Anomali Virtual Compute
Anomali Virtual Compute (AVC) is a computing framework that measures your usage of virtualized infrastructure whenever you perform a compute operation.
Operational Scope
Any search operations you perform on the Anomali platform counts towards your AVC limit. These operations include:
-
Search queries through the Search UI
-
Dashboards queries
-
Scheduled jobs
-
Alerts
-
Search APIs
Target audience
Any user with access to Search and Dashboards can see their AVC usage on the Anomali platform.
Monitoring usage
See Monitor your AVC usage to get started on using the AVC framework to understand and monitor your search usage and usage behavior. Furthermore, see Best Practices to learn how you can leverage AVC for optimal resource usage and optimization.
Best Practices for Managing Usage
Anomali recommends the following guidelines to optimize AVC usage and reduce overhead.
Shorter Search Time Ranges
Select shorter time ranges to minimize data processing, such as 24 hours instead of longer ranges such as 6 months or 1 year.
Here are example scenarios for low- and high-AVC searches:
Low AVC search example: Targeted shorter duration searches that employ Turbosearch on indexed fields and filtering or aggregation on parsed fields.
High AVC search example: Searches with longer duration involving heavy data ingestion or searches on raw messages with the json_extract or regular expression functions in the calc operator. See the calc operator for more information.
Prioritize parsed fields over searches for raw messages to ensure higher operational efficiency.
High AVC approach: | where raw_message contains_ci ("John")
Recommended approach: user = "John"
Use the Turbosearch operator as the initial Search operator whenever feasible. Here are some examples:
|turbosearch "https://www.example-url.com/feed"
|turbosearch "sender_example@doc*" "examplefilehash" "1.2.3.4"| aggr count (sourcetype) as srctype_count