Defensia Database Security vs LevelBlue AppDetectivePRO

Defensia Database Security detects database ports exposed to the network and monitors authentication failures that may indicate brute-force attacks. Its agent monitors authentication logs for MySQL/MariaDB, PostgreSQL and MongoDB, and checks Redis port exposure. At startup, it checks ports 3306, 5432, 27017 and 6379; a port bound to 0.0.0.0 creates a dashboard advisory. Repeated authentication failures can trigger IP blocking through iptables or nftables. The agent runs as a systemd service and detects MySQL, PostgreSQL and MongoDB log files automatically. It requires Linux kernel 4.x or newer, root or sudo access, and HTTPS access to the Defensia panel. Deployment options include Docker, Docker Swarm and Kubernetes, with a Helm chart for Kubernetes. The dashboard shows attack timelines, blocked IPs and port advisories. Free is free, with one server, 2,000 events/month, three days of log retention and monitor mode only. Pro is €9 a month, with unlimited servers and events and 90 days of retention.

LevelBlue AppDetectivePRO scans databases and big data stores for configuration errors, access-control issues, missing patches, and risky settings that could lead to compromise. It assesses databases on premises or in the cloud and supports discovery, assessment, and reporting on security, risk, or compliance posture. LevelBlue says the product has more than 50 built-in policies and 12 annual knowledge-base updates. SpiderLabs experts contribute vulnerability research to that knowledge base, and policies can be customized. Supported datastore examples include Amazon RDS, Azure SQL, Microsoft SQL Server, MySQL, PostgreSQL, MongoDB, Cassandra, Couchbase, Elasticsearch, and Teradata. Licensing depends on the number and type of databases, with a licensed unit defined for each platform; pricing is available on request. A 30-day trial is offered. The trial license excludes some filtering or customization features, and technical support is unavailable during the trial. An evaluation without an evaluation license is limited to one scanned asset and one built-in policy, then stops running 30 days after first opening.