IBM X-Force Exchange vs. Palo Alto Networks AutoFocus

IBM X-Force is well suited for organizations with medium to large SOC's and run IBM Qradar as their SIEM.

Incentivized

Analytics, Threat Hunting and detailed investigations for the security incidents are the main use cases. Automation on the cloud based on the feeds through the minemeld is another use case. When you deploy PAN on perimeter, Autofocus gives you a temendaous value. If you have non PAN firewall/products running Auto focus doe not make sense.

Incentivized

• Ready made security research on threats.
• Security Intel
• Integrate threat intel feeds with SIEMs.

Incentivized

• Threat intelligence
• Emerging Threats
• Intelligence feeds

Incentivized

• Pruning of IOC to reduce false positives.
• Add more flexibility to integration on SIEMs to allow users to compare UserAgents, Compromised users/domains like HIBP.
• Only watch vulnerabilities for selected vendors.

Incentivized

• third party product integration
• simplicity of the managment console
• integration to cortex agents directly

Incentivized

IBM X-force is community-based and crowd strike is not. Community-based will always be best-effort quality.

Incentivized

If you have Palo Alto, autofocus is the selected choice. If you have Checkpoint than the threat cloud. Price of autofocus is much cheaper. Unit42 is the real differentiator. Minemeld is unique to PAN and working perfectly. Search outputs and are detailed and gives lots of data. Integration with SOAR is much easier with autofocus. Indicator list is huge. Tagging works magnificent.

Incentivized

• Threat Intel - Low Confidence IOC - Overhead.
• Lack of integration with IBM Qradar+Vulnerability via X-Force.

Incentivized

• Cheap for us
• Easy integration
• Easy management

Incentivized