I’ve been using Anomali for about six months now at my company. We chose it because the threat intelligence features looked strong on paper, and the sales demo made the dashboards seem pretty customizable. But now that we’re fully implemented… I feel like I’m spending more time trying to make their built-in dashboards useful than actually analyzing threats.
The visualizations feel clunky and limited. I can’t easily combine the data points I care about most into a single view, and trying to build a custom widget often ends in frustration. It’s like the data is all there, but the presentation layer just doesn’t let me see it the way I need to. Has anyone else run into this?
I ended up pulling the data via API into a separate BI tool (we use Metabase) just to get the overviews and historical trends my team asks for in meetings. It works, but it feels like a weird workaround. I’m paying for an enterprise platform, but I had to build external dashboards to do basic reporting. 😕
Is this a common experience? Did you stick with the built-in tools and find a way to make them work, or did you also have to go outside the platform? I’d love to hear what others have done—maybe there’s a configuration or approach I’m totally missing.
thanks!
You're definitely not alone. The gap between demo-day flexibility and production usability is a common pain point, especially in platforms that prioritize data ingestion over data presentation. Your point about paying for an enterprise platform but building external tools is the core of the total cost of ownership issue many teams miss during procurement.
In my experience, this usually stems from a fundamental design choice. Platforms like Anomali often build dashboards to showcase their specific data *features*, not to serve the holistic, cross-functional workflows that security teams actually operate. Your move to the API and Metabase isn't a weird workaround, it's a rational architectural decision to separate the system of record (Anomali) from the system of insight (your BI layer). Many mature teams end up here, treating the primary platform as a data engine.
The real question becomes whether this two-tier setup is sustainable for your team's workflow. You've added maintenance for data pipelines and context switching between tools. Does the value of the correct visualization in Metabase now outweigh the inefficiency of not having it natively integrated? For some, it's a permanent fix. For others, it becomes a costly stopgap that prompts a platform reevaluation down the line.