SecurityMonkey - Detailed Review
Developer Tools
- SecurityMonkey - Product Overview
- SecurityMonkey - User Interface and Experience
- SecurityMonkey - Key Features and Functionality
- SecurityMonkey - Performance and Accuracy
- SecurityMonkey - Pricing and Plans
- SecurityMonkey - Integration and Compatibility
- SecurityMonkey - Customer Support and Resources
- SecurityMonkey - Pros and Cons
- SecurityMonkey - Comparison with Competitors
- SecurityMonkey - Frequently Asked Questions
- SecurityMonkey - Conclusion and Recommendation
SecurityMonkey - Product Overview
Introduction to Security Monkey
Security Monkey is an open-source security tool developed by Netflix, primarily aimed at monitoring and analyzing the security configurations of cloud environments, particularly those on Amazon Web Services (AWS) and Google Cloud Platform (GCP), with additional support for OpenStack.Primary Function
The primary function of Security Monkey is to track and evaluate security-related changes and configurations within cloud environments. It detects changes to various security-relevant components such as security groups, S3 bucket policies, and IAM users, and alerts users to potential security risks or noncompliant configurations.Target Audience
Security Monkey is targeted at security teams and cloud administrators who manage large and distributed cloud environments. It is particularly useful for organizations that need to monitor multiple AWS or GCP accounts and ensure their cloud configurations adhere to security best practices.Key Features
Components
Security Monkey consists of several key components:- Watcher: Monitors AWS accounts and technologies (e.g., S3, IAM, EC2) for configuration changes and records these changes in a database.
- Notifier: Alerts users when changes are detected or when audit rules are triggered.
- Auditor: Executes business rules against AWS configurations to assess the level of risk associated with the configurations. For example, it can identify security groups open to the internet or S3 policies allowing access from unknown accounts.
Technical Architecture
The tool is built using Python with the Flask framework and uses a PostgreSQL RDS database for storage. The frontend is written in Angular Dart, and it provides a REST API for data access. Security Monkey can be automated using Celery for task queuing and Supervisord for ensuring continuous operation.Customization and Extensibility
Security Monkey allows users to add custom watchers, auditors, and alerters, making it highly extensible. It also supports monitoring GitHub organizations, teams, and repositories.Multi-Cloud Support
In addition to AWS, Security Monkey has been extended to support GCP and OpenStack environments, making it a versatile tool for multi-cloud security monitoring.Operational Use
Security Monkey is relatively straightforward to set up and operate. It involves initial configuration of users, AWS accounts, and notification preferences. Users can check historical configuration details, view audit reports, and justify audit issues through the tool’s interface. While Security Monkey is currently in maintenance mode and was initially planned for end-of-life in 2020, it still accepts community contributions and bug fixes, making it a valuable resource for cloud security monitoring. SecurityMonkey - User Interface and Experience
User Interface of Security Monkey
The user interface of Security Monkey, a tool developed by Netflix for monitoring and securing cloud environments, is designed to be intuitive and user-friendly, even though the project is now in maintenance mode.
Logging In and Initial Setup
To start using Security Monkey, users need to log into the web UI. After registration and login, users can add accounts for Security Monkey to monitor. This involves providing details such as the account name, AWS account number, and S3 name, which is often derived from the email address used to create the AWS account.
Web UI Overview
The web UI provides a single interface to browse and search through all monitored accounts, regions, and cloud services. Users can view a list of accounts being monitored and add new accounts via a simple interface. The UI is organized to display items with issues, color-coded to indicate the severity of the issues (e.g., yellow for minor issues and red for more critical security issues like open S3 buckets or overly permissive security groups).
Searching and Filtering
Users can search for specific items using the search button at the top left of the UI. The search functionality includes auto-complete features for fields like Region, Tech, Account, and Name, making it easier to find specific items. Users can also filter results to show only items with issues.
Viewing Items
Clicking on an item in the UI brings up a detailed view-item page. Here, users can see the configuration details of the item, any attached issues, and changes to the configuration highlighted in different colors (green for additions and red for removals). Users can also add comments to explain changes or justify why certain configurations are acceptable.
Notifications and Customization
Security Monkey allows users to receive notification emails about changes and issues. Users can also disable auditor checks or override scores if certain issues are not a concern. The tool supports custom watchers, auditors, and alerters, which can be extended to fit specific needs.
Ease of Use
The interface is relatively straightforward, with clear instructions and minimal steps required to add accounts and start monitoring. However, since Security Monkey is in maintenance mode and no longer actively supported by Netflix, some features might require more technical knowledge to set up and customize, especially when dealing with custom extensions or troubleshooting.
Overall User Experience
The overall user experience is centered around providing a clear and organized view of the security posture of the monitored accounts. The UI helps users quickly identify and address security issues, and the ability to comment on changes and justify configurations enhances collaboration and transparency within teams. Despite being in maintenance mode, Security Monkey remains a useful tool for monitoring cloud security, though users may need to refer to documentation and community resources for support.
SecurityMonkey - Key Features and Functionality
Key Features and Functionality of Security Monkey
Security Monkey, developed by Netflix, is a powerful tool for monitoring and analyzing security configurations in cloud environments, particularly on Amazon Web Services (AWS) and Google Cloud Platform (GCP). Here are the main features and how they work:Monitoring and Tracking
Security Monkey continuously monitors and tracks changes in your cloud infrastructure. It watches various security-relevant AWS components and configuration items such as security groups, S3 bucket policies, and IAM users. For GCP, it monitors services like Firewall Rules, Networking, Google Cloud Storage Buckets, and Service Accounts (IAM).Components
The tool is composed of three main components:- Watcher: This component tracks changes in the cloud environment. It remembers previous states and can show exactly what changed and when.
- Notifier: Alerts users to any changes or potential security issues detected by the Watcher.
- Auditor: Evaluates the current state of the cloud configuration against a set of predefined security rules to identify insecure configurations.
Customization
Security Monkey allows for significant customization:- Users can add custom account types, watchers, auditors, and alerters. This flexibility enables organizations to extend the tool’s capabilities to fit their specific needs.
- Custom alerters can be used to provide new notification methods or to correct problems automatically. For example, a custom alerter can send events to Splunk.
Multi-Cloud Support
Security Monkey supports multiple cloud platforms:- Initially developed for AWS, it now also has beta support for tracking GCP services. It can monitor and alert on changes in both AWS and GCP environments.
Historical Data Access
The tool provides access to historical data for a given configuration item, which is crucial for forensic and investigative purposes. This feature helps in tracking changes over time and identifying when specific configurations were altered.Event-Driven Architecture
Security Monkey is moving towards an event-driven architecture:- On AWS, it uses CloudTrail to trigger CloudWatch Event Rules, which then trigger Lambda functions. On GCP, it uses Stackdriver Logging and Audit Logs to trigger Cloud Functions. This approach allows for real-time detection and response to changes.
AI and Automation Integration
While Security Monkey itself is not explicitly described as an AI-driven tool, it automates many aspects of security monitoring and analysis:- It uses predefined security rules to evaluate configurations, which can be seen as a form of rule-based automation. However, there is no specific mention of AI integration in the available resources. The tool’s primary strength lies in its ability to continuously monitor and alert on security-related changes, which enhances operational efficiency and security posture.
User Interface
Security Monkey provides a single UI to browse and search through all of your accounts, regions, and cloud services. This interface helps users to easily manage and monitor their cloud environments from a centralized location.Benefits
- Enhanced Security: By continuously monitoring and detecting potential anomalies and risky configurations, Security Monkey helps in maintaining a secure cloud environment.
- Operational Efficiency: The tool automates the process of tracking changes and alerting on security issues, reducing the manual workload on security teams.
- Compliance: It helps in ensuring compliance with security policies by alerting on insecure configurations.
- Forensic Capabilities: The historical data access feature is valuable for forensic and investigative purposes.
SecurityMonkey - Performance and Accuracy
Performance of Security Monkey
Security Monkey, developed by Netflix, is a powerful tool for monitoring and analyzing security configurations in cloud environments, particularly AWS, GCP, OpenStack, and GitHub. Here are some key points regarding its performance:Scalability
Security Monkey is designed to scale for large and globally distributed cloud environments. It uses Celery to manage multiple UI instances and workers, allowing it to process data more efficiently.Continuous Monitoring
The tool continuously monitors and detects potential anomalies and risky configurations in the cloud infrastructure. It tracks changes and evaluates security-related configurations, providing a historical view of these changes.Multi-Cloud Support
Security Monkey supports monitoring across various cloud platforms, including AWS, GCP, OpenStack, and GitHub organizations, teams, and repositories. This makes it versatile for organizations using multiple cloud services.Customization
Users can extend Security Monkey with custom account types, watchers, auditors, and alerters, which enhances its flexibility and adaptability to different environments.Accuracy
In terms of accuracy, Security Monkey has several features that contribute to its reliability:Authoritative Configuration History
It provides an authoritative configuration history service, which is crucial for forensic and investigative purposes. This ensures that all changes are accurately tracked and recorded.Built-in Rules and Custom Rules
Security Monkey comes with built-in rules to identify security risks and allows users to add their own rules, ensuring that the tool can accurately detect and alert on specific security configurations.Detailed Auditing
The tool includes components like the Auditor, which can fix issues that are not attached to an AuditorSetting, and it provides detailed reports on changes and configurations, enhancing its accuracy in detecting security anomalies.Limitations and Areas for Improvement
Despite its strong performance and accuracy, there are some limitations and areas where Security Monkey could be improved:Maintenance Mode
As of recent updates, Security Monkey is in maintenance mode and was initially planned to be end-of-life in 2020. This means that while it still receives minor bug fixes, it is not actively being developed with new features. Users are advised to consider alternatives like AWS Config for AWS users and Cloud Asset Inventory for GCP users.Technical Requirements
The tool requires specific IAM permissions and configurations, which can be complex to set up and manage. New permissions and deployment models have been introduced in recent versions, which users need to carefully review and implement.Compatibility
Security Monkey currently works on CPython 2.7, and while there are efforts to support Python 3, it is not yet fully compatible. This could limit its use in environments that have moved to newer versions of Python.Engagement and User Experience
For users, Security Monkey offers a single UI to browse and search through all accounts, regions, and cloud services, making it easier to manage and monitor security configurations. However, the setup and configuration process can be complex, especially for those not familiar with the required IAM permissions and deployment models. In summary, Security Monkey is a powerful tool for monitoring and analyzing cloud security configurations, offering strong performance and accuracy. However, its maintenance mode and specific technical requirements are important considerations for potential users. SecurityMonkey - Pricing and Plans
Pricing Structure of Security Monkey
When it comes to the pricing structure of Security Monkey, which is an open-source tool developed by Netflix for monitoring and analyzing AWS security configurations, there is a key point to note: Security Monkey is completely free.
Since Security Monkey is an open-source project hosted on GitHub, it does not have any paid tiers or subscription plans. Here are the key points:
Free and Open-Source
- Security Monkey is available free of charge to anyone who wants to use it.
- There are no different tiers or pricing models; it is a single, freely available tool.
Features
- The tool includes several components such as the Watcher, Notifier, and Auditor, which monitor AWS configurations, notify users of changes, and evaluate the security risk associated with these changes.
- It supports tracking and evaluating security-related changes and configurations in AWS environments, including security groups, S3 bucket policies, and IAM users.
- Users can add custom security checks and rules to fit their specific needs.
No Subscription or Fees
- There are no costs associated with using Security Monkey, making it a highly accessible tool for anyone managing AWS environments.
Given that Security Monkey is open-source and free, there is no need to consider different pricing plans or tiers. This makes it an excellent resource for individuals and organizations looking to enhance their AWS security monitoring without incurring additional costs.
SecurityMonkey - Integration and Compatibility
Integration with Other Tools
Security Monkey, developed by Netflix, is a versatile tool for monitoring and analyzing the security of AWS configurations. Here are some key points on how it integrates with other tools and its compatibility:AWS Services
Security Monkey is deeply integrated with various AWS services, including security groups, S3 bucket policies, and IAM users. It monitors these components for changes and misconfigurations, which could pose security risks. The tool’s Watcher component detects and records changes to these configurations, storing them in a PostgreSQL RDS database.CloudTrail and Trusted Advisor
While Security Monkey predates AWS CloudTrail and Trusted Advisor, it complements these services. CloudTrail provides detailed API call logs but lacks the state tracking that Security Monkey offers. Trusted Advisor evaluates cloud deployments against best practices, but it is a paid service and does not allow custom security checks, unlike Security Monkey.Custom Rules and Integrations
Security Monkey allows users to add their own custom security rules, which is a significant advantage over other tools like Trusted Advisor. For example, Netflix uses a custom rule to identify whether an IAM user matches a Netflix employee user account. This flexibility makes Security Monkey highly adaptable to specific organizational needs.Edda and Reddalert
There are plans to integrate Security Monkey with Edda, Netflix’s general-purpose AWS change tracker, and Reddalert, a security change detector developed by Prezi. This integration will enhance the tool’s capabilities in tracking and analyzing security-related changes across multiple AWS accounts.Technical Components
Security Monkey is built using Python with the Flask framework and uses Angular Dart for the frontend. It supports JSON data via a REST API, making it accessible for integration with other tools and systems. The tool runs on Ubuntu Linux and uses a PostgreSQL RDS database for storage.Compatibility Across Platforms and Devices
AWS Accounts and Regions
Security Monkey is designed to scale and support multiple AWS accounts and regions. It can monitor dozens of AWS accounts and handle hundreds of changes per day, making it suitable for large and globally distributed cloud environments.Operating System
The tool runs on Ubuntu Linux, and there is no indication that it is incompatible with other Linux distributions. However, specific compatibility with other operating systems is not mentioned.User Management
Security Monkey uses Flask-Login and Flask-Security for user management in its open-source version, ensuring secure authentication and authorization. At Netflix, it integrates with their standard single-sign-on (SSO) provider. In summary, Security Monkey is highly integrated with AWS services and offers significant flexibility through custom rules and planned integrations with other tools. Its compatibility is primarily focused on AWS environments, and it is well-suited for large-scale cloud operations. SecurityMonkey - Customer Support and Resources
Support Options for Security Monkey
For the Security Monkey tool, which is an open-source project developed by Netflix, the customer support options and additional resources are somewhat limited compared to commercial products, but there are still several ways to get help and engage with the community.
Documentation and Release Notes
The primary resource for support is the extensive documentation and release notes available on the GitHub repository. These include detailed descriptions of new features, bug fixes, and breaking changes in each version. For example, the release notes for various versions (e.g., v1.1.3, v1.1.2, v1.1.1) provide insights into specific issues resolved and new functionalities added.
Community Contributions and Issues
Security Monkey is an open-source project, which means that users can contribute to the codebase and report issues directly on GitHub. The project’s issue tracker is where you can find and report bugs, request features, and engage with other users and developers. This community-driven approach allows for collaborative problem-solving and continuous improvement.
Contributor Support
Given that Security Monkey is maintained by a community of contributors, reaching out to these contributors through GitHub can be a viable way to get help. Many contributors are listed in the release notes, and you can contact them directly through their GitHub profiles or through the project’s issue tracker.
General Open-Source Resources
Since Security Monkey is an open-source tool, users can also leverage general open-source community resources. This includes forums like Stack Overflow, Reddit’s netsec community, and other security-focused forums where users can ask for help and advice from a broader audience.
Conclusion
In summary, while there are no traditional customer support channels like phone or email support, the rich documentation, community engagement, and open-source nature of Security Monkey provide ample resources for users to find help and resolve issues.
SecurityMonkey - Pros and Cons
Advantages of Security Monkey
Comprehensive Monitoring
Security Monkey is designed to monitor and analyze the security configurations of AWS, GCP, and OpenStack cloud environments. It tracks changes to various security-relevant components such as security groups, S3 bucket policies, and IAM users, providing a detailed history of configuration changes.
Customizable Rules and Alerts
The tool allows users to define custom audit rules to check for specific security risks. For example, it can identify security groups open to the internet or S3 policies allowing access from unknown accounts. Users can also add their own custom security checks, which is a feature not available in some competing services like AWS Trusted Advisor.
Multi-Account Support
Security Monkey can monitor and manage multiple AWS accounts from a single installation, making it scalable for large and distributed cloud environments. This is particularly useful for organizations with numerous accounts and regions.
User-Friendly Interface
The tool provides a single user interface to browse and search through all cloud services, accounts, and regions. It also offers JSON data via a REST API, making it easier to integrate with other systems.
Community and Support
Despite being in maintenance mode, Security Monkey has a significant community backing, with over 50 contributors and more than 1000 GitHub stars. This indicates a strong support base and the potential for community-driven updates and fixes.
Extensibility
Security Monkey can be extended with custom account types, watchers, auditors, and alerters, allowing users to adapt the tool to their specific needs.
Disadvantages of Security Monkey
Maintenance Mode
As of the latest updates, Security Monkey is in maintenance mode and was scheduled to be end-of-life in 2020. This means that only minor bug fixes are being addressed, and there is limited support for new features or major updates.
Complex Setup
Setting up Security Monkey can be complex, especially for those not familiar with the underlying technologies. It requires specific IAM permissions and configuration, which can be time-consuming to set up correctly.
Limited New Feature Development
Given its maintenance mode status, new feature development is not a priority. Users are advised to consider alternatives like AWS Config for AWS users and Cloud Asset Inventory for GCP users for more actively maintained solutions.
Technical Requirements
Security Monkey is known to work on specific operating systems like Ubuntu Linux and macOS, and it requires a PostgreSQL RDS database. This can limit its deployment flexibility for some users.
Dependence on Older Technologies
The tool is built using older technologies such as Python 2.7 and Angular Dart, which may pose challenges for integration with newer systems or finding support for these technologies in the future.
In summary, while Security Monkey offers powerful monitoring and analysis capabilities for cloud security, its maintenance mode status and complex setup requirements are significant drawbacks. Users should carefully consider these factors when deciding whether to use this tool.
SecurityMonkey - Comparison with Competitors
When comparing Security Monkey, an open-source tool developed by Netflix for monitoring and analyzing the security of AWS configurations, with its competitors, several key aspects and alternatives come into focus.
Unique Features of Security Monkey
- Comprehensive Monitoring: Security Monkey is specifically designed to track and evaluate security-related changes and configurations in AWS environments. It monitors various security-relevant AWS components such as security groups, S3 bucket policies, and IAM users, detecting potential anomalies and risky configurations.
- Scalability: It is built to scale for large and globally distributed cloud environments, making it suitable for organizations with multiple AWS accounts and regions.
- Authoritative Configuration History: The tool provides an authoritative configuration history service, which is crucial for forensic and investigative purposes.
- Customizable Rules: Security Monkey comes with built-in rules, and users can add their own, allowing for flexibility in monitoring and alerting.
Potential Alternatives
AWS Config
- Resource Inventory and Compliance: AWS Config provides a detailed resource inventory, configuration history, and configuration change notifications. It is fully integrated with AWS services, making it seamless for users already within the AWS ecosystem. However, it may be less flexible for those using multiple cloud providers.
- Continuous Monitoring: AWS Config offers continuous monitoring and automatic compliance checks, which can be beneficial for maintaining security and governance standards.
Prowler
- Security Audits and Compliance: Prowler performs security audits, compliance checks, and monitoring for AWS environments. It supports multiple AWS accounts and regions, providing detailed reports on security risks. Prowler is known for its comprehensive security checks and easy deployment.
- Regular Updates: Unlike Security Monkey, Prowler requires regular updates to stay current with security best practices and new vulnerabilities.
Cloud Custodian
- Rules Engine: Cloud Custodian is an open-source rules engine that allows users to define policies for security, cost optimization, and compliance. It supports multi-cloud environments and offers automated remediation. However, it has a learning curve for creating custom policies.
- Flexibility: Cloud Custodian’s flexibility in policy definition makes it a strong alternative for organizations needing customized security and compliance management.
Dome9
- Continuous Compliance Monitoring: Dome9 offers continuous compliance monitoring, security posture management, and governance across public cloud environments. It provides visualization of cloud security configurations and automated remediation. While it has a user-friendly interface, it may be more costly for enterprise features.
Key Differences
- Integration: Security Monkey is specifically tailored for AWS environments and integrates deeply with Netflix’s internal tools, whereas alternatives like AWS Config and Prowler also focus on AWS but offer different levels of integration and features. Cloud Custodian and Dome9 support multi-cloud environments, making them more versatile.
- Customization: Security Monkey allows for customizable rules, which is a strong feature for organizations with specific security needs. Cloud Custodian also offers this flexibility through its rules engine.
- Scalability and History: Security Monkey’s ability to scale and provide an authoritative configuration history makes it particularly useful for large, distributed cloud environments. AWS Config also provides configuration history, but it is more tightly integrated with the AWS ecosystem.
SecurityMonkey - Frequently Asked Questions
Frequently Asked Questions about Security Monkey
What is Security Monkey?
Security Monkey is an open-source tool developed by Netflix to monitor and analyze the security of AWS, GCP, and OpenStack cloud configurations. It tracks changes to security-related components and configurations, helping to identify potential security risks.
What components make up Security Monkey?
Security Monkey consists of several key components:
- Watcher: Monitors AWS accounts and technologies (e.g., S3, IAM, EC2) and records changes to configurations.
- Notifier: Notifies users or groups about changes or when audit rules are triggered.
- Auditor: Executes business rules against AWS configurations to determine the level of risk associated with the configuration.
How does Security Monkey track configuration changes?
Security Monkey uses the Watcher component to detect and record changes to configurations in your cloud accounts. For example, it can detect when a new IAM user is created or when an S3 bucket policy changes. These changes are stored in a PostgreSQL RDS database for historical tracking and forensic purposes.
What kind of notifications does Security Monkey provide?
Security Monkey’s Notifier component sends notifications to users or groups when specific items change or when audit rules are triggered. Users can configure notification preferences to determine what changes or audit reports they should be notified about.
Can I add custom rules and watchers to Security Monkey?
Yes, Security Monkey allows users to add custom rules, watchers, auditors, and alerters. This flexibility enables organizations to tailor the tool to their specific security needs and policies.
How does Security Monkey compare to AWS CloudTrail and AWS Trusted Advisor?
Security Monkey provides a historical view of configuration changes, which CloudTrail does not. Unlike Trusted Advisor, Security Monkey is free and allows users to add custom security checks. It also supports monitoring multiple AWS accounts from a single installation.
What is the current status of Security Monkey support?
As of the latest information, Netflix’s support for Security Monkey has been reduced to minor bug fixes only. The project is in maintenance mode and was planned to be end-of-life in 2020. Users are encouraged to use AWS Config for AWS and Cloud Asset Inventory for GCP instead.
How do I install and set up Security Monkey?
Installation and setup involve setting up Security Monkey users, configuring AWS accounts for monitoring, and defining user-specific notification preferences. Detailed instructions are available in the installation document and user guide on the GitHub repository.
Can Security Monkey monitor other cloud services besides AWS?
Yes, Security Monkey supports monitoring GCP accounts and OpenStack public and private clouds. It can also watch and monitor GitHub organizations, teams, and repositories.
What kind of reports does Security Monkey generate?
Security Monkey generates reports that show historical details of configuration items, audit issues, and changes over time. These reports help in identifying and justifying audit issues, such as S3 policies referencing unknown accounts or IAM users with active access keys.
How can I extend Security Monkey with custom features?
You can extend Security Monkey by adding custom account types, watchers, auditors, and alerters. The project is open-source, and contributions, such as bug fixes and new features, are welcome through pull requests.
SecurityMonkey - Conclusion and Recommendation
Final Assessment of Security Monkey
Overview and Purpose
Security Monkey is a monitoring tool developed by Netflix to track and evaluate security-related changes and configurations in cloud environments, particularly on Amazon Web Services (AWS) and, to a lesser extent, Google Cloud Platform (GCP) and OpenStack. The tool was initially created to address the challenges of managing the complex and frequently changing IT infrastructure at Netflix.
Key Features
- Security Monkey continuously monitors and detects potential anomalies and risky configurations in cloud infrastructure.
- It has three main components: Watcher, Notifier, and Auditor.
- The tool provides a single UI to browse and search through all accounts, regions, and cloud services, and it remembers previous states to show exactly what changed and when.
- Users can extend Security Monkey with custom account types, watchers, auditors, and alerters.
Current Status
Security Monkey is currently in maintenance mode, with Netflix reducing its support to minor bug fixes only. Users are encouraged to use AWS Config for AWS environments and Cloud Asset Inventory for GCP environments instead.
Who Would Benefit Most
Security Monkey would be most beneficial for organizations that:
- Have large, globally distributed cloud environments.
- Need to monitor and manage frequent changes in their cloud configurations.
- Require detailed historical data for forensic and investigative purposes.
- Are looking for a tool to help in identifying and mitigating security risks associated with cloud infrastructure misconfigurations.
Recommendation
Given that Security Monkey is in maintenance mode and no longer actively supported by Netflix, it is recommended to consider alternative tools like AWS Config or Cloud Asset Inventory, which are actively maintained and integrated with the respective cloud platforms.
For organizations already using Security Monkey, it might be worth continuing to use it for the time being, especially if they have customized it extensively. However, planning a transition to a more actively supported tool is advisable to ensure ongoing security and compliance.
While Security Monkey was a valuable tool in its time, relying on a tool in maintenance mode may lead to missed security updates and potential vulnerabilities. Therefore, it is crucial to weigh the benefits against the risks and consider migrating to more current and actively supported solutions.