ThreatConnect Threat Intelligence Platform (TIP) Reviews

We use ThreatConnect for our platform in the database to address the issues of threat attacks within the organization. It helps us look at solutions that can protect our data from being attacked. 

Additionally, it provides an alert mechanism to warn clients in case of internet attacks, focusing on data and information protection.

I like their customer support. Within a short period of contacting them, they resolve issues efficiently. The features are simple to use, and the interface is user-friendly, making it easy to navigate and apply the solutions. ThreatConnect helps us manage patch management and information within the organization effectively.

ThreatConnect aggregates and operationalizes Threat intelligence data and sources across internal client environments. It leverages Automation and built in Case Management to streamline and automate threat intelligence-driven processes and investigations within client environments.

ThreatConnect is not used at Spire, but at client sites.

The solution was used for publishing artefacts and threat intel data. We gathered data from the internet and uploaded it to the platform. It was integrated into every aspect of our cybersecurity network, like endpoints, SOC management, patch management, and vulnerability management tools.

TIP and SOAR are correlated. Neither one could exist alone. If the data is not available in TIP, we won’t be able to write the playbooks. For example, we used to give the client a daily update of the topmost dangerous hashes, IPs, or APTs. We used to upload everything. However, the tool would categorize it. The product automatically generated a threat score based on the maliciousness of an IP. It would correlate with other threat Intel databases.

I was doing research on this product by implementing a proof of concept.

It is used to help an operations team with the identification and resolution of threats in an automated, zero-touch fashion. Basically, it reduces the time to detect and repair any incident related to security. 

It is the security operations people or security engineers who use it.

The most valuable features are ease of use and the ability to customize it.

I use it mainly for investigation. I have found it really useful to track and map threat actors. It can be used for balloting as well.

It's a solid platform and is stable enough. It is not complicated and is easy to use.

I use ThreatConnect to see what threats are coming in. I also use it to look at threats in the community. 

ThreatConnect has a highly user-friendly interface. I loved it. It's really great. It's also easy to configure.