Connect with the Anomali CISO community
Anomali Preferred Partner Store
The only marketplace for threat intelligence, enrichments, and integrations.
Turnkey integrations with your existing security infrastructure
Anomali ThreatStream aggregates threat intelligence under one platform, providing an integrated set of tools to support fast, efficient investigations, and delivering "operationalized" threat intelligence into security controls at machine speed.
Interested in leveraging threat intelligence in your security solution? Become an Anomali Technology Partner and let's solve customer problems together!
SIEM Integrations
Add high-fidelity threat intelligence to event data in your SIEM so your SOC analysts can focus on the real threats rather than false positives. Anomali continuously gathers and risk-ranks threat intelligence (for severity and confidence) and delivers enriched, prioritized IoCs with threat context and relevance to your SIEM for monitoring and detection of security threats in your enterprise infrastructure.
Anomali's security operations ecosystem includes turnkey integrations with the leading SIEM and data lake solutions, including:
SOAR Integrations
SOAR tools give your SOC team the ability to automate and orchestrate the security incident response lifecycle. Anomali's threat intelligence and detection products tightly integrate with the industry's leading SOAR solutions, providing the triggers to initiate incident response and remediation, as well as to help incident response teams enrich, investigate and prioritize incidents with contextualized threat intelligence.
Integrated Anomali SOAR partners include:
Firewalls and Network Security Integrations
Firewalls and network security solutions – often regarded as the key to preventing malicious threats from penetrating your network – are tightly integrated with the Anomali ThreatStream platform. ThreatStream automatically delivers the high-fidelity threat intelligence of your choice to your network perimeter and security products to actively protect your users and assets and to minimize false positives.
Anomali network security solution partners with ready-to-deploy integrations include:
Endpoint Security Integrations
Focus on meaningful threats by combining real-time threat intelligence with event data in your endpoint detection and response deployment, allowing your security team to defend proactively and respond faster. In addition to the automated delivery of enriched and risk-ranked indicators to your protection services, integrated External Lookup gives your analysts needed information about alerts at their fingertips, taking them to Anomali ThreatStream intelligence details pages. From here, analysts are provided with all available context – and should an indicator be attributed to a specific actor group or campaign, ThreatStream will provide related observables and threat models which you need to be aware of to efficiently thwart attacks.
Anomali endpoint security solution partners with off-the-shelf integrations include:
Risk & Vulnerability Management Integrations
Integrate Anomali with your risk and vulnerability management platform to understand the health of your corporate assets and how adversaries might impact your business. Our integrations can help you understand how gaps in your security could be leveraged by an adversary to gain access to key assets, and focus your corrective actions before a breach event can take place. Automated, real-time delivery of critical, contextualized intelligence on the most relevant threat actors and their TTPs allows you to identify related control gaps or misconfigurations, then refine your security stack to reduce risk and increase assurance.
Anomali risk and vulnerability management solution partners with off-the-shelf integrations including:
This enrichment integrates vulnerability assessment data and queries vulnerable hosts from Qualys VM, allowing for risk prioritization that is based on real-world activity.
The Anomali and ServiceNow integration leverages a bi-directional workflow that works hand-in-hand to consolidate incident intelligence and remediation processes. Anomali ThreatStream and ServiceNow Security Operations work together to accelerate investigation and remediation of security incidents.This is accomplished by associating intelligence about indicators of compromise in ServiceNow security incidents with context from AnomaliThreatStream, including threat score, confidence level, source, and severity.
The Anomali ThreatStream App for Splunk empowers Splunk users to leverage threat intelligence to detect, prioritize, and response to security incidents. It provides Splunk users with threat data collected and curated from industry leading threat intelligence platform ThreatStream to correlate with your log data in Splunk, detect malicious activities in incoming and outgoing traffic, alert security teams, and provide you with detailed contextual information from a variety of threat sources (open source, commercial, Anomali Labs, customer internal, etc.).
Tenable delivers unparalleled coverage and comprehensive insight to enable you to detect vulnerabilities, assess risk, and prioritize remediation for every asset, in every environment.
Anomali ThreatStream has an enrichment integration available for Tenable Security Center -Tenable's on-premise risk and vulnerability management solution. This enrichment allows users to query their Tenable Security Center instance with a vulnerability, and view affected asset details in ThreatStream for further analysis.
