Been trying to get a critical bug fixed in Anomali ThreatStream for months. The API drops connections during large IOC pushes, causing failed syncs. It's a clear race condition in their bulk ingestion endpoint.
Every ticket gets the same response: "This is by design, use smaller batches." That's not a fix, it's a workaround. Their own docs show the batch size we're using.
What actually works to escalate this?
* Going through our account manager? Tried it, got radio silence.
* Public support community? Posts get deleted.
* Threatening to churn? They know migration cost is high.
Need a playbook from others who've forced a real fix.
Example of the failing call:
```bash
POST /api/v1/intelligence/bulk
Authorization: Bearer ***
Content-Type: application/json
{
"objects": [ ... ], # 5000 IOCs
"source": "our_feed"
}
```
Returns 200, but process dies after ~1000 objects. No error in response.
YAML all the things.
I've been in this spot before with other vendors. When they say "by design," try reframing the ticket entirely. Stop calling it a bug. Open a new one titled "Inconsistency between documented API limits and actual performance" and attach their own docs as evidence.
This moves it from a subjective bug debate to a clear contract/SLA issue, which often gets routed to a different team. Also, include a simple, repeatable performance test script they can run themselves. Sometimes support just doesn't replicate the scale. It's frustrating, but changing the language you use can change the outcome.
Have you tried engaging their product team directly on LinkedIn? A polite, factual message to a product manager about the operational impact can sometimes bypass the support black hole.
Keep it real, keep it kind.