What's New

ENHANCEMENT

OCSF Field Panel Update (Limited Availability): The Field Summary panel in Search now shows all OCSF fields for the relevant event categories when querying OCSF-normalized data.

See OCSF Field Panel for more information.

ENHANCEMENT

OCSF Schema Support for Views (Limited Availability): Create views using the OCSF schema by selecting OCSF as the schema type during view creation.

See Views for more information.

FEATURE

Role-Based Access Control for Schemas (Limited Availability): Organization administrators can now configure role-based access controls using OCSF schema fields, in addition to the standard eventlog schema, and grant appropriate user permissions for specific use cases.

See Role-Based Access Control for Schemas for more information.

ENHANCEMENT

Customizable Export Timestamp (Limited Availability): Choose either a human-readable or UNIX timestamp when exporting search results.

See Exporting Search Results for more information.

FEATURE

Search Tabs (Limited Availability): Launch one or more searches using multiple search tabs on the Search homepage.

See Using Search Modes for more information.

FEATURE

Resource Tags for Dashboards (Limited Availability): Create and manage an organization-wide tag catalog that lets you locate and organize dashboards by applying multiple tags with appropriate user permissions.

See Resource Tags for more information.

ENHANCEMENT

calc Operator Update (Limited Availability): Use the new shannon_entropy information theory function to calculate an entropy score for any string field and identify unusual patterns in your event data.

See calc for more information.

FEATURE

OCSF Schema Support (Limited Availability): Use the Open Cybersecurity Schema Framework (OCSF) Version 1.2 schema and leverage OCSF-normalized event telemetry on the Anomali platform, alongside continued support for eventlog.

See OCSF Schema Overview for more information.

FEATURE

Lookup Tables (Limited Availability): Use the asset and investigation_elements lookup tables to display asset data populated from vulnerability scanners and perform consistent investigation querying and reporting.

See asset and investigation_elements for more information.

FEATURE

New Operator (Limited Availability): Use the Google Threat Intelligence (gti) operator to to enrich your observables with the latest Google Threat Intelligence verdicts and metadata.

See gti for more information.

ENHANCEMENT

CrowdStrike Operator Updates (Limited Availability): Use updated CrowdStrike operators that work with the new API replacing the now-decommissioned CrowdStrike Detects API.

See the CrowdStrike Operators documentation for more information.

ENHANCEMENT

Operator Updates (Limited Availability): The updated ml_model_summary machine learning operator offers an improved search results display for enhanced readability and usability.

See ml_model_summary for more information.

FEATURE

Trigonometric Function (Limited Availability): Use the haversine function to identify geographically improbable logins by calculating the distance between sequential login events using geographical latitude-longitude pairs.

See calc Trigonometric functions for more information.

FEATURE

Role Based Access Control (Limited Availability): Access to user-created lookup tables can now be controlled through role-based access.

See Using Lookup Tables for more information.

FEATURE

Role Based Access Control (Limited Availability): You can now access and control user-created macros through role-based access.

See Using Macros for more information.

ENHANCEMENT

Automatic JSON Field Extractions: Rapidly and flexibly view and use extracted fields in AQL queries to conduct downstream analysis without requiring the fields to be mapped to the standard Anomali eventlog schema.

See Extracted Fields for more information.

FEATURE

CrowdStrike Operators Update (Limited Availability): Use CrowdStrike operators to ensure CrowdStrike integration with the Anomali platform and interact with CrowdStrike data and services within the Anomali platform.

See the CrowdStrike Operators documentation for more information on the new CrowdStrike operators.

ENHANCEMENT

join Operator Update (Limited Availability): Compare string fields in joins for wildcard-based matching when joining data with dynamic lookup tables.

See join for more information.

FEATURE

Visualization Type (Limited Availability): You can now define and use system or custom variables in the text widget to dynamically populate its values based on AQL data or user-defined inputs.

See the About the Text Visualization Type for more information.

FEATURE

Visualization Type: Use the Timeline visualization type to visualize user and entity behavior in a timeline view in your dashboards.

See About the Timeline Visualization Type for more information.

FEATURE

Visualization Type: Use the MITRE ATT&CK Flow visualization type to add panels with attack flows to your dashboards.

See About the MITRE ATT&CK Flow Visualization Type for more information.

FEATURE

Structured Search (Limited Availability): Use the structured query builder to create AQL Search queries by selecting different search components, without any prior knowledge of the AQL syntax.

See Anomali Search for more information.

ANNOUNCEMENT

Best Practice: Follow Anomali's recommendations to avoid wildcard matching on sourcetypes.

See Resolving error: "To optimize your experience and reduce your AVC usage, Anomali recommends reducing the time range to 24h to proceed." for more information.

ANNOUNCEMENT

Event Data Retention: Review the latest Anomali Search Data Retention Policy.

See Search Data Retention Policy for more information.

ENHANCEMENT

timechart Operator Update: timechart operator now provides the makecontinuous flag to help you create empty buckets for time periods with no data.

See timechart for more information.

FEATURE

Subsearch: Embed a search query within the main search that enable you to filter, manipulate, or correlate search results across multiple tables.

See Subsearch for more information.

FEATURE

Search: Use turbosearch to search for a list of indicators in your data, including historic and incoming data.

See turbosearch for more information.

FEATURE

Views: Views allow you to create aliases for fields, enabling you to reference them directly in your search queries, just like regular fields.

See Views for more information.

ANNOUNCEMENT

Best Practice: Efficiently use the rex operator and json_extract of the calc operator to process large volumes of records following the steps Anomali recommends.

See AQL Best Practices for more information.

ENHANCEMENT

riskiq_ssl Operator Update: riskiq_ssl operator is now rebranded to the mdti_ssl operator that enriches results related to an IP address or domain name using the ThreatStream MDTI enrichment.

See mdti_ssl for more information.

FEATURE

Anomali Virtual Compute: Anomali Virtual Compute (AVC) is a computing framework that measures your usage of virtualized infrastructure whenever you perform a compute operation.

See Anomali Virtual Compute for more information.

ENHANCEMENT

convert Operator Update: Rotate a table such that the rows and column values are swapped, including the ability to specify the field to be used as a header.

See convert for more information.

ANNOUNCEMENT

Best Practice: Anomali recommends not using the join operator between eventlog data and system lookup tables such as iocmatch, since the join operation is not supported.

See join for more information.

ENHANCEMENT

fields Operator Update: Optionally add a plus (+) or minus (-) sign to respectively include or exclude a comma-separated list of additional fields in the result table.

See fields for more information.

ENHANCEMENT

fromjson Operator Update: Extract the top level keys from the JSON object and create a table with keys as column names and values as field values.

See fromjson for more information.

ENHANCEMENT

streamstats Operator Update: Generate cumulative statistics for each event in your data, streaming up to the current event.

See streamstats for more information.

ENHANCEMENT

loadjob Operator Update: Load events or results of a previously completed search job query.

See loadjob for more information.

FEATURE

Visualization Type: Use the Gantt Time Series visualization type to analyze data based on date information and gain intelligence about events across specific timeframes.

See About the Gantt Time Series Visualization Type for more information.

FEATURE

Macros: Use out-of-the-box macros to fetch and analyze ThreatStream data without building complex search queries.

See Using Macros (Classic UI)for more information.

FEATURE

Macros: Create custom macros to avoid manually constructing lengthy strings of parameters for running complex search queries.

See Using Macros (Classic UI)for more information.

FEATURE

New Search APIs: Leverage AQL Search APIs to issue a new search, monitor its status, and receive the search results.

See the Using the Search RESTful API for more information.

ENHANCEMENT

where Operator Update: Search for an event by checking multiple string values in a single field. Also, you can search for an event that contains any value in a field.

See where for more information.

ANNOUNCEMENT

Best Practice: Follow new best practices for query optimization: Specify the smallest possible time range and use targeted search tables.

See AQL Best Practices for more information.

FEATURE

New Operators: Use the first and last aggregation functions to return first and last entry in a result set.

See calc for more information.

ANNOUNCEMENT

Best Practice: Follow our recommendations on how to use the limit operator for better result accuracy.

See AQL Best Practices for more information.

FEATURE

New Operator: Use the snowincident operator to create an incident in ServiceNow.

See snowincident for more information.

FEATURE

New Operator: Use the cluster operator to generate clusters of data based on similarity.

See cluster for more information.

ENHANCEMENT

calc Operator Update: The examples for the json_extract function have been updated.

See calc for more information.

FEATURE

concurrency Operator: Use the concurrency operator to count the number of events with the spans that overlap with the start of each event.

See concurrency for more information.

FEATURE

Visualization Type: Use the Heatmap visualization type to quickly identify patterns, trends, and anomalies by displaying the data in a form of a matrix, where values are represented by varying colors.

See About the Heatmap Visualization Type for more information.

FEATURE

New Operator: Use the outlier operator to modify numeric outputs for given input fields that contain outliers.

See outlier for more information.

ENHANCEMENT

New Operator Update: The examples for the foreach operator have been updated.

See foreach for more information.

FEATURE

New Operator: Use the anomalydetection operator to find outliers in numeric fields.

See anomalydetection for more information.

ENHANCEMENT

calc Operator Update: All timestamps are now calculated in milliseconds.

See calc for more information.

FEATURE

New Operator: Use the contingency operator to generate a cross table to find the number of occurrences for the values of two fields.

See contingency (alias: ctable) for more information.

FEATURE

Ignite Dashboard: The Ignite Dashboard comprises a group of endpoint analytics panels that threat hunters can use to find what is happening around source hosts.

FEATURE

UEIBA: Anomali supports a rich set of algorithms including ARIMA (Autoregressive Integrated Moving Average, DBSCAN (Density-Based Spatial Clustering of Applications with Noise), k-means clustering, LinearRegression, LocalOutlierFactor, LogisticRegression, StandardScaler, and more.

Refer to AQL Operators by Use Case for an index of UEIBA operators.