F5 Distributed Cloud App Infrastructure Protection (AIP)

The monitoring and incident management services are professional, clear, and efficient. The effort to tailor the product during onboarding is thorough. If you need a strong partner to handle incoming threats, Threatstack is an excellent choice. We use it for threat monitoring and response, and it's a critical part of our incident management—not just for responding, but for being the first to know.

As a security-conscious business with a small engineering team, Threat Stack has been a great addition to our security layers. We sleep better knowing automated alerts are watching out for us. The product comes with many alert options out of the box, which can be overwhelming at first. But after customizing with great support from Threat Stack, we're comfortable that only actionable alerts remain. We use it to monitor servers for intrusions and suspicious changes, which is one less worry for our small team, letting us focus on delivering customer features.

There's a lot to appreciate about this platform. After getting used to the dashboard, I found it very insightful to get a quick overview of our cloud. The Oversight service was particularly valuable since our team is small. It freed up our time for other critical initiatives and took care of low-level alerts. They handled detection, triage of high-severity issues, and investigated alerts on our behalf. I'd definitely recommend it. The learning curve is a bit steep, though. A few training sessions with one of their engineers helped us fine-tune alerts and reduce noise. While the dashboard is good for quick looks, deep dives require more effort, and I often switch between AWS console, ThreatStack, and other tools to get the full picture. We needed to audit our AWS environments, and Threat Stack helped with security monitoring and compliance. The Oversight service also uncovered security issues we might have missed otherwise.

I appreciate having predefined rule sets for SOC2 compliance. However, after fixing a reported vulnerability, there's a lag before the report reflects the fix—there's no on-demand scan. I'd also like a Jira integration so that when a vulnerability is found, a ticket is automatically created to track it; reporting is fine, but going the extra mile with action items would be better. The product itself is excellent, setup is very straightforward, and the rule sets simplify things a lot. We used it for classic EC2 instances, but after migrating to K8s, we lost some features like SSH tracking, which isn't as good as it was before. IDS and FIM for SOC2 compliance are solid.

The Threat Stack team makes me feel appreciated and truly looks after our needs. They're more than a SaaS provider; service comes first, and their staff is always available for questions, advice, and consultation on various security matters. Our account manager checks in monthly to ensure we're getting the most out of the service, gather feedback on improvements, and help me stay secure in the ever-changing DevSecOps landscape. He has gone the extra mile with external audits, client requests, security policy drafting, and FedRAMP planning. Threat Stack is receptive to suggestions and tracks every feature request I make; many have already been implemented, making things easier and more functional for my team. I do sometimes wish my RFEs were addressed faster, but I understand that with the pandemic and ThreatML's release, their engineers have other priorities. I'm optimistic about ThreatML, though the initial version has a few gaps that prevent immediate use for us. These are minor; overall, Threat Stack is a great partner, and these points don't detract from my satisfaction. It ensures our enterprise servers' activity is authorized, patches are current, and servers meet our security policies. It also helps us stay compliant with regulatory demands and pass customer audits with confidence. Threat Stack has enabled us to harden our servers, ensuring all management connections are legitimate and that no rogue agents have compromised our engineers' workstations or credentials.

All our production apps run on AWS, and Threatstack is a cloud-native platform built from the ground up to catch threats in cloud environments—not just on instances but also on the management plane. It was straightforward to set up, and since it's SaaS, there's no upkeep on our end. With their Oversight service, they act as our SecOps team, watching over our environment, reviewing events, and notifying us when needed. The tool itself could use better reporting. Also, I'd appreciate more robust integration for Windows workloads, and for compliance, it would be helpful to store all events for a year within the tool. It gives us round-the-clock monitoring of cloud activity. Their SOC examines every alert and only contacts us when it's a genuine issue. It also greatly aids with our PCI requirements.

I relied on this app for VPN access, and it was secure. It let me reach all my work-related files and was fast, despite occasional disconnections—but that's not a big deal. It provides a quick and safe way to get to office content. It's simple to use, no special training needed. I mainly used it as a VPN.

It's great for pinpointing resource usage in the cloud and sends alerts when vulnerabilities pop up. The analytics and dashboard make it easy to spot risks, though the UI could be more polished. Adding shortcuts to jump directly to specific resources would be better than the current click-through. Integration could be smoother too. For monitoring operational and security aspects of cloud resources, it's quite handy. Investigating vulnerability alerts and acting on them helps prevent security issues and supports remediation.

With Threat Stack, our cloud security and compliance management is streamlined through its event-based monitoring. We easily keep an eye on our host instances, containers, and K8s deployments in one centralized view. It also enforces compliance and security governance across every telemetry layer of our cloud setup. As an intrusion detection platform, it effectively cuts through false positives, letting us concentrate on the alerts that matter. By using its predefined rule sets, we can silence all the noise, saving us time and effort. This means we can quickly spot unusual behavior in our cloud infrastructure. Compared to other tools, Threat Stack processes Mean-Time-To-Detect (MTTD) and Mean-Time-To-Know (MTTK) quickly. We base our compliance audits on its monitoring reports and take proactive steps to mitigate risks. It also offers excellent remediation advice, rich security insights, and best practices to track suspicious activities and misconfigurations accurately.

The tool connects campus resources with external ones effortlessly, and it aligns well with our institution-wide firewall and authentication systems. However, logging back in after a session ends is not straightforward—if you try to sign in again without closing the previous window, you'll likely be immediately kicked out. It's a small annoyance. The bigger issue is the rollout: integrating with all systems and then communicating the usage to a large user base has led to a noticeable spike in IT support requests from everyday users.