Download the Threat Intelligence Platforms Buyer's Guide including reviews and more. Updated: December 2022
The ThreatConnect Platform allows security teams to go beyond managing threat intel to operationalizing and making threat intel actionable. The Platform is built on a market-leading threat intelligence platform that includes a modern analytics engine leveraging machine learning, orchestration and automation, case management, and an extensible API along with a marketplace of apps to seamlessly connect tools into the platform.
Threat Intelligence Data Model, Library and Scoring - Native threat intelligence management built into the Platform that ingests dozens of commercial and open source threat feeds, as well as intel shared via STIX and TAXII, then normalizes and scores the intelligence making it ready for action.
Analytics Engine - A key differentiator in the ThreatConnect Platform is our analytics engine – CAL – that leverages machine learning and provides multiple capabilities such as: Community-powered insights on threats and indicators across ThreatConnect users, a “Rosetta Stone” that automatically translates the aliases of threat actor groups used across the threat intel landscape, a series of intelligence feeds that marry our massive dataset with our cutting edge tradecraft and analytics to bring novel datasets that nobody else is talking about, and Report Cards that allow you to track how open source TI feeds are performing in the real world.
Threat Graph - ThreatConnect’s Threat Graph visualization is a game changer that provides an environment where analysts can quickly explore, pivot, and gain insight into the connection between seemingly disparate intelligence and data points to get a comprehensive picture of a threat to the organization.
Low-Code Automation and Workflow - Low-code security automation and workflows are core capabilities of our Platform, enabling CTI and SecOps teams to gain efficiencies, improve consistency, and increase their efficacy by standardizing on specific processes and workflows, and automating repetitive tasks, processes, and playbooks, generating significant ROI for security teams by reducing the manual burden on analysts.
Browser Extension - Allows analysts to instantaneously scan and identify relevant pieces of information from any web-based resource with a simple click of a button. It allows analysts to quickly understand what is currently known about an indicator and to add it to the Threat Library to aid in future analysis and investigation efforts, as well as translate threat actor aliases in real-time.
I was doing research on this product by implementing a proof of concept.
It is used to help an operations team with the identification and resolution of threats in an automated, zero-touch fashion. Basically, it reduces the time to detect and repair any incident related to security.
It is the security operations people or security engineers who use it.
The most valuable features are ease of use and the ability to customize it.
Integration is an area that could use some improvement.
We began using ThreatConnect about a year ago.
This is a reliable product and it's pretty stable in terms of how much traffic it can handle, as well as uptime.
ThreatConnect is pretty scalable. In our proof of concept, we didn't stress stuff to the point where it breaks, so we didn't get into a situation where we could see how much it can handle in a heavy load environment.
I find that the technical support is very good. They are very responsive and knowledgeable.
The price of this product is in the mid-range, not too expensive, nor inexpensive.
My advice for anybody who is implementing ThreatConnect is that they really have to understand what the use cases are, that they are trying to address. A lot of times, there is no one-size-fits-all model or solution. With an understand of the use case, they have to work closely with the vendor to ensure that it will deliver on the feature and the capabilities that they're looking for.
I would rate this solution a nine out of ten.
