We're a 50-person tech startup, all remote. Our stack is AWS, GitHub, Slack. Need to implement XDR. Budget is constrained, but we can't afford a breach.
Primary criteria:
* Must cover cloud workloads (EC2, S3, IAM).
* Must have automated response, not just alerting.
* Must integrate with our existing SIEM (we're sending logs to a S3 data lake).
* Per-user pricing models are a non-starter due to contractor churn.
Evaluating Trend Micro Vision One. The API looks workable for automation. Need to understand real-world operational cost beyond the list price. Is the cloud workload protection agent-heavy? How granular are the response actions?
Example of our current log flow for context:
```python
# Simplified version of our Kinesis Firehose to S3 process
import boto3
import json
firehose = boto3.client('firehose')
def put_to_s3_via_firehose(record_data: dict, delivery_stream_name: str):
response = firehose.put_record(
DeliveryStreamName=delivery_stream_name,
Record={'Data': json.dumps(record_data)}
)
return response
```
Looking for reviews on actual monthly spend for a similar size, and any gotchas in the API or data ingestion.