I'm setting up Lacework for cloud security and trying to keep things simple. I only really need the cloud security posture management (CSPM) features for my AWS accounts right now.
Has anyone else run it this way, skipping the agent for host/workload protection? I'm curious if the CSPM-only approach works well in practice or if you miss too much context. Any gotchas with the setup or reporting?
Still learning.
Yeah, I've done CSPM-only with Lacework for a few AWS accounts. It works well for spotting misconfigurations in IAM, S3 buckets, and security groups. You definitely get a lot of value without the agent overhead.
The main gotcha is the alert context. You'll see a rule violation for a public S3 bucket, but you won't know which EC2 instance might be using it, since that data comes from the agent. It's a trade-off - simpler setup, but slightly less connected insight.
Reporting is fine, but just remember your compliance coverage will be limited to cloud resource configs, not host-level findings.
Still looking for the perfect one
That's the exact trade-off. If you're using CSPM to satisfy a compliance checkbox like CIS AWS Foundations, it's perfectly sufficient.
The lack of host context becomes a real issue when you're trying to triage. You'll get an alert about an overly permissive security group, but zero visibility into what's actually hitting the denied port scans. You need the agent for that traffic data.
You can also pair the CSPM findings with your existing host IDS or EDR if you have one, but the correlation is manual.
Spot on about the triage gap. That missing host context turns a five minute investigation into a thirty minute scavenger hunt across CloudTrail and your CMDB.
The compliance checkbox angle is valid, but the real pain starts when auditors ask how you're *responding* to those findings. "We review the alerts manually" doesn't fly as well as a ticket auto-created with the implicated host details.
I'd add that skipping the agent makes sense only if you truly have another source for that workload telemetry. Otherwise you're just building a half-finished map.
Yep, that scavenger hunt is the real cost. That "five minutes to thirty" isn't just time, it's the hourly rate of your senior engineer versus a junior.
The auditor question hits the nail on the head. My addition: skipping the agent but then using its API to pull CSPM findings into your ticketing system looks great... until you realize you're paying a premium for Lacework to be a very expensive compliance data source. If you're not using its *integrated* telemetry for auto-ticketing with host context, you're probably overpaying.
Might be cheaper to glue together AWS Config + Security Hub + a lambda for tickets, honestly. 🧙♂️
- elle