Need advice about which tool to choose?Ask the StackShare community!

Changefeed

1
5
+ 1
0
Splunk Cloud

167
438
+ 1
15
Add tool

Splunk Cloud vs Changefeed: What are the differences?

Splunk Cloud: Easy and fast way to analyze valuable machine data with the convenience of software as a service (SaaS). If you're looking for all the benefits of Splunk® Enterprise with all the benefits of software-as-a-service, then look no further. Splunk Cloud is backed by a 100% uptime SLA, scales to over 10TB/day, and offers a highly secure environment; Changefeed: A beautiful changelog for your product in seconds. It makes it easy to keep and manage a changelog for your products. Keep your users up to date and engaged with every update your team ships.

Splunk Cloud belongs to "Log Management" category of the tech stack, while Changefeed can be primarily classified under "Engagement/Lifecycle Marketing".

Some of the features offered by Splunk Cloud are:

  • Splunk Cloud delivers all the features of award-winning Splunk® Enterprise, as a cloud-based service. The platform provides access to various apps and enables centralized visibility across cloud, hybrid and on-premises environments
  • Instant: Instant trial and instant conversion from POC to production
  • Secure: Completed SOC2 Type 2 Attestation*. Dedicated cloud environments for each customer

On the other hand, Changefeed provides the following key features:

  • Quickly compile updates
  • Manage all your changelogs
  • Built-in newsletter support
Advice on Changefeed and Splunk Cloud
Jigar Shah
Security Software Engineer at Pinterest · | 8 upvotes · 163.3K views

We would like to detect unusual config changes that can potentially cause production outage.

Such as, SecurityGroup new allow/deny rule, AuthZ policy change, Secret key/certificate rotation, IP subnet add/drop. The problem is the source of all of these activities is different, i.e., AWS IAM, Amazon EC2, internal prod services, envoy sidecar, etc.

Which of the technology would be best suitable to detect only IMP events (not all activity) from various sources all workload running on AWS and also Splunk Cloud?

See more
Replies (5)
Nati Abebe
Recommends
on
AWS ConfigAWS Config

For continuous monitoring and detecting unusual configuration changes, I would suggest you look into AWS Config.

AWS Config enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. Here is a list of supported AWS resources types and resource relationships with AWS Config https://docs.aws.amazon.com/config/latest/developerguide/resource-config-reference.html

Also as of Nov, 2019 - AWS Config launches support for third-party resources. You can now publish the configuration of third-party resources, such as GitHub repositories, Microsoft Active Directory resources, or any on-premises server into AWS Config using the new API. Here is more detail: https://docs.aws.amazon.com/config/latest/developerguide/customresources.html

If you have multiple AWS Account in your organization and want to detect changes there: https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

Lastly, if you already use Splunk Cloud in your enterprise and are looking for a consolidated view then, AWS Config is supported by Splunk Cloud as per their documentation too. https://aws.amazon.com/marketplace/pp/Splunk-Inc-Splunk-Cloud/B06XK299KV https://aws.amazon.com/marketplace/pp/Splunk-Inc-Splunk-Cloud/B06XK299KV

See more
Isaac Povey
Casual Software Engineer at Skedulo · | 6 upvotes · 72.5K views
Recommends
on
TerraformTerraform

While it won't detect events as they happen a good stop gap would be to define your infrastructure config using terraform. You can then periodically run the terraform config against your environment and alert if there are any changes.

See more
Matthew Rothstein
Recommends
on
Security MonkeySecurity Monkey

Consider using a combination of Netflix Security Monkey and AWS Guard Duty.

You can achieve automated detection and alerting, as well as automated recovery based on policies with these tools.

For instance, you could detect SecurityGroup rule changes that allow unrestricted egress from EC2 instances and then revert those changes automatically.

It's unclear from your post whether you want to detect events within the Splunk Cloud infrastructure or if you want to detect events indicated in data going to Splunk using the Splunk capabilities. If the latter, then Splunk has extremely rich capabilities in their query language and integrated alerting functions. With Splunk you can also run arbitrary Python scripts in response to certain events, so what you can't analyze and alert on with native functionality or plugins, you could write code to achieve.

See more
Vijayanand Narayanasharma
DevOps/TechOps Consultant at Qantas Loyalty · | 3 upvotes · 63.5K views
Recommends
on
AWS CloudTrailAWS CloudTrail

Well there are clear advantages of using either tools, it all boils down to what exactly are you trying to achieve with this i.e do you want to proactive monitoring or do you want debug an incident/issue. Splunk definitely is superior in terms of proactively monitoring your logs for unusal events, but getting the cloudtrail logs across to splunk would require some not so straight forward setup (Splunk has a blueprint for this setup which uses AWS kinesis/Firehose). Cloudtrail on the other had is available out of the box from AWS, the setup is quite simple and straight forward. But analysing the log could require you setup Glue crawlers and you might have to use AWS Athena to run SQL Like query.

Refer: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html

In my personal experience the cost/effort involved in setting up splunk is not worth it for smaller workloads, whereas the AWS Cloudtrail/Glue/Athena would be less expensive setup(comparatively).

Alternatively you could look at something like sumologic, which has better integration with cloudtrail as opposed to splunk. Hope that helps.

See more
Ajay M
Recommends
on
AWS CloudTrailAWS CloudTrail

I'd recommend using CloudTrail, it helped me a lot. But depending on your situation I'd recommed building a custom solution(like aws amazon-ssm-agent) which on configuration change makes an API call and logs them in grafana or kibana.

See more
Manage your open source components, licenses, and vulnerabilities
Learn More
Pros of Changefeed
Pros of Splunk Cloud
    Be the first to leave a pro
    • 7
      More powerful & Integrates with on-prem & off-prem
    • 3
      Free
    • 3
      Powerful log analytics
    • 1
      Pci compliance
    • 1
      Production debugger

    Sign up to add or upvote prosMake informed product decisions

    What is Changefeed?

    It makes it easy to keep and manage a changelog for your products. Keep your users up to date and engaged with every update your team ships.

    What is Splunk Cloud?

    If you're looking for all the benefits of Splunk® Enterprise with all the benefits of software-as-a-service, then look no further. Splunk Cloud is backed by a 100% uptime SLA, scales to over 10TB/day, and offers a highly secure environment.

    Need advice about which tool to choose?Ask the StackShare community!

    What companies use Changefeed?
    What companies use Splunk Cloud?
    Manage your open source components, licenses, and vulnerabilities
    Learn More

    Sign up to get full access to all the companiesMake informed product decisions

    What tools integrate with Changefeed?
    What tools integrate with Splunk Cloud?

    Sign up to get full access to all the tool integrationsMake informed product decisions

    Blog Posts

    GitHubPythonNode.js+26
    29
    16171
    What are some alternatives to Changefeed and Splunk Cloud?
    WordPress
    The core software is built by hundreds of community volunteers, and when you’re ready for more there are thousands of plugins and themes available to transform your site into almost anything you can imagine. Over 60 million people have chosen WordPress to power the place on the web they call “home” — we’d love you to join the family.
    Google AdSense
    It is a program run by Google through which website publishers in the Google Network of content sites serve text, images, video, or interactive media advertisements that are targeted to the site content and audience.
    Mailchimp
    MailChimp helps you design email newsletters, share them on social networks, integrate with services you already use, and track your results. It's like your own personal publishing platform.
    HubSpot
    Attract, convert, close and delight customers with HubSpot’s complete set of marketing tools. HubSpot all-in-one marketing software helps more than 12,000 companies in 56 countries attract leads and convert them into customers.
    Drupal
    Drupal is an open source content management platform powering millions of websites and applications. It’s built, used, and supported by an active and diverse community of people around the world.
    See all alternatives