Anomali vs Trellix Advanced Threat Defense vs Trellix Network Detection and Response comparison

Anomali and Trellix are both solutions in the Advanced Threat Protection (ATP) category. Anomali is ranked #20 with an average rating of 8.5, while Trellix is ranked #22 with an average rating of 9.0. Anomali holds a 3.2% mindshare in ATP, compared to Trellix’s 2.1% mindshare. Additionally, 80% of Anomali users are willing to recommend the solution, compared to 76% of Trellix users who would recommend it.

Anomali

Read 4 Anomali reviews

5,271 Views
843 Comparison Views

80% willing to recommend

Trellix Advanced Threat Def...

Read 9 Trellix Advanced Threat Defense reviews

978 Views
910 Comparison Views

76% willing to recommend

Trellix Network Detection a...

Read 40 Trellix Network Detection and Response reviews

3,130 Views
1,628 Comparison Views

97% willing to recommend

Anomali

Trellix Advanced Threat Def...

Trellix Network Detection a...

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Anomali, Trellix Advanced Threat Defense, and Trellix Network Detection and Response based on real PeerSpot user reviews.

Find out what your peers are saying about Palo Alto Networks, Microsoft, Proofpoint and others in Advanced Threat Protection (ATP).

To learn more, read our detailed Advanced Threat Protection (ATP) Report (Updated: April 2026).

Buyer's Guide

Advanced Threat Protection (ATP)

April 2026

Download the complete report

Helped 890,071 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of April 2026, in the Advanced Threat Protection (ATP) category, the mindshare of Anomali is 3.2%, up from 0.8% compared to the previous year. The mindshare of Trellix Advanced Threat Defense is 2.1%, up from 1.3% compared to the previous year. The mindshare of Trellix Network Detection and Response is 3.8%, up from 3.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Advanced Threat Protection (ATP) Mindshare Distribution
Product	Mindshare (%)
Trellix Network Detection and Response	3.8%
Anomali	3.2%
Trellix Advanced Threat Defense	2.1%
Other	90.9%

Advanced Threat Protection (ATP)

Featured Reviews

ChrisCollins

Enterprise Security Architect V at FirstEnergy

Enables automated threat intelligence sorting and enhances proactive threat hunting capabilities

You have to have at least a threat intelligence background or a SOC analyst background to use it, as that's the information you'll dig around with in there. If you don't have that kind of knowledge, it probably can be a little hard to use, but they do provide training. They offer training not only for how to use the platform but also some basic threat intelligence training to explain what these things are and what these terms mean. My company is a customer of Anomali. I would recommend it to other people. I would advise making sure you don't pick it without testing other products and have your use cases well thought out and documented before testing, so you know it will solve the problems you're trying to address. Keep an open mind with it and realize that whatever you can dream of, you can probably do with the platform. Overall, I would rate Anomali an eight out of ten.

Read full review

Philippe Panardie

RSSI at SDIS49

Ensuring long-term reliability while seeking internal email management enhancements

Prisma is a commercial name of the firewall now, but we don't work with the cloud product. Only our company is using it and we do not recommend it to customers. For us, it's transparent because it's a cloud product, so we don't really know the version as it's always updated. We have not had any problem, but it's difficult to report on what's going on because some days they can wash out perhaps 100 mails, and then it's difficult to say how many attacks you have reached. The right email has been washed out and then nobody has complained. We do not use the Threat Visualization feature; as we are in MX, the mail is washed out before it is in the mail inbox of the user, thus avoiding any problem requiring a reservation. In fact, there is no integration with existing security frameworks. The only problem we can have is that as we have no API interface, there is no inspection of internal mail. I rate Trellix Advanced Threat Defense a nine out of ten.

Read full review

Jose Vargas

Agente De Servicios Técnicos at a computer software company with 11-50 employees

Has improved threat detection workflows and supports seamless customer monitoring

The best features Trellix Network Detection and Response offers include very good threat detection, and I believe that it is one of the best XDR tools. For example, ePO and XDR components are very comfortable and similar to many other tools for this type of monitoring, and I have received very good feedback for this tool. What makes Trellix Network Detection and Response stand out for me compared to other tools is the way you can detect threats. It is very easy and comfortable to use, and the detection shows clearly on the screen, which is very easy to understand. Regarding the features, I think that the integration with other platforms is very comfortable with the customer because we can integrate it with any switch or firewall, and it is comfortable to add this tool. Trellix Network Detection and Response has positively impacted my organization as I have improved my knowledge about detection and response. I have already used some other tools such as CrowdStrike and Umbrella, but Trellix is one of the best that I have tested. I believe that for my organization, Trellix has helped a lot with detection and supported our customers effectively. Trellix Network Detection and Response is a great tool that integrates with a lot of security tools such as Palo Alto, which is a good firewall. If you have these types of tools, your organization would benefit greatly.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."

"We now have a very robust collection of threat intelligence based on the capabilities that Anomali provides."

"I have found Cyber threat intelligence (CTI) very useful and concise. The solution is easy to use."

"The most valuable aspect of Anomali is the threat modeling capability."

"The feature I have found most valuable is credential monitoring. This feature is easy and quick."

"The product is expensive, but it is better than the rest of them in the industry."

"The most valuable features are the administration console and its detection and response module."

"If a system admin can put in the patience to read and constantly update the ePO system in terms of rules, enforcing them at regular intervals, you can safely go to sleep every night."

"This solution is very easy to use and requires little to no training."

"It is stable and reliable."

"It was easy to set up initially."

"It is very scalable."

"I recommend this solution because of its ease of use."

More Trellix Advanced Threat Defense pros

"Anyone who is looking for a complete network protection solution and does not have any budget issues should definitely go for it."

"Application categorization is the most valuable feature for us. Application filtering is very interesting because other products don't give you full application filtering capabilities."

"It allows us to be more hands off in checking on emails and networking traffic, as we can set up a bunch of different alerts and have it alert us, giving us a better view of our network and our email environment."

"It protects from signature-based attacks and signature-less attacks. The sandboxing technology, invented by FireEye, is very valuable. Our customers go for FireEye because of the sandboxing feature. When there is a threat or any malicious activity with a signature, it can be blocked by IPS. However, attacks that do not have any signatures and are very new can only be blocked by using the sandboxing feature, which is available only in FireEye. So, FireEye has both engines. It has an IPS engine and a sandbox engine, which is the best part. You can get complete network protection by using FireEye."

"The solution can scale."

"The scalability has not been a problem. We have deployed the product in very high bandwidth networks. We have never had a problem with the FireEye product causing latency issues within our networks."

"Application categorization is the most valuable feature for us."

"The initial setup was straightforward, you can do it by yourself, you don't have to find a partner or a FireEye expert."

More Trellix Network Detection and Response pros

Cons

"An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsistent, as any company can use any tags for their reporting."

"Less code in integration would be nice when building blocks."

"Support in the past has been top-notch, but recent trends indicate that it has taken a back seat, as we often don't get answers for days."

"A lot of tools can give you many features, such as CTI intelligence and a tax service reduction. However, many people are combining different tools together to have more capabilities. It is up to the consumer whether they want to have multiple tools or have one tool that serves the purpose. Anomali Enterprise could improve by combining all the other tools' features into one solution."

"Anomali Enterprise could improve by combining all the other tools' features into one solution."

"I would like to see future versions of the solution incorporate artificial intelligence technology."

"The only problem we can have is that as we have no API interface, there is no inspection of internal mail."

"The support on their side is not readily available. It takes a while."

"There could be a tool that automatically updates all-new Microsoft IPs, which are available for free to connect to the client."

"Make the ATD system a part of the whole product and take the whole thing onto the cloud. While it is there already, it is not to the same level as the on-premise version."

"This solution needs to be made "cloud ready"."

"Some of our customers have mentioned the lack of a tool that would allow for remote capabilities without being attached to the internet."

"The initial setup was industry standard complex. It takes awhile and has a lot of planning involved. It could be simplified with product redesign."

More Trellix Advanced Threat Defense cons

"I would love to see better reporting. Because you can't export some of the reports in proper formats, it is hard to extract the data from reports."

"It doesn't connect with the cloud, advanced machine learning is not there."

"It would be a good idea if we could get an option to block based upon the content of an email, or the content of a file attachment."

"Improvements could be achieved through greater integration capabilities with different firewall solutions. Integrating with the dashboard itself for different firewalls so users can also pull tags into their firewall dashboard."

"Cluster option is not available in NX, and for false positives we need some customization configuration available, such as a whitelist."

"The initial setup was complex because of the nature of our environment."

"Technical packaging could be improved."

"FireEye’s main feature is its sandboxing or threat emulation capabilities to detect malware with extra add-ons such as signature-based IPS or endpoint protection, but these features are lacking compared to most IPS or endpoint vendors."

More Trellix Network Detection and Response cons

Pricing and Cost Advice

"When comparing the price of Anomali Enterprise to other solutions it is in the medium to high range. However, I am satisfied with the price."

"The product is expensive, but it is better than the rest of them in the industry."

"Our licensing fees for this solution are approximately one million dollars per year."

"The user fee is not as high but the maintenance fee is expensive."

"When I compare this solution to its competitors in the market, I find that it is a little expensive."

"When you purchase FireEye Network Security NX, will need to purchase a megabit per second package. You must know your needs from day one."

"We're partners with Cisco so we get a reasonable price. It's cheaper than Palo Alto in terms of licensing."

"The tool is a bit pricey."

"Its price is a bit high. A small customer cannot buy it. Its licensing is on a yearly basis."

"The pricing is fair, a little expensive, but fair. We've evaluated other products, and they're similarly priced."

"There are some additional services that I understand the vendor provides, but our approach was to package all of the features that we were looking to use into the product."

More Trellix Network Detection and Response pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Advanced Threat Protection (ATP) solutions are best for your needs.

See recommendations

890,071 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

14%

Manufacturing Company

Construction Company

Computer Software Company

Construction Company

17%

Outsourcing Company

11%

Comms Service Provider

11%

Financial Services Firm

15%

Comms Service Provider

11%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	2
Midsize Enterprise	1
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	4
Large Enterprise	5

By reviewers
Company Size	Count
Small Business	20
Midsize Enterprise	8
Large Enterprise	19

Questions from the Community

What needs improvement with Anomali ThreatStream?

An area for improvement is the intelligence sharing within the Anomali community. The tagging system can be inconsist...

See all answers

What is your primary use case for Anomali ThreatStream?

I use Anomali ( /products/anomali-reviews ) for threat hunting, threat collection, operationalization of intelligence...

See all answers

What advice do you have for others considering Anomali ThreatStream?

For new users, I recommend taking the training provided by Anomali as it is very well articulated. I advise reading t...

See all answers

What do you like most about McAfee Advanced Threat Defense?

I recommend this solution because of its ease of use.

See all answers

What needs improvement with McAfee Advanced Threat Defense?

I would like to see an API interface for internal email and control of outgoing email to make it closer to 10. It's n...

See all answers

What is your primary use case for McAfee Advanced Threat Defense?

We are working with Palo Alto products, specifically firewalls. We are only using Palo Alto Firewalls and not Cortex....

See all answers

What do you like most about FireEye Network Security?

We wanted to cross-reference that activity with the network traffic just to be sure there was no lateral movement. Wi...

See all answers

What is your experience regarding pricing and costs for FireEye Network Security?

My experience with pricing, setup cost, and licensing for Trellix Network Detection and Response is very great.

See all answers

What needs improvement with FireEye Network Security?

I would like to see in Trellix Network Detection and Response more explanation about some details of the threat, and ...

See all answers

Comparisons

Recorded Future vs Anomali

Compared 5% of the time

ThreatConnect Threat Intelligence Platform (TIP) vs Anomali

Compared 5% of the time

Splunk Enterprise Security vs Anomali

Compared 3% of the time

Hunters vs Anomali

Compared 3% of the time

IBM Security QRadar vs Anomali

Compared 3% of the time

More Anomali Competitors

Microsoft Defender for Office 365 vs Trellix Advanced Threat Defense

Compared 11% of the time

Fortinet FortiSandbox vs Trellix Advanced Threat Defense

Compared 11% of the time

Check Point Infinity vs Trellix Advanced Threat Defense

Compared 10% of the time

Digital Guardian vs Trellix Advanced Threat Defense

Compared 10% of the time

Palo Alto Networks WildFire vs Trellix Advanced Threat Defense

Compared 5% of the time

More Trellix Advanced Threat Defense Competitors

Palo Alto Networks WildFire vs Trellix Network Detection and Response

Compared 6% of the time

Fortinet FortiSandbox vs Trellix Network Detection and Response

Compared 6% of the time

Vectra AI vs Trellix Network Detection and Response

Compared 4% of the time

Darktrace vs Trellix Network Detection and Response

Compared 3% of the time

VMRay vs Trellix Network Detection and Response

Compared 2% of the time

More Trellix Network Detection and Response Competitors

Product Reports

Buyer's Guide

Threat Intelligence Platforms (TIP)

April 2026

Download Anomali product report

Buyer's Guide

Trellix Advanced Threat Defense

April 2026

Download Trellix Advanced Threat Defense product report

Buyer's Guide

Trellix Network Detection and Response

April 2026

Trellix Network Detection and Response report

Download Trellix Network Detection and Response product report

Also Known As

Match, Lens, ThreatStream, STAXX, Anomali Security Analytics

McAfee Advanced Threat Defense

FireEye Network Security, FireEye

Overview

Anomali delivers user-friendly cyber threat intelligence, offering concise insights with robust capabilities for evolving scenarios.

Anomali offers a powerful platform for cyber threat intelligence, allowing organizations to efficiently stream and analyze threat feeds. It excels in threat modeling, prioritizing intelligence, and supporting large-scale automation through its API, fostering a proactive security approach.

What are Anomali's Key Features?

Threat Intelligence: Provides concise and user-friendly intelligence.
Threat Modeling: Enables prioritization and efficient organization of intelligence.
Credential Monitoring: Performs quickly with efficient dataset handling.
API Automation: Supports large-scale automation for robust intelligence management.
Adaptability: Offers capabilities to grow beyond initial use cases.

Which Benefits or ROI Should Users Consider?

Efficient Intelligence Collection: Quickly gathers and organizes data for use.
Enhanced Threat Analysis: Correlates data effectively for proactive security.
Automation Support: Saves time with extensive API capabilities.
Scalability: Adapts and scales with emerging security needs.

Anomali serves as a crucial tool for threat intelligence in industries ranging from finance to healthcare. Organizations stream threat feeds into Anomali to correlate and aggregate data, enhancing security measures and facilitating thorough threat investigations. Its adaptability makes it suitable across different sectors.

Anomali

Powerful advanced threat detection

Uncover Hidden Threats

Combine in-depth static code analysis, dynamic analysis (malware sandboxing), and machine learning to increase zero-day threat and ransomware detection.

Threat Intelligence Sharing

Immediately share threat intelligence across your entire infrastructure—including multi-vendor ecosystems—to reduce time from threat encounter to containment.

Enable Investigation

Validate threats and access critical indicators of compromise (IoCs) needed for investigation and threat hunting.

Trellix

Detect the undetectable and stop evasive attacks. Trellix Network Detection and Response (NDR) helps your team focus on real attacks, contain intrusions with speed and intelligence, and eliminate your cybersecurity weak points.

Trellix

Sample Customers

Bank of England, First Energy, UBISOFT, Bank of Hope, Blackhawk Network

The Radicati Group, Florida International University, MGM Resorts International, County Durham andDarlington NHS Foundation Trust

FFRDC, Finansbank, Japan Advanced Institute of Science and Technology, Investis, Kelsey-Seybold Clinic, Bank of Thailand, City of Miramar, Citizens National Bank, D-Wave Systems

Buyer's Guide

Advanced Threat Protection (ATP)

April 2026

Download Free Report

Find out what your peers are saying about Palo Alto Networks, Microsoft, Proofpoint and others in Advanced Threat Protection (ATP). Updated: April 2026.

DOWNLOAD NOW

890,071 professionals have used our research since 2012.