3 ms·
Macie Analayzes a subset of CloudTrail, not all actions and is about historical behavior (though for high sev actions, it is more point in time) GuardDuty is l
by p0rkbelly 9y ago
Macie Analayzes a subset of CloudTrail, not all actions and is about historical behavior (though for high sev actions, it is more point in time)
GuardDuty is looking for specific threats/attacks and can combine multiple sources of telemetry for more advanced correlation. E.g. A combination of VPC Flows + CloudTrail + DNS that trigger an alert when formed together while a single CloudTrail event may not have.
- tptacek 9y agoWithin CT, what are examples of things Macie will catch, vs. things you'd need GD to catch? If GD weren't so expensive, I wouldn't really care that much. But GD is so expensive that it can be hard to recommend, which is especially weird since the pricing for Macie CT is so low --- even weirder when you note that the pricing for Macie S3 is so high!
- p0rkbelly 9y agoI found the pricing for Guard Duty reasonable compared to most IDS systems. They let you turn on GuardDuty for free for 30 days and give you an estimate your bill so that helps.