Connect with the Anomali CISO community
The only marketplace for threat intelligence, enrichments, and integrations
Choose from 200+ specialized and open source intelligence offerings to improve your security posture
With the APP Store, you can easily evaluate and purchase threat intelligence streams and investigation enrichment offerings offered by Anomali partners directly in the ThreatStream admin console, as well as customize your included subscriptions to more than 100 open-source threat feeds.
Interested in featuring your intelligence on the Anomali APP Store? Let’s discuss how you can become an Anomali Technology Partner.
Threat Intelligence Feeds
Anomali’s pre-integrated partner ecosystem includes the leading global research vendors offering indicators and insights spanning threat categories you need to secure your business, letting you easily implement your intelligence coverage strategy across a breadth of threat categories in the APP Store, including:
Threat Intelligence Partners
BforeAI is a leader in predictive security solutions helping organizations prevent intrusions and data exfiltration by predicting vectors of future attacks. The information is used in PreCrime™ - predictive cyber threat intelligence that enhances existing security solutions (firewalls, DNS resolvers, anti-phish filters, proxies, etc.) with foresight. BforeAI's patented AI technology combined with hyperscale observation infrastructure and modern APIs augment customers' security postures with predictions.
Cisco® Secure Malware Analytics (formerly Threat Grid) combines two of the leading malware protection solutions: unified malware analysis and context-rich intelligence. It empowers security professionals to proactively defend against and quickly recover from cyber attacks. Secure Malware Analytics crowd-sources malware from a closed community and analyzes all samples using proprietary, highly secure techniques that include static and dynamic (sandboxing) analysis. It correlates the results with hundreds of millions of other analyzed malware artifacts to provide a global view of malware attacks, campaigns, and their distribution. Security teams can quickly correlate a single sample of observed activity and characteristics against millions of other samples to fully understand its behaviors in a historical and global context.
Cyberint's digital risk protection enhances threat intelligence using IOCs from OSINT and deep-dark-web sources. It offers a query API and daily feed to enrich security tools, blacklists, and threat intelligence with detailed indicators and scores.
Dataminr Pulse for Cyber Risk brings the leading AI-powered real-time alerting into Anomali, easily fitting into your workflows and enabling rapid identification and mitigation of emerging threats so you can deliver faster time to detection and response.
The Feedly integration with Anomali ThreatStream provides a simple way to ingest articles and threat intelligence reports discovered in Feedly. The integration ingests full article content and insights discovered by Feedly AI, such as IoCs and the relationships between threat actors, malware, TTPs, and CVEs.
Flashpoint is the pioneering leader in threat data and intelligence. We empower commercial enterprises and government agencies to decisively confront complex security challenges, reduce risk, and improve operational resilience amid fast-evolving threats. Through the Flashpoint Ignite platform, we deliver unparalleled depth, breadth, and speed of data from highly relevant sources, enriched by human insights. Our solutions span cyber threat intelligence, vulnerability intelligence, geopolitical risk, physical security, fraud, and brand protection. The result: our customers safeguard critical assets, avoid financial loss, and protect lives.
Most threat intelligence solutions suffer because the data is too hard to standardize and verify. Meta created the ThreatExchange platform so that participating organizations can share threat data using a convenient, structured, and easy-to-use API that provides privacy controls to enable sharing with only desired groups.
SEKOIA.IO CTI is a mix of exclusive SEKOIA.IO threat intelligence data coming from C2 trackers, VT trackers, honeypots and refined OSINT data. The threat intelligence provided by SEKOIA.IO is easily actionable within Anomali ThreatStream as it's highly structured in STIX 2.1, fully contextualized and built for detection purposes. SEKOIA.IO CTI subscription includes an API and a web portal access.
This Spamhaus feed provides comprehensive intelligence on Botnet infrastructure (infected devices and controllers) and Command and Control (C2) infrastructure used in malware distribution and other malicious activities.
Our Botnet Analysis & Reporting Service (BARS) provides in-depth analysis, tracking, and history of 40+ malware families that utilize unique control protocols and possibly encryption mechanisms.
Near-real-time identification of botnet command and control (C&C) IP addresses (IRC, http, and P2P) built for DDoS, warez, and underground economy to include bot types, passwords, channels, and our insight.
Near-real-time feed to allow subscribers to monitor for infected computers visiting their networks to identify compromised hosts as they access their networks, thus enabling them to monitor or block these infected hosts before they can cause any damage.
ThreatBook CTI provides high-fidelity intelligence collected from alerts from real customer cases, using ThreatBook's 99.9% high-fidelity threat intelligence to help enterprises with compromise detection, alarm noise reduction, and focusing on real threats.
iDefense empowers its customers’ environments with contextual, timely and actionable security intelligence, enabling businesses and governments to make smarter decisions to defend against new and evolving threats.
