Anvilogic on Splunk Architecture

Anvilogic implementation with Splunk (Cloud & Splunk on-premise).

Architecture Diagram

Below is the generic architecture digram for how Anvilogic works on top of Splunk.

This supports both Splunk Cloud (Classic & Victoria) and Splunk on-premise.

Diagram:

Anvilogic on Splunk (Cloud and On-Premise)

PDF Download:

5MB

Anvilogic Reference Architecture - Splunk.pdf

PDF

Open

Frequently Asked Questions (FAQs)

How does Anvilogic get installed for Splunk?

The Anvilogic App for Splunk gets installed on your Search head (single or clustered). It is approved for Splunk on-premises and Splunk Cloud (both Victoria and Classic).

Detections run as saved searches in the AVL app on cron & results go into the Anvilogic index.

How does the Anvilogic SaaS platform communicate with Splunk?

All communication (detection use cases deployments) are done over REST API using HTTPS/443 with TLS v1.2+.

Can you help bring raw log data into Splunk for us?

No, Anvilogic does not provide a connector service or forwarding agent to help bring security logs into Splunk. Anvilogic only supports raw data ingestion for Snowflake.

Can you help bring alert data into Splunk for us?

Yes, Avilogic can help retrieve alerts/signals from SaaS security tools (ex. Proofpoint, Wiz, Crowdstrike, etc.) and can ingest those into the Anvilogic index for correlation.

Does Anvilogic require Splunk Enterprise Security (ES)?

No, Anvilogic does not require Splunk ES to operate. However, Anvilogic can integrate with the existing ES framework if required.

Anvilogic does have a native triage capability that can replace certain ES components if required.

What data will Anvilogic have access to?

The Anvilogic Splunk app should be installed on a search head that has access to security data. This will allow the detection team to build and deploy detections to the search heads that have access to the indexed data.

All RBAC controls are still maintained by your existing Splunk admins.

What is the Anvilogic Index?

Anvilogic Index will store the output from all detections that are running within the Anvilogic Splunk app.

This is a fully normalized set of signals that we call “events of interest” that can be used to escalate activity to your SOAR or can be used as a hunting index to create Threat Scenario correlations.

Do you collect the alerts stored in the Anvilogic index?

Not by default. Alerts are stored inside of your Splunk index you specify during the Splunk app setup.

The Anvilogic AI-Insights (ex. Hunting, Tuning, Health) package requires a copy of these events to be collected and stored by Anvilogic. If enabled, a copy of those events will be collected into Anvilogic.

Do you provide parsers for un-normalized data?

Yes, Anvilogic does not require any Splunk add on to function. We provide hundreds of out-of-the-box parsers that can be used to normalize your security data inside of Splunk.

Do you integrate with SOAR?

Yes, Anvilogic can integrate with most SOARs via REST API through either a push or a pull method.

Does Anvilogic have a triage capability in Splunk?

Yes, our Anvilogic app for Splunk has built in triage and allowlisting capabilities to make it easy to investigate alerts that are being generated.

We can also easily integrate with any downstream SOAR platform you are using.