# Anvilogic on Splunk Architecture

### Architecture Diagram 

Below is the generic architecture digram for how Anvilogic works on top of Splunk.  

{% hint style="info" %}
This supports both Splunk Cloud (Classic & Victoria) and Splunk on-premise.
{% endhint %}

**Diagram:**

<figure><img src="https://4253518893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyHwthHcpZXpcJV1cs4SA%2Fuploads%2FrwTxEbX4p9btRa2SCHiU%2FReference%20Architecture%20-%20Type%201%20Splunk.png?alt=media&#x26;token=11788aef-2a27-4fab-85a7-87c7243ec216" alt=""><figcaption><p>Anvilogic on Splunk (Cloud and On-Premise)</p></figcaption></figure>

**PDF Download:**

{% file src="<https://4253518893-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FyHwthHcpZXpcJV1cs4SA%2Fuploads%2FX4LwMMUgA9CdshqsXBm3%2FAnvilogic%20Reference%20Architecture%20-%20Splunk.pdf?alt=media&token=c4da209f-3f8b-49c5-a1da-5fcc0c7d12f4>" %}

### Frequently Asked Questions (FAQs)

<details>

<summary>How does Anvilogic get installed for Splunk?</summary>

The Anvilogic App for Splunk gets installed on your Search head (single or clustered). It is approved for Splunk on-premises and Splunk Cloud (both Victoria and Classic).

Detections run as saved searches in the AVL app on cron & results go into the Anvilogic index.

</details>

<details>

<summary>How does the Anvilogic SaaS platform communicate with Splunk?</summary>

All communication (detection use cases deployments) are done over REST API using HTTPS/443 with TLS v1.2+.

</details>

<details>

<summary>Can you help bring raw log data into Splunk for us?</summary>

**No**, Anvilogic does not provide a connector service or forwarding agent to help bring security logs into Splunk. Anvilogic only supports raw data ingestion for Snowflake.

</details>

<details>

<summary>Can you help bring alert data into Splunk for us?</summary>

**Yes**, Avilogic can help retrieve alerts/signals from SaaS security tools (ex. Proofpoint, Wiz, Crowdstrike, etc.) and can ingest those into the Anvilogic index for correlation.

</details>

<details>

<summary>Does Anvilogic require Splunk Enterprise Security (ES)?</summary>

**No**, Anvilogic does not require Splunk ES to operate. However, Anvilogic can integrate with the existing ES framework if required.

Anvilogic does have a native triage capability that can replace certain ES components if required.

</details>

<details>

<summary>What data will Anvilogic have access to?</summary>

The Anvilogic Splunk app should be installed on a search head that has access to security data. This will allow the detection team to build and deploy detections to the search heads that have access to the indexed data.&#x20;

All RBAC controls are still maintained by your existing Splunk admins.

</details>

<details>

<summary>What is the Anvilogic Index?</summary>

Anvilogic Index will store the output from all detections that are running within the Anvilogic Splunk app.&#x20;

This is a fully normalized set of signals that we call “events of interest” that can be used to escalate activity to your SOAR or can be used as a hunting index to create Threat Scenario correlations.

</details>

<details>

<summary>Do you collect the alerts stored in the Anvilogic index?</summary>

**Not by default**. Alerts are stored inside of your Splunk index you specify during the Splunk app setup.&#x20;

The Anvilogic AI-Insights (ex. Hunting, Tuning, Health) package requires a copy of these events to be collected and stored by Anvilogic. If enabled, a copy of those events will be collected into Anvilogic.

</details>

<details>

<summary>Do you provide parsers for un-normalized data?</summary>

**Yes**, Anvilogic does not require any Splunk add on to function. We provide hundreds of out-of-the-box parsers that can be used to normalize your security data inside of Splunk.

</details>

<details>

<summary>Do you integrate with SOAR?</summary>

**Yes**, Anvilogic can integrate with most SOARs via REST API through either a push or a pull method.

</details>

<details>

<summary>Does Anvilogic have a triage capability in Splunk?</summary>

**Yes**, our Anvilogic app for Splunk has built in triage and allowlisting capabilities to make it easy to investigate alerts that are being generated. &#x20;

We can also easily integrate with any downstream SOAR platform you are using. &#x20;

</details>