No more typing reviews! Try our Samantha, our new voice AI agent.
Anomali Logo

Anomali Reviews

Vendor: Anomali
3.9 out of 5
Leave a review

What is Anomali?

Anomali delivers user-friendly cyber threat intelligence, offering concise insights with robust capabilities for evolving scenarios.

Get the Anomali Buyer's Guide and find out what your peers are saying about Anomali, CrowdStrike Falcon, Cortex XDR by Palo Alto Networks and more!
Anomali is the #8 ranked solution in top Threat Intelligence Platforms, #12 ranked solution in top User Entity Behavior Analytics (UEBA) solutions, #21 ranked solution in top Advanced Threat Protection (ATP) solutions, #22 ranked solution in XDR Security products, and #32 ranked solution in top Security Information and Event Management (SIEM) solutions. PeerSpot users give Anomali an average rating of 7.8 out of 10. Anomali is most commonly compared to CrowdStrike Falcon: Anomali vs CrowdStrike Falcon. Anomali is popular among the large enterprise segment, accounting for 53% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 14% of all views.
Buyer's Guide
Anomali
May 2026
Get the report
Helped 896,467 peers since 2012

Featured Anomali reviews

Read more reviews

Anomali mindshare

Product category:
Threat Intelligence Platforms (TIP)
As of May 2026, the mindshare of Anomali in the Threat Intelligence Platforms (TIP) category stands at 3.9%, down from 4.9% compared to the previous year, according to calculations based on PeerSpot user engagement data.
Threat Intelligence Platforms (TIP) Mindshare Distribution
ProductMindshare (%)
Anomali3.9%
Recorded Future7.1%
CrowdStrike Falcon4.8%
Other84.2%
Threat Intelligence Platforms (TIP)

PeerResearch reports based on Anomali reviews

TypeTitleDate
CategoryThreat Intelligence Platforms (TIP)May 30, 2026Download
ProductReviews, tips, and advice from real usersMay 30, 2026Download
ComparisonAnomali vs CrowdStrike FalconMay 30, 2026Download
ComparisonAnomali vs Recorded FutureMay 30, 2026Download
ComparisonAnomali vs Check Point Security ManagementMay 30, 2026Download
Suggested products
TitleRatingMindshareRecommending
CrowdStrike Falcon4.34.8%97%140 interviewsAdd to research
Cortex XDR by Palo Alto Networks4.2N/A96%112 interviewsAdd to research
 
 
Key learnings from peers
Last updated May 24, 2026

Valuable Features

Anomali offers valuable features like cyber threat intelligence, threat modeling, and a robust user interface. It integrates with tools like Palo Alto, supports query-based searches, and helps consolidate CTI from various platforms such as Mandiant and Flashpoint. Users appreciate its reliability, large data storage, and strong API, enhancing automation and efficiency. The platform aids in monitoring credentials and managing indicators of compromise, significantly improving organizational efficiency and information accuracy.
  • "Anomali positively impacts our organization, notably improving our vulnerability management program under reducing attack surface management."
  • "I think it's one of the awesome tools I've worked with to date."
  • "Anomali is a very versatile platform, quite effective, and very fast when it comes to downloading and maintaining the information of the indicators of compromise."

Room for Improvement

Many users suggest Anomali could benefit from better feature integration to create a comprehensive toolset, improve intelligence sharing with a consistent tagging system, and offer a global cyberattack heat map. Enhancements in compromised credential monitoring from dark web sources, more robust capacity for integrators and web interface management, and no-code integration options are also recommended. Additionally, improvements in artificial intelligence functionalities are advocated as technology advances.
  • "Pricing and licensing are good, but the costs for purchasing threat feeds are somewhat complicated and a bit on the higher side."
  • "One more improvement I would mention is regarding compromised credential monitoring. Anomali should increase their capability to fetch details from various dark web solutions where threat actors post compromised credentials."
  • "My experience with Anomali's customer support has not gone so well for us."

Pricing

  • "When comparing the price of Anomali Enterprise to other solutions it is in the medium to high range. However, I am satisfied with the price."

Popular Use Cases

Anomali is primarily used for threat intelligence, threat hunting, and intelligence gathering. Many integrate Anomali with platforms like Splunk and CISA, leveraging TAXII/STIX for efficient data management. Anomali excels in aggregating threat feeds, providing real-time insights, and enabling centralized storage of indicators of compromise. Its integration capabilities include SIEMs and other CTI tools, facilitating a proactive approach to security by querying diverse threat feeds and scoring indicators for integration into various security controls.

Service and Support

Anomali's support is responsive during incidents, addressing inquiries typically within 24 to 48 hours. While their support was highly regarded, recent experiences suggest slower resolution times and delayed responses, sometimes without immediate follow-up. Some users find support reliable, but limitations in the tool itself can affect support effectiveness. Apologies for delays are noted, but some feel current support professionalism has declined compared to past performance.

Scalability

Anomali excels in scalability, praised for handling extensive growth needs. Users report smooth cloud operation and efficient performance, accommodating numerous users. It manages vast quantities of data that other platforms struggle with. Organizations appreciate its ability to scale beyond traditional SIEM tools like Splunk or Sentinel, with capabilities nearing limitless storage. Many express satisfaction with its adaptability, considering it an optimal choice for large-scale threat intelligence applications.

Stability

Anomali is perceived as stable, with no major downtime reported. It features a health check page for real-time status monitoring. Users value its consistency, though some mention recent operational changes have not considered customer needs sufficiently, with inadequate adaptation time. While changes by other providers allow more transition time, Anomali's shift caused some adjustment difficulty. Overall, the platform's reliability remains strong, though there is room for improvement in change management.
These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.
Download our Anomali Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company SizeCount
Small Business1
Large Enterprise6
By reviewers
By visitors reading reviews
Company SizeCount
Small Business116
Midsize Enterprise58
Large Enterprise197
By visitors reading reviews

Top industries

By visitors reading reviews
Financial Services Firm
14%
Manufacturing Company
7%
Computer Software Company
7%
Construction Company
6%
Healthcare Company
6%
Comms Service Provider
5%
Educational Organization
5%
Government
5%
University
5%
Outsourcing Company
5%
Retailer
4%
Marketing Services Firm
3%
Insurance Company
3%
Performing Arts
3%
Real Estate/Law Firm
3%
Media Company
2%
Energy/Utilities Company
2%
Transportation Company
2%
Pharma/Biotech Company
2%
Wholesaler/Distributor
1%
Consumer Goods Company
1%
Logistics Company
1%
Hospitality Company
1%
Legal Firm
1%
Engineering Company
1%
Religious Institution
1%
Non Profit
1%
Aerospace/Defense Firm
1%

Compare Anomali with alternative products

Go!

Learn more about Anomali

Anomali offers a powerful platform for cyber threat intelligence, allowing organizations to efficiently stream and analyze threat feeds. It excels in threat modeling, prioritizing intelligence, and supporting large-scale automation through its API, fostering a proactive security approach.

What are Anomali's Key Features?
  • Threat Intelligence: Provides concise and user-friendly intelligence.
  • Threat Modeling: Enables prioritization and efficient organization of intelligence.
  • Credential Monitoring: Performs quickly with efficient dataset handling.
  • API Automation: Supports large-scale automation for robust intelligence management.
  • Adaptability: Offers capabilities to grow beyond initial use cases.
Which Benefits or ROI Should Users Consider?
  • Efficient Intelligence Collection: Quickly gathers and organizes data for use.
  • Enhanced Threat Analysis: Correlates data effectively for proactive security.
  • Automation Support: Saves time with extensive API capabilities.
  • Scalability: Adapts and scales with emerging security needs.

Anomali serves as a crucial tool for threat intelligence in industries ranging from finance to healthcare. Organizations stream threat feeds into Anomali to correlate and aggregate data, enhancing security measures and facilitating thorough threat investigations. Its adaptability makes it suitable across different sectors.

Anomali was previously known as Match, Lens, ThreatStream, STAXX, Anomali Security Analytics.

Anomali customers

Bank of England, First Energy, UBISOFT, Bank of Hope, Blackhawk Network

Related questions

  • 120
Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?
  • 216
How inadvisable is it to use a single vulnerability analysis tool?
  • 72
Threat intelligence tools for large organization
  • 236
What is your recommended cost-effective solution to detect and prevent APT attacks?
  • 136
Compromise Assessment vs Threat Hunting
  • 81
When evaluating Threat Intelligence Platforms (TIP), what aspect do you think is the most important to look for?
  • 61
What are some of the biggest mistakes that businesses make when it comes to monitoring cyber threats?
  • 74
What is the difference between internal and external threat intelligence?
  • 75
Which enterprise threat modeling tool do you recommend?
  • 65
Can someone provide any independent comparison of threat modeling solutions?

Product Categories

Product Categories
Threat Intelligence Platforms (TIP)
Security Information and Event Management (SIEM)
User Entity Behavior Analytics (UEBA)
Advanced Threat Protection (ATP)
Extended Detection and Response (XDR)

Popular Comparisons

Popular Comparisons
CrowdStrike Falcon vs Anomali Logo
CrowdStrike Falcon vs Anomali
Cortex XDR by Palo Alto Networks vs Anomali Logo
Cortex XDR by Palo Alto Networks vs Anomali
Microsoft Defender for Endpoint vs Anomali Logo
Microsoft Defender for Endpoint vs Anomali
Wazuh vs Anomali Logo
Wazuh vs Anomali
Splunk Enterprise Security vs Anomali Logo
Splunk Enterprise Security vs Anomali
SentinelOne Singularity Endpoint vs Anomali Logo
SentinelOne Singularity Endpoint vs Anomali
Darktrace vs Anomali Logo
Darktrace vs Anomali
IBM Security QRadar vs Anomali Logo
IBM Security QRadar vs Anomali
Microsoft Defender for Office 365 vs Anomali Logo
Microsoft Defender for Office 365 vs Anomali
Microsoft Sentinel vs Anomali Logo
Microsoft Sentinel vs Anomali
Elastic Security vs Anomali Logo
Elastic Security vs Anomali
Proofpoint Email Protection vs Anomali Logo
Proofpoint Email Protection vs Anomali
TrendAI Vision One vs Anomali Logo
TrendAI Vision One vs Anomali
TrendAI Vision One – Cloud Security vs Anomali Logo
TrendAI Vision One – Cloud Security vs Anomali
LogRhythm SIEM vs Anomali Logo
LogRhythm SIEM vs Anomali
See all alternatives
 
Anomali Reviews Summary
Author infoRatingReview Summary
Lead Cyber Threat Intelligence Incident Response Engineer & Security Engineer at a retailer with 10,001+ employees4.0Anomali excels at centralizing threat intelligence from various sources, integrating with SIEMs like Splunk, and saving significant time. Its UI and querying are great, though I'd like to see global attack heat maps and improved credential monitoring. I highly recommend it.
Security Consultant at a tech vendor with 10,001+ employees4.0I find Anomali a versatile, stable, and effective threat intelligence platform for IoCs, greatly improving operational efficiency. However, its integrators have limited capacity for large deployments, requiring many instances and causing administrative challenges.
Enterprise Security Architect V at FirstEnergy4.0We use Anomali as our central threat intelligence platform to store and correlate various feeds, enabling proactive threat hunting. Its powerful API supports our automation needs. While promising, the AI features still need improvement as technology advances.
Associate Consultant at a tech vendor with 1,001-5,000 employees4.0I used Anomali's TIP and analytics to proactively integrate threat intelligence, blocking malicious activity across our security controls. This reduced our attack surface, improved vulnerability management, and significantly cut down alerts, saving me considerable time.
Senior Cyber Threat Hunter at a financial services firm with 10,001+ employees4.5I use Anomali for threat hunting and intelligence operationalization, valuing its threat modeling capabilities. Improvements are needed in its community intelligence sharing and tagging system. I've evaluated alternatives like Recorded Future and Mandiant Advantage but still use Anomali.
Managing Member at a tech vendor with self employed3.5We use Anomali as a threat intelligence platform to stream and correlate threat feeds. Its credential monitoring feature is highly valuable despite a limited data set. However, integration improvements are needed. We switched from MISP due to its high maintenance needs.
IT Cyber Security Senior Analyst at a consultancy with 10,001+ employees3.5I find Anomali Enterprise's CTI useful and easy for continuous threat detection. While scalable and stable, I wish it integrated more features from other tools, despite its medium-to-high cost. I rate it 7/10.