IBM X-Force Exchange vs ThreatQ

IBM X-Force Exchange is a cloud-based threat intelligence platform for researching security threats, collecting intelligence, and collaborating with peers. Its reports provide context for IP addresses, URLs, malware hashes, web applications, signatures, and vulnerabilities. Logged-in users can search, comment, share research, and create public or private collections containing indicators, reports, and other research content. A QRadar plug-in looks up IP and URL information from events and lets users send data from searches, offenses, and rules to collections. The API documentation covers IP and URL category feeds, reports, vulnerability feeds, and TAXII feeds, with JSON and STIX/TAXII formats. However, API use requires a purchased premium subscription; freemium API keys no longer have API access. The free plan provides limited portal access, and guest users cannot use every website feature. The GUI requires a supported browser and a direct internet connection. IBM describes API Enterprise as suitable for security operations centers and managed security service providers.

ThreatQ is a cyber threat intelligence platform for collecting, prioritizing, analyzing and operationalizing threat information. It ingests material from commercial feeds, open sources, ISACs, partners and internal tools, then normalizes, correlates and enriches it. Threat Library applies customer-defined parameters and organizational context to score and prioritize intelligence. Adaptive Workbench supports configurable enrichment, workflows, prioritization logic, watchlists and operations using existing tools and workflows. The marketplace lists over 450 integrations, with APIs and SDKs available for customization. Integration listings have differing support designations, and ThreatQuotient does not maintain integrations published by other parties. ThreatQ v6 has standard and air-gapped installation guides. Investigations, Data Exchange and TDR Orchestrator are additional modules outside the default deployment. Authentication can use local accounts, LDAP, SAML or SSL client certificates, and account-level two-step verification is available. The default session timeout is sixty minutes of inactivity. Pricing is on request; the platform requires a license, and licenses are not perpetual.