A year ago, our CISO was sold on the promise of "unified threat intelligence" and "automated detection." We stood up Anomali. The sales deck had those glossy workflows where an alert auto-creates a Jira ticket and a Slack notification, and the SOC analyst sips coffee while the machine does the work.
Fast forward to today. Our "Anomali team" is two full-time engineers. One spends 70% of their time just keeping the feeds flowing and normalized. The other is essentially a full-time rule janitor, because the default correlation rules either flood you with nonsense or miss the obvious. The promised "platform consolidation" actually added a new silo. We're not replacing our SIEM; we're feeding it with a more expensive, labor-intensive ingredient.
Here's a taste of the "configuration management" reality. Want to actually use that fancy threat intel in a meaningful way? Enjoy writing custom scripts to parse and push because the out-of-the-box integrations are paper-thin.
```python
# True story: Our script to get IOCs into the WAF.
# Because the "API" output needed...massaging.
import requests
from anomali_client import bogus_wrapper
def get_indicators_and_pray():
data = bogus_wrapper.get_stuff()
# Now filter out the 60% that are low-confidence
# and reformat because the field mapping is wrong.
useful = [transform(i) for i in data if i['confidence'] > 70]
# Now hand-roll the API call the docs said would be automatic.
requests.post(waf_url, json=useful, auth=(secrets_in_plaintext))
```
The ROI math is laughable. License cost plus two senior salaries versus the maybe two legit, automated catches we've had that our existing controls didn't already flag. The rest is noise, or worse, theater for the monthly threat intel briefing.
The contrarian take? The industry's obsession with "ingesting more feeds" is a trap. Intelligence isn't about volume; it's about actionable signal. This tool, for us, just made the pile of hay bigger and demanded two full-time people to manage the hay-stacking machinery. We'd have been better off investing those two FTEs into tuning our existing SIEM and writing some targeted, high-fidelity detection rules. But hey, the vendor slides looked great.