
![Microsoft Defender Threat Intelligence [EOL] Logo](https://images.peerspot.com/image/upload/c_scale,dpr_3.0,f_auto,q_100,w_64/GqfBeX9zWxZG3rC5hyrUo9Aq.jpeg?_a=BACAGSGT)
Anomali and Microsoft Defender Threat Intelligence [EOL] are both prominent products in the threat intelligence category. Anomali stands out in terms of customer satisfaction with pricing and ease of deployment, while Microsoft Defender is chosen for its robust features despite its higher cost.
Features: Anomali delivers comprehensive threat detection and analysis with a focus on real-time intelligence and security infrastructure integration. It enhances visibility through extensive threat feeds and machine learning. Microsoft Defender Threat Intelligence [EOL] features strong threat intelligence integrated within Microsoft's security suite, offering seamless integration, advanced analytics, and a suite of solutions.
Room for Improvement: Anomali could enhance its scalability to match larger enterprises' needs, improve user interface customization, and broaden its documentation resources. Microsoft Defender Threat Intelligence [EOL] might reduce complexity for simpler setups, streamline its integration with non-Microsoft tools, and offer more flexible pricing options to accommodate smaller businesses.
Ease of Deployment and Customer Service: Anomali provides a straightforward deployment process with extensive customer support, facilitating quicker setup and integration. Microsoft Defender Threat Intelligence [EOL], while offering deep integration within its suite, might require more effort due to its comprehensive nature, although it benefits from the extensive Microsoft ecosystem support.
Pricing and ROI: Anomali is known for a lower upfront cost and a quicker return on investment with its efficient deployment and usage-based pricing model. Microsoft Defender Threat Intelligence [EOL], while more costly, provides significant value through its comprehensive features and scalability, making it a justified investment for larger enterprises.
Analyst productivity has improved significantly, with hours saved because of automation and AI-driven work that Anomali performs.
There is a return on investment concerning time and effort saved by 40% after implementing Anomali.
It's a value-for-money product.
They have strong onboarding and deployment assistance, provide a dedicated technical account manager for large customers, and engage in regular product updates and customer interaction.
The technical support at Anomali is excellent.
It doesn't seem very professional how they're handling support anymore.
Level two support is knowledgeable and knows how the product works, which is very good.
I would give Microsoft an eight for their technical support.
The scalability is massive, allowing us to store millions of indicators.
I believe Anomali's scalability is good; whether it is an organization for ten people or one hundred thousand people, the job a threat intel platform has to do will be the same.
Anomali's scalability is impressive as a mature platform capable of processing large amounts of threat intelligence and indicators of compromise data.
If there were some customizations available, I would rate its scalability as nine out of ten.
From a reliability perspective, Anomali consistently injects threat feeds, works on automation, performs reliable API integrations, and supports enterprise scale globally.
For example, while Microsoft allows ample time for users to adapt to deprecated features, Anomali only gave us three weeks before switching, so they need to be more cognizant of customer use cases from their engineering side.
The good thing is that they have a health check page, and if any issues arise, they notify us.
It provides a high level of security and avoids phishing and scam emails.
Combining all aliases into a coherent solution would be beneficial, as we had to review each individual source ourselves.
Anomali should increase their capability to fetch details from various dark web solutions where threat actors post compromised credentials.
Anomali's ability to correlate and integrate different Threat Intel platforms, such as Mandiant and PolySwarm, is another valuable feature, removing duplicacy and enabling the application of specific IOCs across various security controls.
Providing code customization would help keep pace with new vulnerabilities and threats.
The main area of improvement for Microsoft Defender Threat Intelligence is related to how information is conveyed.
From the telemetry data standpoint, I would prefer Defender data to be more open in future updates.
Pricing and licensing are good, but the costs for purchasing threat feeds are somewhat complicated and a bit on the higher side.
Regarding integration, Anomali has capabilities to integrate with different downstream applications such as Palo Alto, allowing us to create playbooks to block domains, URLs, or IPs directly within the firewall.
Correlating IOCs with the telemetry data we are ingesting from our data sources allows us to pull monthly reports identifying how many assets and users interacted with malicious content, giving insight into whether communications failed or users accessed restricted content, providing complete visibility of the IOCs traveling throughout our environment.
It aggregates intelligence from hundreds of sources, automatically de-duplicates, applies risk scoring, applies context, and reduces much manual effort.
If it wasn't for that real-time threat detection on the vulnerability, I think we would not have survived the attack.
One of the best features is that it provides a certain level of customization, allowing us to set our spam confidence levels.
Our threat detection is enhanced due to the AI agents in Microsoft Defender Threat Intelligence, which helps in detecting automatically.

| Company Size | Count |
|---|---|
| Small Business | 2 |
| Midsize Enterprise | 1 |
| Large Enterprise | 14 |
| Company Size | Count |
|---|---|
| Small Business | 17 |
| Midsize Enterprise | 2 |
| Large Enterprise | 15 |
Anomali delivers user-friendly cyber threat intelligence, offering concise insights with robust capabilities for evolving scenarios.
Anomali offers a powerful platform for cyber threat intelligence, allowing organizations to efficiently stream and analyze threat feeds. It excels in threat modeling, prioritizing intelligence, and supporting large-scale automation through its API, fostering a proactive security approach.
What are Anomali's Key Features?Anomali serves as a crucial tool for threat intelligence in industries ranging from finance to healthcare. Organizations stream threat feeds into Anomali to correlate and aggregate data, enhancing security measures and facilitating thorough threat investigations. Its adaptability makes it suitable across different sectors.
Microsoft Defender Threat Intelligence [EOL] offers comprehensive security by integrating with Microsoft platforms, retaining data within tenants, and providing real-time threat detection and collaboration. It's designed for both enterprise and SMB environments.
Microsoft Defender Threat Intelligence enhances cybersecurity operations by integrating with Azure Sentinel and Microsoft products like Intune and Azure. Its capabilities in endpoint, email, and cloud security ensure robust protection against a wide range of threats. With global threat data, anti-spam features, and customization options, it addresses threat prevention and vulnerability management. Seamless scaling and proactive incident prevention make it a reliable choice for enterprises looking for collaborative, efficient security management.
What are the key features of Microsoft Defender Threat Intelligence?Microsoft Defender Threat Intelligence is crucial for industries that value data retention and comprehensive threat analyses in safeguarding their operations. Financial institutions, healthcare providers, and technology firms implement this solution to secure their environments by updating security protocols and ensuring compliance with various industry standards. The focus on integration and customization helps these organizations adapt to evolving cybersecurity threats effectively.
We monitor all Advanced Threat Protection (ATP) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.