Do any folks here install any open source or paid product for server hardening / security monitoring software on their EC2 instances? I have a client going through PCI / SOC2 and there have been requests from the auditing team to validate that we have security monitoring tooling installed on all servers. The client primarily runs applications on EKS Fargate so we hand-wave around this for the most part, but there are a couple EC2 instances in each environment account to support a bastion and system resources running on EKS Node Groups. All are using the base, up-to-date Amazon Linux 2 AMIs. Looking for any recommendations around something simple to satisfy this requirement. Also, I’d be completely happy to hear that the community consensus is “Hey you should just hand-wave around that”.

ClamAV

Yeah, that’s the one tool that I’ve seen used in this space. Question for you: Do you actually find it useful that you install that or is it just a checked box?

I guess it goes along with the saying “it is better to have it and not need it, then need it and not have it”

there is a bunch of Enterprise where this type of softwares are mandatory, we installed some at EA what were bakes on the images

EA as in Electronic Arts? Is that where you work Pepe?

I used to work there

the only commercial platform i'd come close to recommending is trend micro's deep security - but i'd only recommend that if something like ClamAV doesn't tick the boxes required - and that recommendation is quite a few years old now

I’m either going to with ClamAV OR I have a spike to investigate AWS Inspector and that has an “Inspector Agent” model which you can run on your instances, which I’m now interested in as well.

I use inspector, you can then do auto remediation and such based off findings using ssm

Inspector is an aws thing?

Yea

That Is pretty cool

we investigated a few vendors (paloalto twistlock, aquasec, stackrox) and went with Stackrox as it was the cheapest of the three yet they still checked all our boxes for container security monitors for certain benchmarks (CIS, SOC2, HIPAA, etc.), kubernetes security best practice checks on running containers and intrusion detection. None of the vendors in this space are cheap though.