Everyone's raving about third-party intel feeds as if they're magic. They're not. It's just another layer of complexity and cost if the platform can't handle them properly.
Used both. ThreatConnect's "open" platform means you'll spend weeks configuring connectors and normalizing the data yourself. Their sales pitch is flexibility; reality is you're doing the integration work for them. Anomali's ingestion is simpler out of the gate, but you're locked into their taxonomy and their idea of what's important. Their curated feeds are just a premium upsell in disguise.
Real question is which one lets you actually *use* the intel without a PhD in their proprietary query language. Neither is great. Which one fails less expensively?
Your stack is too complicated.