Anomali ThreatStream
by Anomali Inc.
Anomali ThreatStream is a leading cyber threat intelligence platform that aggregates, normalizes, and operationalizes threat intelligence from hundreds of commercial, open source, and government feeds — making the Anomali threat intelligence platform the go-to choice for organizations wanting to integrate TIP with SIEM and SOAR at scale.
Starting Price
Starts at ~$20,000/year; enterprise full-platform pricing on quote; contact anomali.com
G2
Gartner
Capterra
Ratings & Reviews
Key Features
- ThreatStream — Central Threat Intelligence Management Platform
- Anomali Lens — Browser Extension for IOC Identification
- Anomali Match — Real-Time Threat Detection Against SIEM/EDR Logs
- 200+ Pre-Integrated Threat Intelligence Feeds
- STIX/TAXII Standard Support
- IOC Lifecycle Management — Scoring
- Enrichment
- Expiry
- Threat Actor Library — 1
- 000+ Named Threat Groups
- Anomali AI — Automated IOC Enrichment & Investigation
- Dark Web Collection
- Vulnerability Intelligence Module
- Third-Party Risk Intelligence
- Threat Intelligence Sharing (ISAC/ISAO Integration)
- MITRE ATT&CK Mapping & Visualization
Pros & Cons
Pros
- +Best anomali threat intelligence platform for SIEM integration — Anomali Match detects threats against existing SIEM logs in real time
- +200+ pre-integrated threat feeds — fastest time-to-value for threat intelligence operationalization
- +On-premise deployment option — critical for air-gapped and classified environments
- +STIX/TAXII support enables sharing with government ISACs and ISAOs
- +Anomali Lens browser extension identifies IOCs in any web page — unique usability feature
- +Strong MITRE ATT&CK visualization for threat actor profiling
Cons
- −UI complexity can overwhelm analysts new to threat intelligence platforms
- −On-premise deployment requires significant infrastructure investment
- −Less AI maturity vs. Recorded Future for automated intelligence generation
- −Modular pricing — full capability requires multiple add-on purchases
- −Smaller dark web coverage than Recorded Future
Best For
Enterprise security operations teams wanting a best threat intelligence platform for operationalizing hundreds of commercial and open source feeds directly into existing SIEM and SOAR workflows — with on-premise deployment for regulated and air-gapped environments.
Target Audience
Enterprise, Government, Financial Services, Healthcare, MSSPs, ISACs
Key Integrations
Competitor Tools
Pricing
Model
Annual subscription — per user or per feed volume; ThreatStream, Lens, Match modules priced separately
Starting At
Starts at ~$20,000/year; enterprise full-platform pricing on quote; contact anomali.com
Free Trial
Yes — free trial and demo available at anomali.comCompany Info
Founded
2013
Headquarters
Redwood City, CA, USA
Employees
500+
Company Size
Mid-Market & Enterprise (200+ employees)
Funding
Private — Series D; backed by General Catalyst, GV (Google Ventures), Paladin Capital. Total raised: ~$140M
Certifications
Awards & Recognition
Gartner Magic Quadrant Leader — Security Threat Intelligence Services 2025 | Forrester Wave Strong Performer — TIP Q3 2025 | SC Awards TIP Finalist 2025 | IDC MarketScape Major Player — TIP 2025
Data sourced from G2, Gartner & Capterra · Verified by Firmographic