Data Onboarding and Log Source Management

Anomali Security Analytics supports log ingestion from various telemetry log sources. This event telemetry data can be ingested in one of the following ways:

  • Log forwarders: Anomali recommends using log forwarders such as NXLog or Cribl to ship event data to an AWS S3 bucket that you share with Anomali.

  • API calls: Cloud-to-Cloud services allow Anomali to make API calls and directly fetch your data for ingestion.

  • Universal Link: Some log sources depend on Universal Link for data ingestion.

See Supported Log Sources for the complete list of log sources Anomali currently supports.

Onboarding your data

Note: See Anomali Search Data Retention Policy to understand how your data is retained over time in the Anomali platform.

As an org admin, you can onboard your data by adding a log source in Anomali Search by navigating to Search > Manage > Log Sources.

Add new log source: Click New to add a new log source. See Supported Log Sources for the complete list of log sources Anomali currently supports. For each log source, as an org admin, you can select:

  • Ingest Method: The method you use to ingest your event data logs into Anomali.

    • AWS S3: Configure AWS S3 bucket and provide its AWS SQS Queue URL, AWS Acces Key ID, Secret Access Key, along with the S3 key path.

    • API: Uses an API token to make API calls and collect event log data for ingestion.

  • Permissions: Set Private or Shared read-write permissions for a role mapped to a user group or an entire organization.

Find a log source: Search and select a log source from the table of log sources.

Filter by owner: You can filter log sources by owner. Possible values include:

  • Mine: returns log sources for which you are the owner.

  • <user>: returns log sources where the selected user is the owner.

Status of log source: The Status column denotes the current status of a log source, from creating a log source to confirming its deletion. Possible statuses include:

  • Create Requested: When you add a log source. You will also receive an email confirmation, with a copy sent to Anomali.

  • Active: The log source is now Active after it's either been created or updated and after Anomali has successfully confirmed the ingestion. Your data is now ready for analysis within the Anomali platform. An email confirmation confirms this change.

  • Update Requested:

    • Once you submit a request to update your log source, you will receive an email confirmation, with a copy sent to Anomali.

    • Update Requested is also the status when you successfully complete a pending action requested by Anomali.

  • Deletion Requested: You would like to delete a log source. The deletion will be complete once Anomali has confirmed the deletion.

  • Inactive: The log source is now Inactive after Anomali has completed its deletion.

Here are 3 common scenarios for status changes:

Scenario 1: Create Requested > Active.

Scenario 2: Create/Update Requested OR Update Requested > Active.

Scenario 3: Deletion Requested > Inactive.
S3 URL: URL to the S3 path from which the data is to be ingested.