What's New

ENHANCEMENT

Log Source Update (Limited Availability): Ingest Mimecast cloud logs into Security Analytics using the updated Mimecast API 2.0 integration, instead of the previous API 1.0 integration, ensuring continued support for monitoring and analysis.

See Mimecast for more information.

ENHANCEMENT

Asset Lookup Table(Limited Availability): Import asset data from supported scanners (Qualys, Rapid7, Tenable, AWS) or CSV uploads, which is then populated into the asset lookup table for monitoring.

See Managing Asset Data Imports for more information.

FEATURE

Google SecOps Log Ingestion Support (Limited Availability): Anomali now supports ingestion of Google SecOps data based on both curated and custom alerts.

See Google SecOps for more information.

FEATURE

Alert Triage Result Entries: Specify how many result entries an alert returns as its output, each time it is triggered.

See Using Alerts for more information.

ANNOUNCEMENT

Event Data Retention: Added information about how Anomali Security Analytics retains event data.

See Security Analytics Data Retention Policy for more information.

ANNOUNCEMENT

Retrosearch API Update: The Retrosearch API /api/v1/xdr/retrosearch is deprecated. Use the Search API and turbosearch to launch rapid, efficient searches.

FEATURE

Log Source Management (Limited Availability): Add event telemetry data from various log sources using one or more ingestion methods.

See Data Onboarding and Log Source Management for more information.

FEATURE

Audit Logs for Dashboards: Audit the actions users take on dashboards.

See Audit Logging (Limited Availability) for more information.

FEATURE

Cron Scheduling for Alerts: Use cron expressions to schedule alerts and their frequency.

See Creating Alerts for more information.

FEATURE

Audit Logging (Limited Availability): Administrators can audit the activity of users in their organization to gain crucial insight into the history of different user actions.

See Audit Logging (Limited Availability) for more information.

FEATURE

New Log Source: Added support for NXLog.

See Using NXLog to Ship Data for more information.

FEATURE

New Log Source: Added support for Cribl.

See Cribl Stream for more information.

FEATURE

Alert Throttling: Now throttling can be configured for Event Search alerts.

See Using Alerts for more information.

FEATURE

Lookup Tables: Added the Append to existing table feature to the CSV Import tab. The feature allows you to add rows to an existing lookup table.

See Managing Lookup Tables for more information.

ANNOUNCEMENT

Anomali Security Analytics: Anomali Security Analytics is the new name for Anomali Match Cloud.

See Anomali Security Analytics Overview for more information.

ANNOUNCEMENT

Cloud Link Updates: A recent Cloud Link software update has improved the workflow for several log sources. Customers are advised to contact Anomali Customer Support to request support for log ingestion.

See Data Onboarding and Log Source Management for a matrix describing Anomali support for common log sources. Contact Anomali Customer Support for information about other log sources you want to analyze.

ANNOUNCEMENT

Alerts and Lookup Table Updates: Alerts and Lookup Table configuration settings were moved from the Settings menu to the Manage menu so that non-admin users can create alert configurations and lookup table configurations.

See Using Alerts for more information.

FEATURE

Event Telemetry Update: Added support for ingesting Azure Event Hubs logs.

See Azure Event Hubs for more information.

ENHANCEMENT

Scheduled Retrospective Search: You can now delete scheduled retrospective search jobs.

FEATURE

Asset Data Enrichment: Added support for ingesting asset data from Amazon Web Services SQS or S3 locations.

See Managing AWS Asset Data Imports for more information.

ENHANCEMENT

IOC Match Search: In the search results table, rows are now aggregated when an event log matches more than one indicator or when an indicator has multiple intel source feeds. The leftmost column shows the aggregation count and has an expander icon you can click to display individual result rows.

See IOC Match Activity Searches for more information.

FEATURE

Event Telemetry: Added support for ingesting Microsoft Defender ATP alerts.

See Microsoft Defender ATP for more information.

FEATURE

Event Telemetry: Added support for ingesting Google Cloud Platform VPC flow and firewall logs.

See Google Cloud Platform for more information.

FEATURE

Anomali Match for IOA: Use Anomali Match to identify IOA and potential infrastructure threats based on Anomali Sigma rules. Note that IOA Match has been deprecated.

ANNOUNCEMENT

Event Telemetry Updates: Added support for using Cloud Link to ingest custom log sources from AWS S3 or SQS. The AWS S3/SQS log source workflow has been deprecated. Your event logs can be ingested via a different workflow. Contact Anomali support for assistance.

FEATURE

Event Telemetry: Updated the Sumo Logic log source integration. Integration with this log source no longer requires use of Anomali Universal Link.

See Sumo Logic for more information.

FEATURE

Event Telemetry: Updated the Microsoft Defender log source integration. Integration with this log source no longer requires use of Anomali Universal Link. The new integration supports ingestion of device events and email events.

See Microsoft Defender for more information.

ENHANCEMENT

IOC Match Search: Added support for field-based searches based on the trusted_circle_ids field.

See IOC Match Activity Searches for more information.

FEATURE

Threat Model Search: Added support for Attack Pattern searches. Attack Pattern refers to common methods of exploiting software reported by MITRE and other intelligence providers.

See Attack Pattern Activity Searches for more information.

FEATURE

Scheduled Retrospective Search: Added support for scheduled retrospective search jobs. A retrospective search job is a scheduled task to evaluate historic event logs for newly reported indicators of compromise (IOCs) or updated Threat Model details.

FEATURE

Asset Data Enrichment: Added support for ingesting asset data from Rapid7 InsightVM Platform.

See Managing Rapid7 Scanner Imports for more information.

FEATURE

Event Telemetry: Added support for ingesting Azure NSG flow logs.

See Microsoft Azure NSG Flow for more information.

ENHANCEMENT

Asset Details: New Asset Details page. You can drill down from the Overview dashboard Top 20 Impacted Hosts by Risk Score panel or the Activity Search Asset results table to view asset details, including Risk Score, match history timeline, match results table, and vulnerabilities.

See Asset Activity Searches for more information.

FEATURE

Link or Log Source Status Indicators: Improved health status indicators for Links and log sources.

See Managing Links and Log Sources for more information.

FEATURE

Event Telemetry: Added support for ingesting Carbon Black EDR logs.

See Carbon Black for more information.

FEATURE

Alerts: Added support for spike and frequency detection alerts.

See Using Alerts for more information.

FEATURE

Dashboards: Added the Match Analysis Dashboard. The Match Analysis Dashboard provides analytics about the threat intelligence feeds, indicator types, indicators, and DGA domains that match events in your network. These analytics can be useful in determining the effectiveness or noise-level of a threat intelligence element.

See Match Analysis Dashboard for more information.

FEATURE

Dashboards: Added the Multi Dimensional Dashboard. The Multi Dimensional Dashboard has ten visualizations and table panels that show the occurrences of IOC matches over time. The panels bring different elements of IOC matching into focus—for example, IOC matches over time or IOC matches by source.

See Multi Dimensional Dashboard for more information.