Anomali ThreatStream vs. NetWitness Network

Anomali ThreatStream is excellent in scenarios where we deliver Managed Security Services to customers. It offers exhaustive volumes of information in the form of threat bulletins, IOCs, Threat Actor profiling, and details related to campaigns in the wild which can be used to a great extent by MSSPs. For an enterprise SOC, I believe it is a little less suited purely because of the pricing aspect as it is slightly towards the expensive side of the spectrum.

Incentivized

It is perfectly suited for large organizations aiming for providing web security to the customers or also if they are interested to setup their own security perations center . It is one of the leading security tools in the market and offers comprehensive capability in dealing with web attacks

Incentivized

• Indicators of Compromise
• Signatures
• Community Sharing

Incentivized

• Full packet capture allows look back on security events
• Packet reconstruction is essential to make sense of packets captured
• Threat analysis of captured packets provide additional indicators of compromise

Incentivized

• The user interface, perhaps there is some room for improvement although it is good already.
• Confidence assigning process for IOCs needs to be more robust and transparent.
• While integration with SIEM solutions is a cakewalk, there is definitely added value if SIGMA rule conversion and YARA rule creation are provided from the platform.

Incentivized

• The meta part to form the dashboards were a bit complicated
• The user interface could be made more understandable

Incentivized

Many of the products that can be used to be ingested into a security event management software can be cumbersome with threat streamThere are many opportunities to continue fine-tuning the environment and providing great context in regards to threat research. When compared to other products threat stream stands out from usability and features.

Incentivized

It was more advanced and comprehensive . The personalized dashboards and view was the major likeable difference . The correlation could help us analyze better and was more effective , the drill down features gives more information at one go

Incentivized

• After the Initial startup cost, it has overall had a positive impact by increasing efficiency of the team and freeing up analysts to do manual threat hunting

Incentivized

• The tool is great and an important part of my tool box
• The level of administration needed is a little too high
• Support relationships have to be customer led and prompted

Incentivized