Anomali Search Overview

Anomali Search is a data analytics platform designed to enable important cybersecurity practices.

Anomali Query Language

The Anomali Query Language (AQL) supports:

  • Evaluation of standard Boolean expressions to filter data

  • Aggregation functions

  • Calculation and transformation functions

  • Timetrends

  • Enrichment from ThreatStream intelligence sources and external sources, such as GeoIP data sets

  • Training machine learning models on event log data

Search

Anomali Search can parse natural language requests. The Search user interface also features typeahead suggestions and click-to-add filters from results to help you get started with AQL.

See Anomali Search.

Dashboards

Anomali Search dashboards are powered by AQL searches and provide a useful set of visualization options.

See Dashboards.

Lookup Tables

Anomali supports several lookup tables that let you map your event log data to Anomali's schema, perform different types of IOC correlation, and enable further analysis. See Lookup Tables for more information.

Use Cases

  • Threat hunting

    Use natural language or precise AQL expressions to explore your event logs and correlate event data with ThreatStream intelligence and enrichment.

  • Automatic detection of indicators of compromise (IOC)

    Upon ingestion, event logs are correlated with ThreatStream intelligence to produce the IOC Match system table and with high fidelity intelligence identifying endpoint filehash IOCs to produce the Ignite Match system table.

  • User, entity, and indicator behavior analytics (UEIBA)

    Leverage the IOC Match and Ignite Match system tables or use the raw event log to train machine learning models. Anomali supports a rich set of algorithms including ARIMA (Autoregressive Integrated Moving Average, DBSCAN (Density-Based Spatial Clustering of Applications with Noise), k-means clustering, LinearRegression, LocalOutlierFactor, LogisticRegression, StandardScaler, and more. Refer to AQL Operators by Use Case for an index of UEIBA operators.

  • Security orchestration, automation, and response (SOAR)

    Use alerts to add tags to ThreatStream observables or to send AQL results to a preferred destination. You can also use AQL operators to get or post columnar data. Refer AQL Operators by Use Case for an index of SOAR operators.