Security Vision TIP collects, analyzes, and enriches cybersecurity threat data to support infrastructure detection, investigation, and response. It covers indicators at technical, tactical, operational, and strategic levels, including hashes, IP addresses, URLs, processes, vulnerabilities, and attacker attribution. The product has more than 50 connectors for event sources such as SIEM, NGFW, proxy, and email systems, with support for developing additional connectors. Listed formats include Syslog, CEF, LEEF, EMBLEM, and Event log. TIP uses machine learning for DGA detection and supports match and retrospective searches. Analysts can enrich indicators using MITRE ATT&CK and services such as VirusTotal, Shodan, KasperskyOpenTIP, IPInfo.io, and MaxMind Geo-IP. Graph and table views can launch response actions, including blocking an IP, adding a URL to a web-control policy, stopping host processes, or ending a user session. The self-hosted, browser-accessed platform supports Linux distributions and Windows Server 2016 and higher, and includes an API. Pricing is calculated individually through sales; the product page offers a demo but states no price or trial duration. Security Vision is headquartered in Moscow, Russia.
Who it is for
TIP suits security teams that need to gather and enrich threat indicators, search collected data, and initiate response actions. Its stated operating-system support and self-hosted deployment are relevant to organizations evaluating infrastructure requirements.
What is good
- More than 50 event-source connectors.
- Supports match and retrospective searches.
- Enriches indicators with MITRE ATT&CK and external services.
- Analysts can initiate response actions from graph and table views.
- Includes an API and supports Linux and Windows Server 2016 and higher.
What to know first
- Pricing is calculated individually through sales.
- Self-hosted deployment is required.
- At least one trained technician is required for operations.
Verdict
Security Vision TIP combines threat-data ingestion, enrichment, searching, and response in a self-hosted platform. Buyers should account for individual pricing and the stated need for trained technical staffing.
Security Vision TIP plans and pricing
All plansCompared on threat intelligence platforms
- Indicator enrichment
- Yes
- STIX/TAXII support
- Yes
- Report management
- Yes
- Workflow automation
- Yes
- Case management
- Yes
- Deployment
- self-hosted
