After running Anomali ThreatStream for our SOC's threat intelligence platform (TIP) needs for three years, we made the decision to migrate our core threat hunting workflows to the Elastic Stack. The primary driver was cost, but the operational impact was more nuanced. For teams considering a similar move, here’s a breakdown of our analysis.
**Cost Structure Comparison (Annual, ~500M events/day)**
* **Anomali (Enterprise SaaS):** Fixed per-user license for the TIP + variable data ingestion fees for the integrated data lake. Our spend was predictable but plateaued at a high floor. Scaling meant negotiating new tiers.
* **Elastic Security (Self-managed on AWS):** Primarily infrastructure costs (data nodes, master nodes, storage). We use a mix of Reserved Instances and Spot for the data layer. The main variables are EC2 (compute) and EBS (storage) costs, which we can optimize directly via AWS tools and instance right-sizing.
**The Trade-Offs: Where We Gained and Lost**
✅ **Benefits Realized:**
* **Cost Reduction:** ~40% lower annual run-rate for equivalent data volume. The biggest saving came from decoupling compute and storage, allowing independent scaling.
* **Operational Flexibility:** Native integration with our existing log sources in Elastic was seamless. Custom detections and dashboards are now part of a single pipeline.
* **Hunting Performance:** For ad-hoc, broad IOC searches across our internal telemetry, Elastic's query performance is faster on our hardware profile.
❌ **Compromises Accepted:**
* **Managed Intelligence Curation:** Anomali's strength is its curated intelligence feeds and normalization. We now maintain our own feed subscriptions and normalizing pipelines, which adds non-trivial administrative overhead.
* **Out-of-the-Box TIP Workflows:** Tasks like intelligence sharing, campaign tracking, and analyst collaboration required building internal tooling around Elastic, whereas Anomali provided those features natively.
* **Skillset Shift:** We traded vendor management for deeper infra/DevOps demands on the team.
**Conclusion:** The switch was financially vindicated and improved raw hunting agility. However, it effectively shifted costs from a software license to internal engineering labor for platform management and intelligence curation. For a mature team with strong DevOps, it's a compelling move. For a lean team needing a fully-featured TIP out of the box, Anomali's value is clearer.
Would be interested to hear if others have quantified the operational overhead of managing their own intelligence pipeline in a similar setup.
Every dollar counts.