ThreatSTOP Managed Rules - New and Active HTTP Threats for AWS WAF

My main use case for ThreatSTOP Platform is that we are using an A10 DDoS protection device in our internal network as an on-premise device, and we are using ThreatSTOP Platform's feature to prevent well-known attacks from well-known IP addresses in A10's database.

For example, my use of ThreatSTOP Platform in our environment involves a category named well-known bank attacks, where there were subnets in ThreatSTOP Platform's database that we added into the system, and then ThreatSTOP Platform converged those IP addresses into our A10 devices, preventing attacks from well-known bank attackers and financial attackers.

ThreatSTOP Platform functioned as an IP address database, so it was not a day-to-day use device. Instead, we were checking IP addresses from ThreatSTOP Platform and using it as a USOM list.

The best features ThreatSTOP Platform offers are that it gives us categories to create a policy and add IP addresses and categories into that policy, which we can use directly on the A10.

The category and policy creation made my work easier and more effective because I did not add IP addresses one-by-one into that policy. Instead, I added categories into the policy, so I did not use any irrelevant IP addresses or irrelevant categories in my policies.

ThreatSTOP Platform has impacted our organization positively by reducing our DDoS false positive protection, and since we were doing some fine-tuning in our DDoS devices, it reduced our work time in the device.

I cannot say an exact number regarding how much time was saved, but we obviously observed that it helped to reduce our work time in the A10 device. However, I cannot say exactly how much the impact was, but it was really helpful.

ThreatSTOP Platform can be improved by enhancing the graphical user interface, making it work faster, and addressing the installation part, which was difficult because they sent us too many port numbers and IP addresses to add to our firewall policies, along with an OS to install on our Linux server, which I think should not have to be part of buying the product.

Initial support and setup support being great would be an additional improvement needed.

I have been working in my current field for about six years.

I describe the stability of ThreatSTOP Platform as adequate for an IP list database.

ThreatSTOP Platform's scalability has a good side because it has so many options and categories, but the scalability side allows using categories in your system, and I think the categories are static.

Customer support, as far as I remember, was good, and they were quick and fast.

I did not previously use a different solution because we just used well-known IP lists like USOM in our firewall, so ThreatSTOP Platform was the first in my previous company.

Before choosing ThreatSTOP Platform, I did not evaluate other options because the A10 team, the DDoS device we use, had a support team that offered us ThreatSTOP Platform.

My advice to others looking into using ThreatSTOP Platform is to consider it as an IP list, so if anything occurs on the DDoS side, it might be related to ThreatSTOP Platform, and they should check it when troubleshooting.

ThreatSTOP Platform's AI capabilities and its governance and security were not used by me because these features were not published yet when I was using ThreatSTOP Platform, so I do not have any comments on that.

In terms of ThreatSTOP Platform's AI capabilities, I think its accuracy and reliability of output is the same situation because I used ThreatSTOP Platform from 2021 to 2023, and when I was using it, it was not involved with AI, meaning we did not use a chatbot or anything else to use ThreatSTOP Platform.

My overall rating for this product is 7 out of 10.