Anomali ThreatStream
By Anomali
A threat intelligence platform (TIP) rather than primarily an intel producer: it aggregates commercial, open-source, and ISAC feeds, deduplicates and scores the indicators, and pushes the curated result into SIEM and security controls. Relaunched as ThreatStream Next-Gen in 2026 with AI-assisted analysis on top of the aggregation core.
Verified Source: 1
- Product type
- Software
- Deployment
- SaaS
- Organization size
- Mid-marketEnterprise
- Pricing tier
- $$
Capability checklist
TIHow Anomali ThreatStream measures up against the full Threat Intelligence taxonomy.
- Curated IOC feeds — supported
- Provides vetted lists of malicious IPs, domains, and file hashes.
- Adversary & TTP profiles — supported
- Documents known attacker groups and the techniques they typically use.
- Dark web & brand monitoring — not supported
- Watches for leaked credentials, data, or brand impersonation outside the organization.
- SIEM/SOAR enrichment integration — supported
- Automatically feeds intelligence context into alerts and playbooks.
- Vulnerability & exploit intelligence — not supported
- Tracks which vulnerabilities are being actively exploited in the wild.
- Analyst research portal — supported
- Gives analysts a searchable portal to investigate threats manually.
Alternatives
Other Threat Intelligence tools with overlapping capabilities, sized for similar teams.