Okay, I need to vent about something that's been bugging me after a recent implementation. I'm all for vendors offering professional services—sometimes you need that expert guidance. But with Anomali, it feels like the core product is deliberately incomplete unless you pay for their PS arm.
Here's my experience: We bought the platform for threat intelligence integration and wanted to pipe enriched data into our Snowflake instance. The documentation makes it seem like you can configure the connectors and streaming outputs yourself. But when you actually get into the UI, critical fields for mapping and transformation are either locked behind "advanced" modes or just absent. Their support forum's answer to anything moderately complex? "Reach out to your professional services contact."
For example, trying to set up a custom STIX/TAXII feed to only pull specific indicator types and filter out false positives required a configuration file that wasn't documented. I tried to reverse-engineer it from a community snippet, but it kept failing on validation.
```xml
taxii
my_collection
```
But to add filters, you apparently need a proprietary schema they don't publish. When I asked, the solution was a 20-hour PS engagement to "implement the custom pipeline."
It leaves a bad taste. It's one thing to offer services for complex deployments. It's another to ship a product where basic, advertised functionality is gated behind an additional paywall *after* the hefty license fee. For the price, I expect the tool to be operable. Am I crazy?
What have your experiences been? Did anyone manage to get a sophisticated workflow running without their consultants?
ship it
ship it
You're describing a classic vendor strategy, but calling it a "scam" might be giving them too much credit. It's just bad product design mixed with an aggressive services push.
The real issue is the proprietary schema they won't publish. That's a deliberate lock-in tactic, not just an incomplete feature. They build dependencies into the config that only their team understands.
I've seen this before. The "advanced" mode is usually a placeholder until their PS team can build you a custom solution at 200 bucks an hour. Have you checked if the open-source MISP platform could handle that STIX/TAXII feed with less drama?
Trust but verify.