Anomali ThreatStream vs. Palo Alto Networks AutoFocus

Anomali ThreatStream is excellent in scenarios where we deliver Managed Security Services to customers. It offers exhaustive volumes of information in the form of threat bulletins, IOCs, Threat Actor profiling, and details related to campaigns in the wild which can be used to a great extent by MSSPs. For an enterprise SOC, I believe it is a little less suited purely because of the pricing aspect as it is slightly towards the expensive side of the spectrum.

Incentivized

Analytics, Threat Hunting and detailed investigations for the security incidents are the main use cases. Automation on the cloud based on the feeds through the minemeld is another use case. When you deploy PAN on perimeter, Autofocus gives you a temendaous value. If you have non PAN firewall/products running Auto focus doe not make sense.

Incentivized

• Indicators of Compromise
• Signatures
• Community Sharing

Incentivized

• Threat intelligence
• Emerging Threats
• Intelligence feeds

Incentivized

• The user interface, perhaps there is some room for improvement although it is good already.
• Confidence assigning process for IOCs needs to be more robust and transparent.
• While integration with SIEM solutions is a cakewalk, there is definitely added value if SIGMA rule conversion and YARA rule creation are provided from the platform.

Incentivized

• third party product integration
• simplicity of the managment console
• integration to cortex agents directly

Incentivized

Many of the products that can be used to be ingested into a security event management software can be cumbersome with threat streamThere are many opportunities to continue fine-tuning the environment and providing great context in regards to threat research. When compared to other products threat stream stands out from usability and features.

Incentivized

If you have Palo Alto, autofocus is the selected choice. If you have Checkpoint than the threat cloud. Price of autofocus is much cheaper. Unit42 is the real differentiator. Minemeld is unique to PAN and working perfectly. Search outputs and are detailed and gives lots of data. Integration with SOAR is much easier with autofocus. Indicator list is huge. Tagging works magnificent.

Incentivized

• After the Initial startup cost, it has overall had a positive impact by increasing efficiency of the team and freeing up analysts to do manual threat hunting

Incentivized

• Cheap for us
• Easy integration
• Easy management

Incentivized