Detections

The Detections page displays the entire catalog of signals produced in your environment when the platform identifies a specific behavioral pattern, policy violation, or threat indicator within log data. These signals are organized by detection rules created on the platform and are grouped for quick review, enabling you to monitor detection volume across severity levels, investigate matched entities, and act on individual detection instances.

A detection is produced when a log event matches:

• An AQL detection rule configured by your team

• An IOC match against ThreatStream threat intelligence

• A DGA match identifying domain generation algorithm activity

Each detection is automatically enriched with entity context and MITRE ATT&CK technique mappings before it is surfaced to analysts.

To access detections, navigate to ThreatStream Next Gen >  Security Operations > Detections.

At the top of the Detections page, you can view the following panels: Detection Trend and MITRE Tactics.

Detection Trend Panel

The Detection Trend panel displays detection volume over the selected time range, with a separate line series per severity level: Critical (Red), High (orange), Medium (yellow), Low (green), and Informational (blue). Use the 1H, 24H, and 7D radio buttons in the top-right corner of the chart to change the time range. This time range also applies to the Understanding Detection Rule Matches.

Hover over any point on the chart to see a tooltip showing the per-severity counts at that timestamp.

MITRE Tactics Panel

The MITRE Tactics panel uses a radar diagram to show the distribution of active detections across MITRE ATT&CK tactics. Each axis represents one tactic. The example image below represents detections in a polygon area displaying multiple MITRE tactics such as Credential Access, Initial Access, Reconnaissance, Resource Development, and more. This area grows as more detections map to a particular tactic.

Hover over any tactic axis to see a tooltip showing the tactic name and the total detection count for that tactic.

Understanding Detection Rule Matches

Detection Rule Matches represent detections produced by AQL rules, grouped by rule name. Each group row represents one detection rule and the set of entities that triggered it within the active time range.

Search rule & entities: Search across rule names and entity values.

Severity: Filter detection rule matches by severity.

OCSF Category: Filter detection rule matches by OCSF category assigned to the rule.

Detection Rule: Search by rule name

Rule: Detection rule name and the matched entities.

Category: The OCSF category assigned to the rule, such as Authentication or Network Activity.

Severity: Color-coded severity badge for the rule, containing levels such as Critical (Red), High (orange), Medium (yellow), Low (green), and Informational (blue).

Count:Total number of detection instances in the active time range.

Trend: Detection frequency over the time range using a sparkline trend.

Last Seen: Denotes the timestamp of the most recent detection instance.

More Options: Click the more options menu (...) on each row to select one of two options:

• Detail: This option displays the configuration for the detection rule that produced this set of involved entities. The panel displays the rule name, severity, and OCSF category in the header, and a Rule tab with the following fields: Description, OCSF Category, Severity, Base Risk Score, Detection Count (30 days), Look-back Window, Run Schedule, MITRE ATT&CK, and the AQL Query used by the rule.
  
  

• Edit Rule: This option opens the detection rule editor. See Detection Rules for more information.

Time Range: Time range selector sets the active time window for both the panels and the detection list. Options include Last 1h, Last 24h, Last 7d, Last 30d, and Custom.

Understanding IOC Matches

Your organization subscribes to ThreatStream intelligence feeds that make up the set of IOCs that your organization is interested in tracking. The set of indicators are correlated with event logs when the logs are ingested.

Search IOC indicators: Search for IOC matches by their observable (indicator) value.

Indicator Type: Filter IOC matches by an indicator type: IP, Domain, Hash, or URL.

TLP: Filter IOC matches by their TLP color: Red, Amber, Green, or Clear.

Time range: Time range selector sets the active time window for both the panels and the detection list. Options include Last 1h, Last 24h, Last 7d, Last 30d, and Custom.

Indicator: Indicator value.

Type: Indicator type: IP, Domain, Hash, or URL.

TI Confidence: Confidence score indicates the certainty that an observable exhibits or is connected to malicious behavior.

TLP: TLP of an IOC match.

Count: Total number of detection instances in the active time range.

Trend: Detection frequency over the time range using a sparkline trend.

Last Seen: Timestamp of the most recent detection instance.

Understanding DGA Matches

Anomali Security Analytics automatically processes domain names (contained in the host names and URLs) in the events received from your network to determine the likelihood of these being Domain Generated Algorithms (DGA) domains. The DGA processor uses machine learning to calculate the probability of a domain in an event being a DGA domain. Domains with a probability of 60% or higher are considered "likely DGAs". The DGA processor further corroborates the state of a domain against other data sources before classifying the domain state as active or benign. An active domain has a high probability as generated with a DGA, while a benign domain is most likely not generated by a DGA.

Search domains: Search domains by their name.

Severity: Filter domains by their severity level: Critical, High, Medium, or Low.

DGA family: Filter DGA  matches by a DGA family. For example, Conficker, Necurs, Ramnit, GOZ, Suppobox, or Matsnu.

Time range: Time range selector sets the active time window for both the panels and the detection list. Options include Last 1h, Last 24h, Last 7d, Last 30d, and Custom.

DGA Family: DGA Family name.

Sample Domain: Highest severity domain within the aggregation window.

Severity: Severity level: Critical, High, Medium, or Low.

Count: Aggregated match count.

Trend: Detection frequency over the time range using a sparkline trend.

Last Seen: Timestamp of the most recent detection instance.

Viewing Per-Detection Details

Expanding each row reveals the individual entities matched by that rule within the active time range.

See Viewing Matched Detections for more information.