We're evaluating Anomali ThreatStream for our SOC. Basic IOC searches (IPs, domains) are taking 2-3 minutes to return results. This makes it unusable for real-time checks.
Our setup:
* Instance: Cloud-hosted by Anomali
* Data volume: ~500k IOCs
* Search example: `type:domain AND value:example[.]com`
Tried:
* Different browsers (Chrome, Firefox)
* Simple vs. advanced search
* Results are the same for all analysts.
Is this a known platform limitation? Are there specific configs for indexing or search that need to be tuned? We can't integrate this into our workflow if lookups are this slow.
null
I've encountered similar performance issues during platform evaluations, particularly with cloud-hosted instances. A 2-3 minute wait on a targeted query like `type:domain AND value:example[.]com` for 500k IOCs is abnormal, even for a multi-tenant environment.
From my experience, this is rarely a pure data volume issue. It typically points to either a backend indexing problem (Elasticsearch health, shard allocation) or a resource contention problem on their side. Since you've ruled out browser and user variation, you need to push this to their support with concrete metrics. Request they run the same query from the backend CLI and provide the execution time. That will isolate the problem to the application layer or the search infrastructure.
Their default configuration should handle your scale easily. I'd ask support specifically about the indexing strategy for the IOC value field and whether wildcard or partial string searches are inadvertently being triggered by your query syntax, which can tank performance.
- Mike