ThreatQ Reviews

We used the solution for threat mapping and managing IoCs.

ThreatQ is a very good tool. We can create playbooks. The solution’s data aggregation and correlation capabilities are good. The product has connectors for the majority of the security controls. Integrating the solution with our existing security tools and workflows was easy. If it is a unique product that is not commonly available in the market, we must request it. Otherwise, ThreatQ has the connectors for all the commonly used security controls. It has improved our threat intelligence gathering process overall.

The tool is not user-friendly. It is not beginner-friendly. It would be very difficult for a beginner to learn the tool. It will take at least two months to get familiar with it. Building the playbook is a little difficult for a beginner. The vendor must simplify the tool and make it user-friendly.

I have used the solution in the last 12 months.

The tool is stable. There might be some bugs in the playbooks. Otherwise, it is stable. I rate the stability a seven out of ten.

The tool is scalable.

The support is very responsive.

Positive

The solution can be deployed both on-premise and on the cloud. The cloud-based product is easy to set up. The on-premise version is a little difficult to set up. It is easy if we have the infrastructure.

If someone is proficient with playbooks and knows how to create the relations, they can use the product. However, I won't recommend that beginners use it. It will take some time for them to learn the tool and understand how it works. Overall, I rate the product a seven and a half out of ten.

Initially, the solution was assigned to just extract the reports we needed. We just integrated our threat feed URLs to the ThreatQ platform. We could create a report which was like a categorized report. We deployed these solutions for other customers. We had five or six customers for which we just deployed five to six VMs of ThreatQ on our customer devices and with our selections for the threat intelligence feed.

Therefore, we primarily use the solution to provide threat intelligence to our clients.

The reporting services are great. With reporting services, if you have customers that just visit a URL you can see the result - including why it's blocked and how and how the URL was first recognized as malicious. 

I'm not sure if the solution is currently missing any features. I haven't noticed anything that could be added.

The biggest challenge is the deployment. The installation of the ThreatQ only takes the highest specified and customer-specific VMs or machines in order to be deployed without errors. This needs improvement.

The solution should be simpler for the end-user in terms of reporting and navigating the product.

The solution is stable after the deployment and initialization of services. There haven't been any errors to speak of. It's not buggy. It doesn't crash or freeze. It's good.

I can't really speak to the scalability as it's been a while since I've looked at the functionality of the solution.

There was another team that handled technical support. As I never really spoke with them, I can't speak to how responsive or knowledgable they are.

I've worked with another simpler intelligence platform in the past. It was called Tines. It was simple to integrate everything, and we just followed a video guide in order to implement it. I've also worked with Anomali.

Currently, I work with Kaspersky. We did an integration on it and we installed it on our Windows server to check its stability. As a software engineer, we worked on Ubuntu and Linux.

The support team of ThreatQ set up a VM on our VPN, which was SlashNext's private VPN. Then we just initiated some system calls and ThreatQ provided us the configuration file with our settings (like our email, our API key, our URL, our category, etc.). They set up a VM on our private VPN cloud. And then they provided us the configuration file in which we just entered our details like our company URL, our API category, and API keys et cetera.

We could just add it on the configuration file. We just uploaded it to the ThreatQ server. After running the system calls, we just initiated the ThreatQ and then performed tasks on the UI, such as categorizing the reports. If we only wanted the report for phishing, then we just manipulated the data on the UI and just extracted the reports. That's all.

The deployment was complex. We used high hardware specifications. I don't remember the exact specifications, however, I recall them being high. There were some services that had some compatibility errors. That's why we had our VMs - to make sure that the customer would not face any errors. Everything's deployed with high specifications and custom specifications. That was the biggest challenge for us - to deploy on the customer VMs.

On average, deployment takes 15-20 minutes if it's deployed without any errors.

I was with one of the NetOps network admin during deployment. We were only two people and we just deployed and installed all services and we executed the deployment.

The ThreatQ support team assisted us with the implementation.

If we're talking about user experience, from the customer experience point of view, the UI should be simpler. It should be diagrammatically similar to Tines, which is very user friendly. Everything from reporting to event details could be simpler. The deployment should be lighter as well. A new user should know these two aspects of the solution before they consider implementing it.

Overall, I'd rate the solution seven out of ten.