Anomali
Threat intelligence platform (ThreatStream) combined with a security data lake and SIEM
Updated · AppBreakup editorial · Web
Is Anomali free?
No, it's a paid product
3 alternatives with a free optionSwitch from Anomali to
All 5
Recorded FuturePaid
CrowdStrike FalconStarting price: $59.99 per device/year (Falcon Go, billed annually)
GreyNoiseFree plan + paid
- Verified facts
- 4 of 4
- Alternatives ranked
- 5
- Approved reviews
- 0
- Visits sent from here
- 0
About Anomali
Anomali is a security company best known for ThreatStream, a threat intelligence platform that gathers indicators and reports from open-source, commercial and sharing-community feeds, removes duplicates, scores them and pushes them to firewalls, SIEMs and other tools. In recent years Anomali has wrapped ThreatStream into a broader platform that adds a security data lake, SIEM-style search and detection, and AI assistants for investigations, so teams can match intelligence against their own logs in one place. A marketplace lets customers trial and buy premium feeds from partner vendors. For smaller teams, Anomali offers STAXX, a free tool for collecting STIX/TAXII feeds. Commercial products are sold to enterprises and government agencies by quote, and are delivered mainly as cloud services. It suits security operations and threat intelligence teams that want feed management and detection under one vendor.
Best for: SOC and CTI teams that want feed aggregation and SIEM detection from one vendor.
Pros and cons
What works
- Mature feed aggregation and indicator scoring
- Marketplace for buying premium partner feeds
- Free STAXX tool for STIX/TAXII feeds
Why people leave
- Quote-only enterprise pricing
- Full value depends on adopting its data lake and SIEM
- Less original research than Recorded Future
Anomali vs Recorded Future, CrowdStrike Falcon and GreyNoise
From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.
| Attribute | Anomali | Recorded Future | CrowdStrike Falcon | GreyNoise |
|---|---|---|---|---|
| Pricing | Paid | Paid | Paid | Free plan + paid |
| Verified price | — | — | $59.99 per device/year (Falcon Go, billed annually) | — |
| Free plan | No | No | No | Community tier for IP lookups |
| Open source | No | No | No | No |
| Self-hostable | No | No | No | No |
| Platforms | Web | Web, Browser extension | Web, Windows, macOS, Linux | Web |
Top Anomali alternatives
See all 5- 1Recorded Future68.8
Broader proprietary collection, dark web coverage and its own research team.
- 2CrowdStrike Falcon65.0
Falcon's intelligence modules tie adversary reports and IOCs directly into endpoint detection.
- 3GreyNoise61.8
Focused IP intelligence that filters out internet background scanning at a lower cost.
- 4
MISP59.4Open-source alternative to a threat intel platform you can self-host for indicator sharing and correlation.
- 5
Feedly58.5AI-curated open-source threat feeds, a cheaper way to follow vulnerabilities and attacker activity.
Why people left Anomali
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from Anomali, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of Anomali
Anomali: common questions
What is Anomali?
Anomali: Threat intelligence platform (ThreatStream) combined with a security data lake and SIEM. Best for SOC and CTI teams that want feed aggregation and SIEM detection from one vendor. Available for Web.
Is Anomali free?
No, Anomali is a paid product.
Is Anomali open source?
No, Anomali is not open source. Open-source alternatives include MISP.
What platforms does Anomali run on?
Anomali is available for Web.
What are the best alternatives to Anomali?
The highest-ranked Anomali alternatives right now are Recorded Future, CrowdStrike Falcon and GreyNoise. See the full ranked list for pricing, platforms and verified facts.
Anomali vs Recorded Future: what's the difference?
Both Anomali and Recorded Future are paid products. Only Recorded Future runs on Browser extension.