Anomali ThreatStream vs. SolarWinds Threat Monitor

Anomali ThreatStream is excellent in scenarios where we deliver Managed Security Services to customers. It offers exhaustive volumes of information in the form of threat bulletins, IOCs, Threat Actor profiling, and details related to campaigns in the wild which can be used to a great extent by MSSPs. For an enterprise SOC, I believe it is a little less suited purely because of the pricing aspect as it is slightly towards the expensive side of the spectrum.

Incentivized

Due to the high price that SolarWinds has, I do not recommend it for small companies. And if I recommend SolarWinds in large companies with complex infrastructures where constant monitoring and review of the network is required, this system is very complete and helps everyone in the technology team, both network administrators, database administrators, Security Administrators, and Server Administrators are all very happy with this system.

Incentivized

• Indicators of Compromise
• Signatures
• Community Sharing

Incentivized

• monitoring
• notification systems
• virus attack monitoring
• ability to shut down systems when it senses an imminent threat

Incentivized

• The user interface, perhaps there is some room for improvement although it is good already.
• Confidence assigning process for IOCs needs to be more robust and transparent.
• While integration with SIEM solutions is a cakewalk, there is definitely added value if SIGMA rule conversion and YARA rule creation are provided from the platform.

Incentivized

• Steep learning curve.
• Usually takes a bit to get the scans to run easily in a new environment.
• Could have more reporting options.

Incentivized

SolarWinds offers live chat support for all its products built-in. So if you are working on something you can just reach out to someone at that time, and usually get an answer pretty quick. If you are trying to get something done it's a lot better than submitting a ticket and waiting for the email response.

Incentivized

Many of the products that can be used to be ingested into a security event management software can be cumbersome with threat streamThere are many opportunities to continue fine-tuning the environment and providing great context in regards to threat research. When compared to other products threat stream stands out from usability and features.

Incentivized

Threat Monitor is very new on the scene. Its obviously not at the same level as some of the established vendors yet. We also deploy Alienvault for example and its nowhere near the same level as this, however the cost model between these two products reflects that. Alienvault however does have a physical footprint on the environment, whereas Threat Monitor doesnt. If you have the paitence to wait, Threat Monitor will surely only improve over time.

Incentivized

• After the Initial startup cost, it has overall had a positive impact by increasing efficiency of the team and freeing up analysts to do manual threat hunting

Incentivized

• The positive impact that this system has on our company is that it has saved us a lot of expenses when it comes to investigating what the bank's network and systems are.
• This saving translates into administrators' time when it comes to finding the problem quickly, expeditiously, and effectively.
• It has helped us a lot and we have even required fewer hours from external providers when it comes to solving a problem.

Incentivized