Security Vision TIP vs ThreatQ

Security Vision TIP collects, analyzes and enriches threat data to help security teams detect, investigate and respond to activity across infrastructure. It covers technical, tactical, operational and strategic indicators, including hashes, IP addresses, URLs, processes, vulnerabilities and attacker attribution. More than 50 connectors receive events from SIEM, NGFW, proxy and email systems, and new connectors can be developed. Supported formats include Syslog, CEF, LEEF, EMBLEM and Event log. TIP uses machine learning for DGA detection and offers match and retrospective searches across collected data. Indicators can be enriched using MITRE ATT&CK and services such as VirusTotal, Shodan, IPInfo.io and MaxMind Geo-IP. Analysts can initiate actions from graph and table views, including blocking an IP, changing a web-control policy, stopping a process or ending a user session. The self-hosted, browser-accessed client-server platform supports Linux and Windows Server 2016 and later, with an API for partner integrations. Pricing is calculated individually through sales; no product price or trial duration is stated.

ThreatQ is a cyber threat intelligence platform for collecting, prioritizing, analyzing and operationalizing threat information. It ingests material from commercial feeds, open sources, ISACs, partners and internal tools, then normalizes, correlates and enriches it. Threat Library applies customer-defined parameters and organizational context to score and prioritize intelligence. Adaptive Workbench supports configurable enrichment, workflows, prioritization logic, watchlists and operations using existing tools and workflows. The marketplace lists over 450 integrations, with APIs and SDKs available for customization. Integration listings have differing support designations, and ThreatQuotient does not maintain integrations published by other parties. ThreatQ v6 has standard and air-gapped installation guides. Investigations, Data Exchange and TDR Orchestrator are additional modules outside the default deployment. Authentication can use local accounts, LDAP, SAML or SSL client certificates, and account-level two-step verification is available. The default session timeout is sixty minutes of inactivity. Pricing is on request; the platform requires a license, and licenses are not perpetual.