Hey everyone, I've been evaluating different threat intel platforms for my company's security pipeline, and I keep hitting a consistent issue with Anomali. In our tests, their feeds seem to be consistently slower than others—like, 6+ hours on average—when we compare IoC (like malicious IPs or new C2 domains) publication times against feeds from places like AlienVault OTX or even some open-source communities.
As someone who's trying to automate blocking with our CI/CD for security tooling, this lag is a big deal. If a new threat pops up, we need to know *fast* to update our WAF rules or network policies. A 6-hour window feels like a lifetime.
I'm trying to understand the *why* behind this. Is it their collection methodology? Are they doing more validation, which adds delay? Or is it something about their aggregation and processing pipeline? For example, our current pipeline using a Python script to compare timestamps looks something like this:
```python
# Simplified check we run hourly
for feed in feeds:
latest_ioc = get_latest_ioc(feed['url'])
delay = current_time - latest_ioc['first_seen']
print(f"{feed['name']}: {delay}")
```
Has anyone else run into this? From an infrastructure perspective, I'm curious if this is a known trade-off for maybe higher confidence data, or if there are specific settings or premium feeds that improve this. Also, how are others handling this in their automated threat response workflows? Do you just accept the lag and layer another, faster feed on top?
Learning by breaking