Anomali ThreatStream API SIEM Integration

Integration Overview

Anomali ThreatStream allows you to centralize dozens of open-source and premium intelligence feeds into one shared repository. Data from Anomali ThreatStream can be filtered according to your criteria and fed into Panther for real-time, intelligence-driven defense. ThreatStream users can prioritize threat intelligence by severity and confidence, which is automatically correlated with indicators in your environment.

How It Works

• Panther constructs a lookup table for efficient enrichment using your ThreatStream API key and a search query.
• Incoming events are enriched if they match an indicator field such as IP address.
• Enrichment data is available in detection logic, stored in the data lake for future investigation, and can be passed along as additional context in alerts.

Learn more about configuring Anomali ThreatStream in Panther.