Anomali has announced ThreatStream Next-Gen. Available standalone or within the Anomali Unified Security Data Lake, it turns threat intelligence into an active decisioning layer across security workflows, validated to drive investigations 300× faster than traditional methods across 50 enterprise deployments.

Most security platforms focus on detection. Anomali focuses on decision-making. It integrates intelligence across data, analysis, and response workflows. ThreatStream Next-Gen follows this approach, providing context on attackers and campaigns, prioritization, and recommended next steps as part of the process. This model was developed before the need for faster response became more pressing.

“Attackers move fast, targeting identity and exploiting behavior — often closing windows in hours. We close them faster. ThreatStream Next-Gen is the intelligence layer that competitors can’t replicate, because it’s not a bolt-on — it’s the core of everything we build, including our current innovation in agentic AI. By owning the decisioning layer between intelligence and action, we give security teams something they’ve never had before: the ability to respond at the speed of threats,” said Ahmed Rubaie, CEO, Anomali.

In most security operations, the bottleneck is not data, it is deciding what matters and what to do next. CTI analysts spend hours curating and contextualizing intelligence, SOC analysts spend hours stitching that context across tools to validate alerts and determine response. ThreatStream Next-Gen closes that gap: five new capabilities that carry intelligence all the way from production to action, without losing fidelity at the handoff.

• Priority Intelligence Requirements (PIRs) automate recurring intelligence questions, ensuring consistent monitoring of the threats that matter most to your organization, without analyst intervention on every cycle.
• Command Center provides a live, prioritized view of relevant threats, so analysts spend less time triaging noise and more time acting on signal.
• Intelligence Search connects indicators, threat models, and campaigns with AI-generated context, compressing multi-hour investigations to minutes.
• Case Management keeps investigations and response workflows synchronized, preserving full context from first signal to final resolution.
• Reporting translates technical findings into clear stakeholder outputs, no manual reformatting, no context lost in translation.