Anomali ThreatStream vs. Logz.io

Anomali ThreatStream is excellent in scenarios where we deliver Managed Security Services to customers. It offers exhaustive volumes of information in the form of threat bulletins, IOCs, Threat Actor profiling, and details related to campaigns in the wild which can be used to a great extent by MSSPs. For an enterprise SOC, I believe it is a little less suited purely because of the pricing aspect as it is slightly towards the expensive side of the spectrum.

Incentivized

Logz.io is an effective solution if your alerting needs are fairly straightforward and you don't need long-term retention of logs with easy access. If being able to maintain easy access to logs longer than this is necessary, another solution might be better. If you need a high degree of precision with alerting triggers and the ability to suppress alerts, you will need to combine Logz.io with an integration to get this or you might consider a different solution.

Incentivized

• Indicators of Compromise
• Signatures
• Community Sharing

Incentivized

• Well documented and easy to set up.
• Their alerting mechanism is really great especially when it comes to application monitoring.
• Our data analysis in Kibana is made easy with the solution for Logz.io.
• The issue checking and fixing is escalated quickly and is reported in time.

Incentivized

• The user interface, perhaps there is some room for improvement although it is good already.
• Confidence assigning process for IOCs needs to be more robust and transparent.
• While integration with SIEM solutions is a cakewalk, there is definitely added value if SIGMA rule conversion and YARA rule creation are provided from the platform.

Incentivized

• Its price can be very high, so you should have good control of it to avoid exaggerated figures.
• Some functions can be confusing.
• It has limits to create subaccounts, which is a big problem for large companies.

Incentivized

I initially struggled trying to ensure the correct data was returned in the Kibana search, but I found it overall easy to use. Some of the UI is not as seamless as I'd expect, like changing the environment completely resets your search criteria and filters, which is annoying since it's a common use case to search something in multiple environments

Incentivized

Their support team is the best in the world! They supported us in most of the critical times and helped to resolve the issue in real time. Also their email support is well maintained and never a mail is missed unanswered. Kudos to the support team of logz.io for maintaining professionalism.

Incentivized

Many of the products that can be used to be ingested into a security event management software can be cumbersome with threat streamThere are many opportunities to continue fine-tuning the environment and providing great context in regards to threat research. When compared to other products threat stream stands out from usability and features.

Incentivized

Logz.io is more affordable, less work to maintain, and has more features. It was an easy choice. After my last team had to manage their own ELK stack, this was a no brainer. It helps us be focused on our core competencies.

Incentivized

• After the Initial startup cost, it has overall had a positive impact by increasing efficiency of the team and freeing up analysts to do manual threat hunting

Incentivized

• Be capable to efficiently identify problems
• Efficiently investigate issues and find the root cause
• Be able to improve the logging of services and products

Incentivized