GuardDuty Customers! - Anyone with experience using partner GuardDuty threat lists?

Question

Our company is considering purchasing a partner threat list for GuardDuty to generate additional findings.  What has been others experience with that?  Is the default Amazon threat list good enough?  Have you found that your partner threat list adds too much noise and doesn't provide much real world value?  Does the partner threat list even do anything that Amazon doesn't already catch? Would you say that your purchase of the partner threat list has been worth it to your company?  What would you tell someone who is considering a partner threat list for GuardDuty?  Thanks.

Answer

Hello,

Thank you for contacting us! I understand that you have some questions related to partner GuardDuty threat list.

Please note that our default threat list is based from our internal security and partner information. Our current partners are Crowdstrike and Proofpoint.
The choice for a customer purchasing a threat list will be something they have to decide but note that GuardDuty regularly pulls in intelligence from partners and is very reliable.

Also, could you advise as to why are you looking to purchase an external threat intelligence as it will help us to understand if you are having an issue with GuardDuty or are just trying to add an extra layer of defence.

As always, feel free to reach back with any further questions or concerns. I will be happy to assist you.

GuardDuty Customers! - Anyone with experience using partner GuardDuty threat lists?

Relevant content