ThreatBook is a provider of cyber threat detection and response services. We developed new approaches to deliver high-fidelity, efficient, and actionable security intelligence. We integrated these capabilities with a full life cycle threat detection system and incident response mechanisms to enhance protection across cloud, network, and endpoints. This helps enterprises respond to threats efficiently, reduce complexity, and improve security operations.
Do You Manage Peer Insights at ThreatBook?
Access Vendor Portal to update and manage your profile.
First, the product highly accurate threat intelligence with very few false positives.Second, it supports automated workflows, such as integrating with firewalls or gateway devices to block malicious IPs and domains automatically, without requiring manual blocking operations.
TIP is highly open and can integrate with security platforms such as situational awareness systems and other security devices, supporting various use cases and scenarios.Second, it provides highly accurate threat intelligence, including IP reputation and compromise intelligence.Finally, ThreatBook's support service is responsive, and dedicated engineers continuously follow up and help resolve issues quickly.
1) They have an IP reputation query tool, when we need to check a large amount of data on a regular basis,we simply invoke this tool, which is very convenient. 2) After their intelligence investigation, there is a specific field that can directly provide us with suggestions for blocking as well as the reasons,and the accuracy is very high,we will rely on it quite a lot.
TIP is deployed locally, so the threat intelligence update frequency is not as high as the cloud version.Occasionally, issues may occur during version upgrades, and support from ThreatBook engineers is required to resolve them.
In my opinion, there are still a few minor weaknesses.First, the intelligence update frequency is not as timely as the cloud version. There are also some issues with the attack source distribution displayed on the TIP web interface.Finally, hope TIP can support intelligence with more brands and models of security devices.
1) Our query volume is quite large, especially for the DNS logs, which we would like to connect separately, however, they charge based on QPS, which might be a bit expensive. 2) In the original version we used, the vulnerability intelligence and asset count did not match, however, after a request was made, support was provided.