TIP and SOAR are correlated. Neither one could exist alone. If the data is not available in TIP, we won’t be able to write the playbooks. For example, we used to give the client a daily update of the topmost dangerous hashes, IPs, or APTs. We used to upload everything. However, the tool would categorize it. The product automatically generated a threat score based on the maliciousness of an IP. It would correlate with other threat Intel databases.

The most valuable features are ease of use and the ability to customize it.

It's a solid platform and is stable enough. It is not complicated and is easy to use.

ThreatConnect has a highly user-friendly interface. I loved it. It's really great. It's also easy to configure.