Cloud-custodian: Provide further clarification about Security Monkey comparison in Docs

[mechastorm]

Not a high priority issue, but could we please get a more detailed clarification on the comparison about Security Monkey with Cloud Custodian in the docs?

Currently it is still a bit vague to newbies like me on how it compared to Security Monkey beyond that SecMonkey is for a different use case than Cloud Custodian?

Netflix’s Security Monkey is a more interesting tool that provides for some basic audit capabilities. It’s worth investigating, but it’s not clear that there is much overlap between Cloud Custodian and Security Monkey as they are targeted to different use cases.

[alfredgamulo]

Security Monkey monitors AWS and GCP for changes and insecure configurations upon which it can notify.

Cloud Custodian enforces a user-defined policy set on AWS resources to maintain security compliance as well as business accountability. Given the permissions to do so, Cloud Custodian can act on resources to auto-fix issues that are filtered in for example TLS protocols on load balancers.

[kapilt]

so when that comparison was written security monkey had much less coverage, one of the hedge funds (bridgewater afaicr) added significant additional resource coverage and as a result sec monkey resource coverage has grown significantly since that assessment was written. That said, the delta is primarily the same still, security monkey has a set of hardcoded rules, that require code to extend and is targeted at the reporting use case and executing via polling. custodian supports a wide variety of use cases (security, cost optimization, compliance, etc) and supports both reporting and enforcement, including real time via lambda. moreover custodian is intended to allow users to define their own policies without having to write code, we have thousands deployed authored by over a hundred different folks. i regard custodian as a superset of secmonkey features minus at the moment the cross cloud support, which is on our roadmap for this year. i think there's also some other differences, sec monkey setups a db and web ui, custodian tries to be free form, in that you don't need any pre-requisites or infrastructure to get started, but if you want ux we provide the capabilities for indexing our structured outputs (cw metrics, resources in s3, etc.. see tools/c7n_index and tools/c7n_traildb). i think for folks that want dashboards we've got a bit more work to do to get some that we can distribute thats useful (though grafana and kibana out of the box are pretty useful imo). there's also a few companies building commercial products on custodian to incorporate ui capabilities.

[cixelsyd]

Thank you! The additional information inside this issue is highly relevant to OP's question, and should be pulled into the cloud-custodian documentation (which is still out-of-date in this regard) at the earliest possible convenience, as some people might not take the time to dig all the way into github issues for it.

[kapilt]

reopening, we should update the docs with this content.

[kapilt]

comparisions removed