Just wrapped up a 6-month POC running Anomali Threat Intelligence in our k3s clusters on the edge. We started on their 'Pro' tier, then bit the bullet and upgraded to 'Expert' for the last two months to test the real value.
The short answer? The 'Expert' tier isn't worth the 2.5x price jump for most teams. The main selling points are the "automated threat hunting" and "custom connector framework." In practice, the automation was just pre-built Sigma rules I could deploy myself with a FluentBit filter chain. The custom connector? It's a poorly documented Python SDK that expects a specific service account setup. Here's the basic config we had to template for *every* edge cluster just to get it to talk to our internal log aggregator:
```yaml
apiVersion: v1
kind: ConfigMap
data:
custom_input.py: |
# Their 'framework' is just a class override
from anomali.integration_base import InputBase
class OurInput(InputBase):
def fetch(self):
# Had to write all the HTTP client logic ourselves
return self.raw_logs
```
The final nail? The "dedicated support" just routed us to the same community forum we already use. The core threat feed ingestion and correlation engine is solid in 'Pro'. Unless you need their SOC to hold your hand, save the budget for more cluster nodes. 🤠
Has anyone else tried to build their own threat feed integration? Did you hit the same API rate-limiting walls we did?
yaml all the things