Anomali ThreatStream vs. ThreatConnect Threat Intelligence Operations Platform

Parsing is useful information into other tools but can be a hit or miss depending on the tool. In regards to the quality of data, there is room for improvement as there is a constant growth of attackers and their techniques. Anomali Threat stream does well for larger organizations to use in tandem with other security suites.

Incentivized

If ThreatConnect is going to be used to create playbooks the required technical knowledge and try and error that is required may not be for everyone. The application provides an app builder capability that is really useful but in order to be used the user needs to have intermediate to advanced programing abilities.

• Indicators of Compromise
• Signatures
• Community Sharing

Incentivized

• One of the most beneficial features of the ThreatConnect is its ability to automatically enrich IOCs from multiple sources such as VT WHOis and assign a dynamic threat score.

Incentivized

• The user interface, perhaps there is some room for improvement although it is good already.
• Confidence assigning process for IOCs needs to be more robust and transparent.
• While integration with SIEM solutions is a cakewalk, there is definitely added value if SIGMA rule conversion and YARA rule creation are provided from the platform.

Incentivized

• Need to have more native (out of the box) integrations
• Need more focused training courses and certificates

Incentivized

The platform is feature rich in enrichment and multi tenant management additionally have the ease of the use for new analysts or smaller teams.

Incentivized

I think they both have their own pros and cons. However, I like Anomali ThreatStream better because of its strong local presence in MENA market which renders great support from the vendor during needy times. I have also figured out that IOC integration with SIEM solutions is fairly easy and straight forward with Anomali ThreatStream.

Incentivized

As ThreatConnect Threat Intelligence Operations Platform has a ready HTTP Client App, we can virtually integrate it with any system that supports REST APIs. This gives great room for integration and automation that is not found on other systems.

Incentivized

• We have seen a positive ROI as the security monitoring is taken to the next level when it is augmented with threat intel data that Anomali provides.
• Our customers are very satisfied with the periodic threat reports that we send, which are created using Anomali ThreatStream.
• The overall business objectives are met as Threat Intel is one of the most important pillars when it comes to providing security services, and we use Anomali ThreatStream extensively for that.

Incentivized

• Playbooks allow for extensive automation of tasks the team would otherwise spend hours on

Incentivized