F5 Distributed Cloud App Infrastructure Protection (AIP) Reviews & Product Details

The ability to monitor your cloud environment combined with per-host monitoring provides good overall coverage of potential threats and software vulnerabilities. While ThreatML (Machine Learning) is in a nascent state, I believe ThreatStack will continue to improve its use of ML over time. It is fairly easy to tune alerting to your environment, and Threatstack support is very helpful when it comes to working with rule sets and suppressions. Review collected by and hosted on G2.com.

I would like to see better exportable reporting for Audits. Some alerts are not actionable or cannot be suppressed. Review collected by and hosted on G2.com.

The best part is that with less effort you can implement in any platform (cloud or on-premise). with the most supported Linux distributions. Its support to Docker & Kubernetes also.

And also provides an easy interface for administration. It currently integrated into the app-sec for latest technologies ruby , python & also node js. Many more to go with app-sec monitoring for application security.

It has clear documentation for automation for ts agent implementation through ansible or with a script with . which documentation is available in their git hub.

I did like the quick support in all hurdle times. Review collected by and hosted on G2.com.

Nothing more. wanted to explore threat stack more in app-sec monitoring & integrate all the languages which are most latest technologies. Review collected by and hosted on G2.com.

The product has been excellent and provides us with great insight to the vulnerabilities, exploits and misconfigurations within our environment. The default rule sets have worked well out of the box both for our AWS environment and our Kubernetes environment.

One of the top aspects for our team has been our interactions with our customer support team. They provide actionable items each meeting and clearly have a strong grasp of our environment. Review collected by and hosted on G2.com.

The UI can feel a little clunky at times.

It would be nice if server vulnerabilities found would link to remediation steps within the console without having to go look through the NIST site, possibly even tie directly into a JIRA ticket.

There are some other quality of life improvements but for it's core functionality we are very happy with the product as a team. Review collected by and hosted on G2.com.

Threat Stack's Security Oversight, Insight, and Customer Support teams are top-tier. They are responsive, engaging, and coordinated on all fronts. I sleep with confidence that the data reported from our deployed agents (as well as our audit logs in AWS) are being effectively monitored by capable experts around the clock. Having an external team we can depend on for the triaging and tuning of alerts is particularly valuable for a small team like the one I am a part of. Review collected by and hosted on G2.com.

The Threat Stack platform lacks some "quality-of-life" features that I would like to see. More customizable Slack integration options and better workflows for acknowledging/dismissing alerts are at the top of my list. Review collected by and hosted on G2.com.

ThreatStack has made it incredibly easy for my team to quickly identify security vulnerabilities, keep track of any unwanted accesssion, and enforce compliance across our entire platform. Installing and configuring it on our machines is super painless to automate, it integrates easily with AWS and Slack, making sure that setup is easy and alerts are raised as soon as problems are found. Luckily, it has kept us proactive rather than reactive with respect to security, so we are able to keep our maintenance backlog low and work on further improving our infrastructure. Review collected by and hosted on G2.com.

It would be nice to be able to distinguish which AWS account a server resides in from the Threatstack UI. Other than that minor gripe, it works pretty well for us. Review collected by and hosted on G2.com.

Keeping on top of CVEs is fantastic, there's more open CVEs here than the Linux distro recognizes as needing to be patched. This is a very real picture of exactly how things are. As we've gone along in using Threatstack we're now moving to AWS and having Threatstack deployed there from the very beginning has been useful.

The rulesets are also incredibly useful and the ability to configure custom rules and exceptions is a strength. Review collected by and hosted on G2.com.

The complexity around hosts and ports and appropriately configuring everything to accept some things but not others. Custom rules are very powerful but holy cow it's tedious and feels as though one should be taking a fine grained approach but being a threat stack configuration expert is not a major part of the job. Review collected by and hosted on G2.com.

Setup was very easy (just install an agent on all the instances, and connect cloudtrail, and you start getting a pretty good idea of what is going on in your system. The default alerts are easy to set up, and give you a good starting point. Review collected by and hosted on G2.com.

You will definitely need to tweak the alerts out of the box, or you will get too many false-positives. The process for this is not too cumbersome, though. Review collected by and hosted on G2.com.

I like that we have the option to range between full control and hands-off. If we wanted to step back and let them handle all the monitoring and interpretation, that's an option. If we wanted to do it all and not have any suggestions, that's also fine. We're in between the ranges, but as things get busier I know that I can let them handle the day to day monitoring and will alert me if there's really suspicious stuff. Review collected by and hosted on G2.com.

Some of the alerts were noisy before they suggested suppression rules. It's easy to get lost in all the features, and I bet we're still not making full use of everything. They've been good at reducing the amount of effort it takes though. I can see that not having an idea what to do could be confusing. Review collected by and hosted on G2.com.

I like how simple it is to get up and running. It's great to setup and not have to worry about a complicated configuration process. There is a base set of rules already created and it is fairly simple to implement new rules for instance and Cloudtrail monitoring. Review collected by and hosted on G2.com.

Lack of feature set and log retention. Threatstack is great at having a baseline checks and monitors, but lacks some of the more advanced features. While they claim to have intelligence, there is no way for a user of the platform to view any types of intelligence. Rule creation is a bit tricky when you get into suppressions, there is no way to test a rule in combination with suppressions, you have to test each piece individually and hope it works all together. For the price point, Threatstack only keeps 3 days of logs which is completely useless and you must have a SIEM to forward the logs to in order to keep any sort of record of what is happening on your servers. Review collected by and hosted on G2.com.

Threat Stack's 24/7 SOC, monthly vulnerability and alert analysis, tuning to reduce noise, compliance mapping, and responsive support provide a very cost effective package of security monitoring services. Review collected by and hosted on G2.com.

I have no complaints after a year of use. Review collected by and hosted on G2.com.