questions such as "Hey, what can we see in our environment?", "What should we implement within the environment?", What's recommended?" We know that cost will always be associated with that, but Amazon GuardDuty should show us the increased costs or decreased costs if we implement it or don't implement it, and that would be a good feature request, particularly with all products within AWS, just for cloud products in general because there are times features are implemented, but once they're deployed, they don't tell you about costs that would be generated along with those features. After features are deployed, there should a summary of the costs that would be generated, and projected based on current usage, so they would give us the option to figure out how long we're going to use those features and the option to keep those on or turn those off. If more services were like that, a lot more people would use those on the cloud."

More AWS GuardDuty cons

"It shoots back a lot of alerts."

"The API - which has grown quite a bit, so we're still learning it and I can't say whether it still needs improvement - was an area that had been needing it."

"Some features do not work as expected."

"I would like further support of Windows endpoint agents or the introduction of support for Windows endpoint agents."

"The compliance and governance need improvement."

"The user interface can be a little bit clunky at times... There's a lot of information that needs to be waded through, and the UI just isn't great."

"The solution’s ability to consume alerts and data in third-party tools (via APIs and export into S3 buckets) is moderate. They have some work to do in that area... The API does not mimic the features of the UI as far as reporting and pulling data out go. There's a big discrepancy there."

"They could give a few more insights into security groups and recommendations on how to be more effective. That's getting more into the AWS environment, specifically. I'm not sure if that's Threat Stack's plan or not, but I would like them to help us be efficient about how we're setting up security groups. They could recommend separation of VPCs and the like - really dig into our architecture. I haven't seen a whole lot of that and I think that's something that, right off the bat, could have made us smarter."

More Threat Stack Cloud Security Platform cons

Pricing and Cost Advice

"We have an enterprise license. It is affordable. I'm not sure, but I think we pay 150,000 rupees per month."

"The pricing is fair. It is not inexpensive, and it is also not expensive. When managing a large organization, it is going to be costly, but it meets the business needs. In terms of what is out there on the market, it is fair and comparable to what I have seen, so I do not have any complaints about the cost"

"Its pricing was a little less than other providers."

"Singularity Cloud Workload Security's pricing is good."

"PingSafe is fairly priced."

"The features included in PingSafe justify its price point."

"Its pricing is okay. It is in line with what other providers were providing. It is not cheap. It is not expensive."

"I wasn't sure what to expect from the pricing, but I was pleasantly surprised to find that it was a little less than I thought."

More SentinelOne Singularity Cloud Security pricing and cost advice

"I have heard that the solution's price is quite high."

"We use a pay-as-you-use license, which is competitively priced in the market."

"The pricing model is pay as you go and is based on the number of events per month."

"GuardDuty only enables accounts in regions where you have an active workload. If there are places where you don't have an active workload, you wouldn't even enable them. That's one area where they could allow you to cut down your cost."

"I prefer to have something on demand for myself. That's why I haven't been paying for GuardDuty specifically. AWS provides a wide range of offerings, especially in the security area."

"On a scale of one to ten, where one is a high price, and ten is a low price, I rate the pricing a four or five, which is somewhere in the middle."

"I don't have all the details in terms of licensing for Amazon GuardDuty, but my organization does have a license set up for it."

"The platform is inexpensive."

More AWS GuardDuty pricing and cost advice

"Pricing seems to be in line with the market structure. It's fine."

"We find the licensing and pricing very easy to understand and a good value for the services provided."

"It came in cheaper than Trend Micro when we purchased it a few years ago."

"It is a cost-effective choice versus other solutions on the market."

"It is very expensive compared to some other products. The pricing is definitely high."

"What we're paying now is somewhere around $15 to $20 per agent per month, if I recall correctly. The other cost we have is SecOps."

"I'm happy with the amount that we spend for the product that we get and the overall service that we get. It's not cheap, but I'm still happy with the spend."

See which vendors are best for you

Use our free recommendation engine to learn which Cloud Workload Protection Platforms (CWPP) solutions are best for your needs.

See recommendations

814,763 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

19%

Financial Services Firm

16%

Manufacturing Company

10%

Insurance Company

Financial Services Firm

17%

Computer Software Company

16%

Manufacturing Company

Government

Computer Software Company

25%

Financial Services Firm

14%

Real Estate/Law Firm

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about PingSafe?

The dashboard gives me an overview of all the things happening in the product, making it one of the tool's best featu...

What is your experience regarding pricing and costs for PingSafe?

I am personally not taking care of the pricing part, but when we moved from CrowdStrike to Singularity Cloud Native S...

What needs improvement with PingSafe?

They can provide some kind of alert when a new type of risk is there. There can be a specific type of alert showing t...

What do you like most about Amazon GuardDuty?

With anomaly detection, active threat monitoring, and set correlation, GuardDuty alerts me to any unusual user behavi...

What is your experience regarding pricing and costs for Amazon GuardDuty?

The tool's licensing model is pay-as-you-go.

What needs improvement with Amazon GuardDuty?

The product needs to improve its cost-efficiency since it is expensive.

Wiz vs SentinelOne Singularity Cloud Security

Ask a question

Earn 20 points

Comparisons

Compared 32% of the time

Prisma Cloud by Palo Alto Networks vs SentinelOne Singularity Cloud Security

Compared 25% of the time

Orca Security vs SentinelOne Singularity Cloud Security

Compared 7% of the time

Microsoft Defender for Cloud vs SentinelOne Singularity Cloud Security

Compared 5% of the time

Aqua Cloud Security Platform vs SentinelOne Singularity Cloud Security

Compared 3% of the time

More SentinelOne Singularity Cloud Security Competitors

Microsoft Defender for Cloud vs AWS GuardDuty

Compared 50% of the time

CrowdStrike Falcon Cloud Security vs AWS GuardDuty

Compared 12% of the time

Wiz vs AWS GuardDuty

Compared 10% of the time

Prisma Cloud by Palo Alto Networks vs AWS GuardDuty

Compared 8% of the time

Orca Security vs AWS GuardDuty

Compared 1% of the time

More AWS GuardDuty Competitors

Darktrace vs Threat Stack Cloud Security Platform

Compared 30% of the time

Palo Alto Networks URL Filtering with PAN-DB vs Threat Stack Cloud Security Platform

Compared 23% of the time

BMC Helix Cloud Security vs Threat Stack Cloud Security Platform

Compared 23% of the time

Prisma Cloud by Palo Alto Networks vs Threat Stack Cloud Security Platform

Compared 23% of the time

More Threat Stack Cloud Security Platform Competitors

Product Reports

SentinelOne Singularity Cloud Security

Download SentinelOne Singularity Cloud Security product report

SentinelOne Singularity Cloud Security report

Download AWS GuardDuty product report

AWS GuardDuty

November 2024

Threat Stack Cloud Security Platform

Download Threat Stack Cloud Security Platform product report

Threat Stack Cloud Security Platform report

Also Known As

PingSafe

No data available

Threat Stack, CSP,

Learn More

SentinelOne

Amazon Web Services (AWS)

Video not available

Threat Stack

Overview

SentinelOne Singularity Cloud Security protects cloud workloads, offering advanced threat detection and automated response. It integrates seamlessly with cloud environments and secures containerized applications and virtual machines against vulnerabilities.

SentinelOne Singularity Cloud Security is renowned for its efficiency in mitigating threats in real-time. The platform integrates effortlessly with existing cloud environments, ensuring robust cloud security management with minimal manual intervention. Securing containerized applications and virtual machines, it excels in threat intelligence and endpoint protection. However, improvements are needed in performance during high workload periods, and more integrations with third-party tools and better documentation would be beneficial. Users often find the installation process complex, support response times slow, and the dashboard's navigation unintuitive.

What are the key features of SentinelOne Singularity Cloud Security?

Real-time Threat Detection: Identifies and mitigates threats as they occur.
Automated Response: Automatically responds to threats to minimize impact.
Ease of Deployment: Simple setup process with scalable options.
Machine Learning Insights: AI-driven insights enhance threat prevention.
Seamless Integration: Integrates with cloud environments for unified security management.

What are the primary benefits or ROI to expect from SentinelOne Singularity Cloud Security?

Enhanced Threat Mitigation: Improved security against real-time threats.
Reduced Manual Intervention: Automated processes save time and resources.
Scalability: Easily adapts to growing security requirements.
Centralized Management: Manage security across platforms from a single console.
Advanced Threat Intelligence: Provides in-depth analysis and protection.

In specific industries, SentinelOne Singularity Cloud Security is implemented to safeguard critical data and infrastructure. Organizations in finance, healthcare, and technology depend on its real-time threat detection and automated response to protect sensitive information. Its ability to secure containerized applications and virtual machines is particularly valuable in dynamic environments where rapid scaling is necessary.

Amazon Guard Duty is a continuous cloud security monitoring service that consistently monitors and administers several data sources. These include AWS CloudTrail data events for EKS (Elastic Kubernetes Service) audit logs, VPC (Virtual Private Cloud) flow logs, DNS (Domain Name System) logs, S3 (Simple Cloud Storage), and AWS CloudTrail event logs.

Amazon GuardDuty intuitively uses threat intelligence data - such as lists of malicious domains and IP addresses - and ML (machine learning) to quickly discover suspicious and problematic activity in a user's AWS ecosystem. Activities may include concerns such as interactions with malicious IP addresses or domains, exposed credentials usage, or changes and/or escalation of privileges.

GuardDuty is able to easily determine problematic AWS EC2 (Elastic Compute Cloud) instances delivering malware or mining bitcoin. It is also able to trace AWS account access history for evidence of destabilization. such as suspicious API calls resulting in changing password policies to minimize password strength or anomalous infrastructure deployments in new or different never-used regions.

GuardDuty will continually alert users regarding their AWS environment status and will send the security discoveries to the GuardDuty dashboard or Amazon CloudWatch events for users to view.

Users can access GuardDuty via:

AWS SDKs: Amazon provides users with several software development kits (SDKs) that are made up of libraries and sample code of numerous popular programming languages and platforms, such as Android, iOS, Java, .Net, Python, and Ruby. The SDKs make it easier to develop programmatic access to GuardDuty.
GuardDuty HTTPS API: This allows users to issue HTTPS requests directly to the service.
GuardDuty Console: This is a browser-based intuitive dashboard interface where users can access and use GuardDuty.

Amazon Elastic Kubernetes Service (Amazon EKS)

Kubernetes protection is an optional add-on in Amazon GuardDuty. This tool is able to discover malicious behavior and possible destabilization of an organization's Kubernetes clusters inside of Amazon Elastic Kubernetes Service (Amazon EKS).

When Amazon EKS is activated, GuardDuty will actively use various data sources to discover potential risks against Kubernetes API. When Kubernetes protection is enabled, GuardDuty uses optional data sources to detect threats against Kubernetes API.

Kubernetes audit logs are a Kubernetes feature that captures historical API activity from applications, the control plane, users, and endpoints. GuardDuty collates these logs from Amazon EKS to create Kubernetes discoveries for the organization's Amazon EKS assets; there is no need to store or turn on the logs.

As long as Kubernetes protection remains activated, GuardDuty will continuously dissect Kubernetes data sources from the Amazon EKS clusters to ensure no suspicious or anomalous behavior is taking place.

Amazon Simple Cloud Storage (S3) Protection

Amazon S3 allows Amazon GuardDuty to actively audit object-level API processes to discover possible security threats to data inside an organization's S3 buckets. GuardDuty continually audits risk to the organization’s S3 assets by carefully dissecting AWS CloudTrail management events and AWS CloudTrail S3 data events. These tools are continually auditing various CloudTrail management events for potential suspicious activities that affect S3 buckets, such as PutBucketReplication, DeleteBucket, ListBucket, and data events for S3 object-level API processes, such as PutObject, GetObject, ListObject, and DeleteObject.

Reviews from Real Users

“The most valuable features are the single system for data collection and the alert mechanisms. Prior to using GuardDuty, we had multiple systems to collect data and put it in a centralized location so we could look into it. Now we don't need to do that anymore as GuardDuty does it for us.” - Arunkumar A., Information Security Manager at Tata Consultancy Services

Threat Stack Cloud Security Platform is a CWPP (Cloud Workload Protection Platform) that provides your organization with comprehensive security for modern applications and APIs. It is designed specifically for monitoring cloud environments, vulnerabilities, covering workloads, infrastructure, and compliance. The solution offers application infrastructure protection for all layers of your infrastructure stack and delivers the necessary observability for proactive and targeted remediation action. In addition, it is platform-independent and easily adapts to various environments. Threat Stack Cloud Security Platform works best for companies who want real-time protection against active external threats and need to reduce alert investigation time. It is ideal for small, medium, or large-sized organizations.

Threat Stack Cloud Security Platform Features

Threat Stack Cloud Security Platform has many valuable key features. Some of the most useful ones include:

High-efficacy threat detection
App deployment speed
Increased visibility
Remediation integration
Security and compliance telemetry
Built-in and configurable rules
ML and advanced analytics
Integrations with third-party SecOps tools
File integrity monitoring
Host-based intrusion detection
Vulnerability assessment
Fully integrated IDS functionality
Real-time alerts and threat response

Threat Stack Cloud Security Platform Benefits

There are many benefits to implementing Threat Stack Cloud Security Platform. Some of the biggest advantages the solution offers include:

All-in-one solution: Because Threat Stack Cloud Security Platform offers everything you need in one solution, you don’t need to integrate multiple security solutions in the cloud or spend time manually tweaking the desired functionality.

Continuous proactive monitoring: Threat Stack Cloud Security Platform provides continuous proactive monitoring across your full infrastructure stack. It monitors your web application, can track risky behavior from the point of deployment, can scan your operating system, detect any unusual patterns in file hosting, and analyze other server events in real time.

Real-time protection: The solution offers protection from active intrusion attempts and gives you visibility into ongoing events on the server so you can discover data breaches before it’s too late.

Flexibility: The Threat Stack Cloud Security Platform is tailored to your server’s specific operating system deployment and remains accessible to you no matter how your infrastructure changes or scales over time.

Quick threat detection: Because Threat Stack Cloud Security Platform can quickly isolate problems, issues are less likely to cause damage and can be remediated faster.

Monitoring for reactive, proactive, and interactive threats: The solution is designed to detect even the most evasive discrepancies in your server events.

Reviews from Real Users

Below are some reviews and helpful feedback written by PeerSpot users currently using the Threat Stack Cloud Security Platform solution.

Skyler C., Software Development Manager at Rent Dynamics, says, “The most valuable feature is the SecOps because they have our back and they help us with the reports. We jump on calls monthly to set goals and roadmaps internally for how we can secure our platform more. Their SecOps program is absolutely amazing when you do not have a dedicated resource for security.”

An IT Engineer at a consultancy mentions, “The platform has a good threat and vulnerability manager with very helpful technical support. The scalability is great.”

Sample Customers

Information Not Available

autodesk, mapbox, fico, webroot

StatusPage.io, Walkbase, Spanning, DNAnexus, Jobcase, Nextcapital, Smartling, Veracode, 6sense

AWS GuardDuty vs. Threat Stack Cloud Security Platform