Next lesson
Reading a vendor connector page
Four questions to ask of any connector list, what the six vendors on this site publish, and how to turn a connector page into a check against your own platforms.
Straight answer
Decide which criteria matter to your team, remove tools built for a different job, read the reasons behind the top few scores, and take two or three tools into demos with the questions from our buyer notes.
Step 1: check the buyer question
The weights on this site follow one question: hunting and detection on data you already have, without a new ingestion pipeline. If that is your question, the weighted figure is a reasonable starting order. If not, note which criteria matter more to you.
Step 2: set your own weights
Copy the per-criterion scores from the matrix into a spreadsheet and change the weights to match your priorities. Keep them adding up to 100. The lesson How to read a weighted score shows the calculation.
Step 3: drop tools built for a different job
A score of 1 often means a tool is not designed for that task. It may still suit a different need.
Step 4: read the reasons behind the top scores
For each tool left, read the reasons on its highest-weighted criteria. Look for named platforms and stated figures. Where a reason says "not described", write a demo question.
Step 5: take two or three into demos
A shortlist of two or three keeps demos comparable. Use Twelve questions to ask in a threat hunting platform demo and score the answers on the same 1 to 5 levels.
Where to go next
Use the calculator for step 2 instead of a spreadsheet, the side-by-side compare page for step 4, and the alternatives page for any tool you already run, such as Anvilogic alternatives or Mars Security alternatives, to see which rows each other tool is stronger on. The Buying track starts with Reading a vendor connector page.
Related
Editorial assessment · Desk research from public vendor material, last reviewed September 2026