Anomali vs Trellix Advanced Threat Defense vs Trellix Network Detection and Response comparison

Anomali and Trellix are both solutions in the Advanced Threat Protection (ATP) category. Anomali is ranked #20 with an average rating of 8.5, while Trellix is ranked #22 with an average rating of 9.0. Anomali holds a 3.2% mindshare in ATP, compared to Trellix’s 2.1% mindshare. Additionally, 80% of Anomali users are willing to recommend the solution, compared to 76% of Trellix users who would recommend it.

Anomali

Read 4 Anomali reviews

5,271 Views
843 Comparison Views

80% willing to recommend

Trellix Advanced Threat Def...

Read 9 Trellix Advanced Threat Defense reviews

978 Views
910 Comparison Views

76% willing to recommend

Trellix Network Detection a...

Read 40 Trellix Network Detection and Response reviews

3,130 Views
1,628 Comparison Views

97% willing to recommend

Anomali

Trellix Advanced Threat Def...

Trellix Network Detection a...

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Anomali, Trellix Advanced Threat Defense, and Trellix Network Detection and Response based on real PeerSpot user reviews.

Find out what your peers are saying about Palo Alto Networks, Microsoft, Proofpoint and others in Advanced Threat Protection (ATP).

To learn more, read our detailed Advanced Threat Protection (ATP) Report (Updated: April 2026).

Buyer's Guide

Advanced Threat Protection (ATP)

April 2026

Download the complete report

Helped 890,071 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of April 2026, in the Advanced Threat Protection (ATP) category, the mindshare of Anomali is 3.2%, up from 0.8% compared to the previous year. The mindshare of Trellix Advanced Threat Defense is 2.1%, up from 1.3% compared to the previous year. The mindshare of Trellix Network Detection and Response is 3.8%, up from 3.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Advanced Threat Protection (ATP) Mindshare Distribution
Product	Mindshare (%)
Trellix Network Detection and Response	3.8%
Anomali	3.2%
Trellix Advanced Threat Defense	2.1%
Other	90.9%

Advanced Threat Protection (ATP)

Featured Reviews

ChrisCollins

Enterprise Security Architect V at FirstEnergy

Enables automated threat intelligence sorting and enhances proactive threat hunting capabilities

You have to have at least a threat intelligence background or a SOC analyst background to use it, as that's the information you'll dig around with in there. If you don't have that kind of knowledge, it probably can be a little hard to use, but they do provide training. They offer training not only for how to use the platform but also some basic threat intelligence training to explain what these things are and what these terms mean. My company is a customer of Anomali. I would recommend it to other people. I would advise making sure you don't pick it without testing other products and have your use cases well thought out and documented before testing, so you know it will solve the problems you're trying to address. Keep an open mind with it and realize that whatever you can dream of, you can probably do with the platform. Overall, I would rate Anomali an eight out of ten.

Read full review

Philippe Panardie

RSSI at SDIS49

Ensuring long-term reliability while seeking internal email management enhancements

Prisma is a commercial name of the firewall now, but we don't work with the cloud product. Only our company is using it and we do not recommend it to customers. For us, it's transparent because it's a cloud product, so we don't really know the version as it's always updated. We have not had any problem, but it's difficult to report on what's going on because some days they can wash out perhaps 100 mails, and then it's difficult to say how many attacks you have reached. The right email has been washed out and then nobody has complained. We do not use the Threat Visualization feature; as we are in MX, the mail is washed out before it is in the mail inbox of the user, thus avoiding any problem requiring a reservation. In fact, there is no integration with existing security frameworks. The only problem we can have is that as we have no API interface, there is no inspection of internal mail. I rate Trellix Advanced Threat Defense a nine out of ten.

Read full review

Jose Vargas

Agente De Servicios Técnicos at a computer software company with 11-50 employees

Has improved threat detection workflows and supports seamless customer monitoring

The best features Trellix Network Detection and Response offers include very good threat detection, and I believe that it is one of the best XDR tools. For example, ePO and XDR components are very comfortable and similar to many other tools for this type of monitoring, and I have received very good feedback for this tool. What makes Trellix Network Detection and Response stand out for me compared to other tools is the way you can detect threats. It is very easy and comfortable to use, and the detection shows clearly on the screen, which is very easy to understand. Regarding the features, I think that the integration with other platforms is very comfortable with the customer because we can integrate it with any switch or firewall, and it is comfortable to add this tool. Trellix Network Detection and Response has positively impacted my organization as I have improved my knowledge about detection and response. I have already used some other tools such as CrowdStrike and Umbrella, but Trellix is one of the best that I have tested. I believe that for my organization, Trellix has helped a lot with detection and supported our customers effectively. Trellix Network Detection and Response is a great tool that integrates with a lot of security tools such as Palo Alto, which is a good firewall. If you have these types of tools, your organization would benefit greatly.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."

"We now have a very robust collection of threat intelligence based on the capabilities that Anomali provides."

"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."

"The feature I have found most valuable is credential monitoring. This feature is easy and quick."

"The most valuable aspect of Anomali is the threat modeling capability."

"It was easy to set up initially."

"Its greatest strength is the DXL client which can rapidly disseminate attack information to all clients via the McAfee Agent instead of going through the ePO server."

"It is very scalable."

"Provides good exfiltration, and is an all-in-one product."

"If a system admin can put in the patience to read and constantly update the ePO system in terms of rules, enforcing them at regular intervals, you can safely go to sleep every night."

"I see ROI, as it stops in excess of twenty-five malware events per month, all of which could be critical to the business."

"I recommend this solution because of its ease of use."

"The fact that in 10 years, we have had no problem is the most valuable feature for us; it's really a washing machine, but the only problem we face is that it's difficult to report on this product."

More Trellix Advanced Threat Defense pros

"The POC quickly revealed areas for improvement and potential threats that the traditional defenses had utterly missed."

"The most valuable feature is the view into the application."

"The simplified Alert Dashboard is straightforward to navigate."

"It has provided us with better malware, intrusion and incident detection."

"The scalability has not been a problem. We have deployed the product in very high bandwidth networks. We have never had a problem with the FireEye product causing latency issues within our networks."

"There are sandbox capabilities; you can submit malicious files and get great feedback, including if there is malware and what it is doing, and it can give you simulations in different operating systems and applications to provide real insights from the perspective of a real environment."

"The most valuable feature is the network security module."

"FireEye has placed us in the position to proactively counter malicious threats; we now don’t have to take a user offline in order to rebuild their PC following an attack."

More Trellix Network Detection and Response pros

Cons

"Less code in integration would be nice when building blocks."

"Anomali Enterprise could improve by combining all the other tools' features into one solution."

"A lot of tools can give you many features, such as CTI intelligence and a tax service reduction. However, many people are combining different tools together to have more capabilities. It is up to the consumer whether they want to have multiple tools or have one tool that serves the purpose. Anomali Enterprise could improve by combining all the other tools' features into one solution."

"An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting."

"Support in the past has been top-notch, but recent trends indicate that it has taken a back seat, as we often don't get answers for days."

"This product does the job, but it is not flexible enough to do new environments yet."

"We'd like them to be better at dealing with script threats."

"Lacks remote capabilities not dependent on the internet."

"The only problem we can have is that as we have no API interface, there is no inspection of internal mail."

"It was not complex, but there are things to look out for, because it's an intense product. It scans intensely and there are major obstacles to overcome if it scans while users are using a network, then it is not a good thing."

"This solution needs to be made "cloud ready"."

"I would like to see future versions of the solution incorporate artificial intelligence technology."

More Trellix Advanced Threat Defense cons

"There is a lot of room for Improvement in the offering, from cost to functionality. It is pretty straightforward to implement which is an advantage. However, it falls short in pricing, detection capabilities, and, most importantly, reporting and policy management."

"It would be a good idea if we could get an option to block based upon the content of an email, or the content of a file attachment."

"Technical support could be improved."

"The initial setup was complex because of the nature of our environment."

"A lot of false positives."

"If you want to search the hashes in the environment, you need to put in IOCs one by one, making it a very hectic job."

"Stability issues manifested in terms of throughput maximization."

"FireEye’s main feature is its sandboxing or threat emulation capabilities to detect malware with extra add-ons such as signature-based IPS or endpoint protection, but these features are lacking compared to most IPS or endpoint vendors."

More Trellix Network Detection and Response cons

Pricing and Cost Advice

"When comparing the price of Anomali Enterprise to other solutions it is in the medium to high range. However, I am satisfied with the price."

"The product is expensive, but it is better than the rest of them in the industry."

"Our licensing fees for this solution are approximately one million dollars per year."

"When you purchase FireEye Network Security NX, will need to purchase a megabit per second package. You must know your needs from day one."

"Pricing and licensing are reasonable compared to competitors."

"Because of what the FireEye product does, it has significantly decreased our mean time in being able to identify and detect malicious threats. The company that I work with is a very mature organization, and we have seen the meantime to analysis decrease by at least tenfold."

"FireEye is comparable to other products, such as HX, but seems expensive. It may cause us to look at other products in the market."

"It's an expensive solution."

"Its price is a bit high. A small customer cannot buy it. Its licensing is on a yearly basis."

"When I compare this solution to its competitors in the market, I find that it is a little expensive."

"The pricing is a little high."

More Trellix Network Detection and Response pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.

See recommendations

890,071 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

14%

Manufacturing Company

Construction Company

Computer Software Company

Construction Company

17%

Outsourcing Company

11%

Comms Service Provider

11%

Financial Services Firm

15%

Comms Service Provider

11%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	2
Midsize Enterprise	1
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	4
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	8
Large Enterprise	19

Questions from the Community

What needs improvement with Anomali ThreatStream?

An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsist...

See all answers

What is your primary use case for Anomali ThreatStream?

I use Anomali ( /products/anomali-reviews ) for threat hunting, threat collection, operationalization of intelligence...

See all answers

What advice do you have for others considering Anomali ThreatStream?

For new users, I recommend taking the training provided by Anomali as it is very well articulated. I advise reading t...

See all answers

What do you like most about McAfee Advanced Threat Defense?

I recommend this solution because of its ease of use.

See all answers

What needs improvement with McAfee Advanced Threat Defense?

I would like to see an API interface for internal email and control of outgoing email to make it closer to 10. It's n...

See all answers

What is your primary use case for McAfee Advanced Threat Defense?

We are working with Palo Alto products, specifically firewalls. We are only using Palo Alto Firewalls and not Cortex....

See all answers

What do you like most about FireEye Network Security?

We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. Wi...

See all answers

What is your experience regarding pricing and costs for FireEye Network Security?

My experience with pricing, setup cost, and licensing for Trellix Network Detection and Response is very great.

See all answers

What needs improvement with FireEye Network Security?

I would like to see in Trellix Network Detection and Response more explanation about some details of the threat, and ...

See all answers

Comparisons

Recorded Future vs Anomali

Compared 5% of the time

ThreatConnect Threat Intelligence Platform (TIP) vs Anomali

Compared 5% of the time

Splunk Enterprise Security vs Anomali

Compared 3% of the time

Hunters vs Anomali

Compared 3% of the time

IBM Security QRadar vs Anomali

Compared 3% of the time

More Anomali Competitors

Microsoft Defender for Office 365 vs Trellix Advanced Threat Defense

Compared 11% of the time

Fortinet FortiSandbox vs Trellix Advanced Threat Defense

Compared 11% of the time

Check Point Infinity vs Trellix Advanced Threat Defense

Compared 10% of the time

Digital Guardian vs Trellix Advanced Threat Defense

Compared 10% of the time

Palo Alto Networks WildFire vs Trellix Advanced Threat Defense

Compared 5% of the time

More Trellix Advanced Threat Defense Competitors

Palo Alto Networks WildFire vs Trellix Network Detection and Response

Compared 6% of the time

Fortinet FortiSandbox vs Trellix Network Detection and Response

Compared 6% of the time

Vectra AI vs Trellix Network Detection and Response

Compared 4% of the time

Darktrace vs Trellix Network Detection and Response

Compared 3% of the time

VMRay vs Trellix Network Detection and Response

Compared 2% of the time

More Trellix Network Detection and Response Competitors

Product Reports

Buyer's Guide

Threat Intelligence Platforms (TIP)

April 2026

Download Anomali product report

Buyer's Guide

Trellix Advanced Threat Defense

April 2026

Download Trellix Advanced Threat Defense product report

Buyer's Guide

Trellix Network Detection and Response

April 2026

Trellix Network Detection and Response report

Download Trellix Network Detection and Response product report

Also Known As

Match, Lens, ThreatStream, STAXX, Anomali Security Analytics

McAfee Advanced Threat Defense

FireEye Network Security, FireEye

Overview

Anomali delivers user-friendly cyber threat intelligence, offering concise insights with robust capabilities for evolving scenarios.

Anomali offers a powerful platform for cyber threat intelligence, allowing organizations to efficiently stream and analyze threat feeds. It excels in threat modeling, prioritizing intelligence, and supporting large-scale automation through its API, fostering a proactive security approach.

What are Anomali's Key Features?

Threat Intelligence: Provides concise and user-friendly intelligence.
Threat Modeling: Enables prioritization and efficient organization of intelligence.
Credential Monitoring: Performs quickly with efficient dataset handling.
API Automation: Supports large-scale automation for robust intelligence management.
Adaptability: Offers capabilities to grow beyond initial use cases.

Which Benefits or ROI Should Users Consider?

Efficient Intelligence Collection: Quickly gathers and organizes data for use.
Enhanced Threat Analysis: Correlates data effectively for proactive security.
Automation Support: Saves time with extensive API capabilities.
Scalability: Adapts and scales with emerging security needs.

Anomali serves as a crucial tool for threat intelligence in industries ranging from finance to healthcare. Organizations stream threat feeds into Anomali to correlate and aggregate data, enhancing security measures and facilitating thorough threat investigations. Its adaptability makes it suitable across different sectors.

Anomali

Powerful advanced threat detection

Uncover Hidden Threats

Combine in-depth static code analysis, dynamic analysis (malware sandboxing), and machine learning to increase zero-day threat and ransomware detection.

Threat Intelligence Sharing

Immediately share threat intelligence across your entire infrastructure—including multi-vendor ecosystems—to reduce time from threat encounter to containment.

Enable Investigation

Validate threats and access critical indicators of compromise (IoCs) needed for investigation and threat hunting.

Trellix

Detect the undetectable and stop evasive attacks. Trellix Network Detection and Response (NDR) helps your team focus on real attacks, contain intrusions with speed and intelligence, and eliminate your cybersecurity weak points.

Trellix

Sample Customers

Bank of England, First Energy, UBISOFT, Bank of Hope, Blackhawk Network

The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust

FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems

Buyer's Guide

Advanced Threat Protection (ATP)

April 2026

Download Free Report

Find out what your peers are saying about Palo Alto Networks, Microsoft, Proofpoint and others in Advanced Threat Protection (ATP). Updated: April 2026.

DOWNLOAD NOW

890,071 professionals have used our research since 2012.