Anvilogic is a Multi-data platform SIEM that enables detection engineers and threat hunters to detect, hunt, and investigate seamlessly across disparate data lakes and tools without the need to centralize data, learn new languages or deploy new agents.

Anvilogic helps enterprise security operation centers implement more accurate detections and hunt more efficiently and effectively with its low-code detection builder, automated workflows, and AI-powered insights for tuning, maintenance and critical alert escalations. You can go from threats to detections in minutes with 1000s of curated detections available to deploy with single clicks. The platform provides you continuous SOC maturity scoring to always assess and get a real-time view into your detection posture against your highest priority threats.

The Anvilogic platform releases continuously. This list is periodically updated with the latest functionality and changes

Release 7.31

March 13, 2025

This release includes the following enhancements:

• Pipeline updates for the Crowdstrike EDR and Proofpoint vendor alerts, as well as push alerts.

Release 7.30.2

March 6, 2025

This maintenance release includes various bug fixes.

Release 7.30.1

February 27, 2025

This maintenance release includes various bug fixes.

Release 7.30

February 20, 2025

This release provides support for integrating Databricks on AWS as a Beta feature for all customers.

Release 7.29.1

February 13, 2025

This maintenance release includes the following enhancements:

• If you don't have Splunk configured, EOI drilldown links won't be active anymore.

• Updates to the algorithm for recommending rules in the Armory.

• Bug fixes in the Azure and Databricks integrations.

Release 7.29

February 6, 2025

This release includes enhancement to the Databricks integration to include creating a group, and adding the service principal to the group, along with a variety of bug fixes.

Release 7.28

January 30, 2025

This release includes the following enhancements:

• Enhancements to the Azure UD integration.

• Bug fixes and enhancements to the Databricks integration.

• Enhancements to some tuning recommendations. including priority tuning for some threat identifiers.

Release 7.27

January 23, 2025

This release enables you to configure rule enrichment macros used to customize the Enrich component in the Unified Detect builder.

Release 7.26

January 16, 2025

This release includes the refactored workflow for creating threat identifiers. The new workflow integrates the Unified Detect rule builder for various data repositories.

Release 7.25

January 9, 2025

This release enables you to quickly identify macros with available updates from the home page, list of macros, and macro details.

Release 7.24

December 19, 2024

This release includes the following new features and enhancements:

• Deobfuscator tool for Monte Copilot.

• Updated Monte Copilot API endpoints to provide entity analysis in your investigations.

Release 7.23

December 12, 2024

This release includes various bug fixes and enhancements related to data onboarding.

Release 7.22.1

November 21, 2024

This release includes various bug fixes.

Release 7.22.0

November 14, 2024

This release includes a new hunting insight for unusual IP location.

Release 7.21.0

November 7, 2024

This release introduces the following enhancements:

• Enhancements to Azure UD data feeds, ability to configure the ADX cluster size, and including Azure as a data logging platform in the first-time onboarding.

• Enhancements to SSO SAML configuration:

  • Prevent password change and reset

  • Invitations are no longer sent to new users for SAML enabled accounts

  • SAML Group Mapping enable accounts will reflect the corresponding roles in Anvilogic, and the roles are also included in audit events.

• Google Cloud Platform (GCP) logs Snowflake integration.

• Previously, you can only view diffs for rules imported from the Armory. This release expands this capability so that you can view diffs for custom imported rules.

Release 7.20

October 24, 2024

This release introduces a new Snowflake integration to onboard the data in your Amazon S3 buckets and generate detections on that data.

Release 7.19

October 17, 2024

An architectural adjustment to have threat scenarios are run directly on the Anvilogic platform, rather than being deployed on your Snowflake environment. This change simplifies the management of threat scenarios, reducing the overhead involved in maintaining custom code for multiple data repositories. This adjustment also ensures minimal delays or data loss when gathering EOIs from various log repositories, leading to more effective threat detection.

Release 7.18

September 26, 2024

This release introduces the following feature enhancements:

• The threat scenario deployment workflow is updated so that threat scenarios are first added to the Workspace before they are deployed.

• The Search and Unified Detect page is enhanced to support search across Azure data feeds and macros on the Anvilogic platform.

Release 7.17

September 19, 2024

This release introduces Azure as a supported data logging platform.

Release 7.15

August 22, 2024

This release includes the following enhancements:

• The integrations workflow to get data sources into Snowflake is enhanced to provide self-managed pipeline options the UI when available.

• The QnA tool in Monte Copilot is enriched with information from the Anvilogic Armory so that it can now pull information about threat identifiers and threat scenarios, in addition to its existing capability of pulling data from Google searches and Anvilogic Forge Threat Reports.

Release 7.14

August 8, 2024

This release makes Monte Copilot generally available under a licensing model.

This release also addresses a variety of bug fixes, including the following:

• The ability for users to validate a rule via API.

• The ability to sync feeds when onboarding task is incomplete and is pending on data feeds sync from Snowflake.

Release 7.13

July 29, 2024

This release includes the following enhancements:

• MonteAI Copilot is enhanced with additional tools such as IoC to check if an URL or IP address is an indicator of compromise (IoC), and AnvilogicAllowlistProcessRegexGenerator to help you generate regex patterns for allowlisting benign processes.

• The UI libraries are updated to provide an enhanced experience. In some cases, you may notice a slight difference in the look and feel of the page or component.

Release 7.12

July 11, 2024

This release includes the following new features and enhancements:

• On-demand sync for data feeds.

• Additional event types are supported for the Lacework vendor alert integration.

• The existing Snowflake Custom Data integration for Anvilogic-managed pipelines is replaced by separate Cribl Stream and Forward Events integrations.

Release 7.11

June 27, 2024

This release provides the ability to create and manage your own techniques and sub-techniques outside of the MITRE ATT&CK framework.

Release 7.10

June 13, 2024

The Threat Priorities page is updated so that when you are viewing your prioritized threat techniques, the default view is now a list of prioritized techniques. Previously, you saw a matrix view of your prioritized techniques by default. You can click List View or Matrix View to switch between the views.

Release 7.9

May 30, 2024

This release includes the following features and enhancements:

• Ability to auto accept tuning insights.

• Upgrade to version 15.1 of the MITRE ATT&CK framework. This upgrade introduces additional data categories for alerts on the Anvilogic platform.

Release 7.8

May 16, 2024

This release includes enhancements to the alert ingestion pipeline with machine learning-based enrichments and improved performance.

Release 7.7.1

May 9, 2024

This maintenance release provides support for Microsoft Security Alerts and Incidents vendor alert integration.

Release 7.7

May 2, 2024

This release includes the following features and enhancements:

• (Beta) MonteAI Copilot, your SOC assistant trained by the common personas within the SOC to help assist any person within the SOC. MonteAI Copilot has access to the commonly used tools and data sets that enable these personas to perform their day-to-day activities.

• (Beta) Auto Investigate automatically populates the Hypothesis and Resolution in hunting insights generated after May 2, 2024 to help you perform more efficient investigations.

• The CrowdStrike FDR integration for self-managed pipelines is enhances to support additional data types.

Release 7.6

April 18, 2024

This release includes a variety of bug fixes, and the addition of the edit_hunting_insight_automation privileges to the Content Developer role.

Release 7.5

April 4, 2024

This release provides Google Workspace Snowflake integration to get your admin, drive, and login events into Snowflake to generate detections on the Anvilogic platform.

Release 7.4

March 21, 2024

This release introduces the beta version of the ability to create native Snowflake threat scenarios.

Release 7.3

March 7, 2024

This is a maintenance release to address performance issues and includes several bug fixes.

Release 7.2

February 22, 2024

This release includes back-end enhancements in the Unified Search area, along with a variety of bug fixes.

Release 7.1

February 8, 2024

This release provides the following new features and enhancements:

• A redesigned investigation experience, featuring a new timeline that makes it easier to pivot from the timeline and add EOIs and notes to the timeline.

  • The EOI Summary dashboard is moved under the Detect in the navigation bar.

  • Saved investigation are called cases, which can be managed and shared by your team of analysts.

• The workflow for deploying trending topics and detection packs is updated to align with the threat scenario deployment workflow, where macro verification happens at the end of the workflow instead of at the beginning.

Release 7.0.1

February 1, 2024

Introducing Ask MonteAI, enabling you to interact with the product documentation using MonteAI from any page on the Anvilogic platform.

Release 7.0

January 25, 2024

This release provides the ability to create and manage your own platforms outside of the MITRE ATT&CK framework.

See What's New for a summary of the most recent releases and their new features and enhancements.

Release 5.9.1

August 17, 2023

This release introduces health insights to notify you when detections fail to run.

Release 5.9

August 10, 2023

This release provides the following new features and enhancements:

• Ability to ingest custom raw data into Snowflake. Each field from the raw log is extracted as a table column in Snowflake.

• Enhancements to the Hunt experience, including the following:

  • Ability to add multiple events of interest (EOIs) to evidence with a single step.

  • Improved performance dealing with issues related to timeouts and maximum number of entries.

Release 5.8

July 27, 2023

This release provides the following new features and enhancements:

• A guided onboarding workflow so new customers can integrate the Anvilogic platform with Splunk, perform key actions, and start getting detections.

• Added the following third-party vendor alert integrations:

  • GitHub Dependabot ALerts

  • Wiz.io Alerts

• Ability to add to an allow list from the event viewer in Unified Detections.

• Validation for threat scenario deployment so make sure that any dependent threat identifiers and their dependent macros are also available and deployed.

Release 5.7

June 29, 2023

This release provides the following new features and enhancements:

• A guided onboarding workflow so new customers can integrate the Anvilogic platform with Splunk or Snowflake, perform key actions, and start getting detections.

• A scratchpad is added to the Unified Detections canvas so you can create custom SQL queries and save your own macros.

• MITRE mapping for third-party vendor integration data is improved to consider the data categories mapped in your environment.

Release 5.6

June 15, 2023

This release provides the following new features and enhancements:

• Ability to ingest Google Security Command Center vendor alerts.

• After you integrate the Anvilogic platform with Snowflake, you can view details of the integration, such as the connected Snowflake instance and search commands.

• Improvements to Hunt and Investigate.

• Usability enhancements and bug fixes.

Release 5.5

June 2, 2023

This release provides the following new features and enhancements:

• When you deploy a rule in a threat identifier, a new workflow validates and checks for dependent macros before the rule is deployed.

• The Anvilogic platform provides recommended follow-up tasks upon completion of certain workflows, such as building and deploying content, maturity score updates, and investigations.

Release 5.4

May 18, 2023

This release provides the following new features and enhancements:

• Ability to ingest Tanium Cloud endpoint vendor alerts.

• Usability enhancements and bug fixes.

Release 5.3

May 4, 2023

This release adds the ability to ingest Microsoft Defender logs into Snowflake and enable Anvilogic detections.

Release 5.2

April 20, 2023

This release includes the following new features and enhancements:

• New Hunt pages to help you drill down and investigate your hunting insights, or start a new hunt from scratch.

  • Add evidence to any hunt to create a threat trail.

  • Generate a PDF report of any hunt.

  • Save and revisit your hunts at any time.

• Ability to ingest AWS Cloudtrail logs into Snowflake and enable Anvilogic detections.

• The tactics, techniques, and threat groups on the Anvilogic platform are updated to support the latest version of the MITRE ATT&CK framework.

Release 5.1

April 6, 2023

This release includes the following new features and enhancements:

• The home page is updated to highlight prioritized trending topics, personalized tasks and recommended content for the user who is logged in, and actionable insights.

• Stylistic enhancements on the Maturity Score history page.

Release 5.0

March 30, 2023

This release provides a unified searching capability so you can create threat identifiers across multiple connected data repositories.

Use the guided onboarding to define your company's threat profile and make the Anvilogic platform work according to your needs and priorities.

Benefits of setting threat priorities

Anvilogic provides prioritized content recommendations based on the following factors:

• Your threat priorities

• Market and industry trends

• Your trusted group activity

• Popular search terms

• Activity from organizations similar to you

Gather your organization’s specific threat priorities to help Anvilogic recommend use cases specific to your organization rather than generic recommendations based on external factors.

What's in a threat profile?

To build your company profile, provide the information listed in the table. This information helps to filter the MITRE techniques most applicable to you, so that the most relevant recommended content is generated.

Revisit your threat priorities

As your organization matures over time, you can revisit and update your threat profile to accommodate changes to your infrastructure, including platforms, threat groups, techniques, and data categories.

Next step

After you define your threat profile, Select your data repository and get data in.

Perform the following tasks to download and install the Anvilogic App for Splunk on Splunk Cloud Platform:

1. Verify requirements

2. Install the Anvilogic App for Splunk

Next step

Verify requirements

The Anvilogic App for Splunk provides triage, allow list and suppressions management, and analytics used by the data feed and productivity scores on the maturity score pages.

You can also enable automated threat detection in the Anvilogic App for Splunk, which is required to generate tuning insights and some hunting insights.

Snowflake-only customers can get tuning insights without the Anvilogic App for Splunk.

I am a Splunk user

If you are already using Splunk Enterprise or Splunk Cloud Platform, follow the instructions in the documentation to download and install the Anvilogic App for Splunk.

Next step

Select one of the following to continue:

• Splunk Enterprise

• Splunk Cloud Platform

I don't have Splunk

If you don't have Splunk, and you want the capabilities provided by the Anvilogic App for Splunk, Anvilogic will provision a Splunk instance for you and manage the installation and upgrade of the Anvilogic App for Splunk.

Next step

After the Anvilogic platform is connected to a hosted Splunk instance, Review data feeds.

Your welcome packet email from Anvilogic contains a link to log in to the Anvilogic platform for the first time. You must change your password the first time you log in to the Anvilogic platform.

1. Make sure you are a user with administrator privileges on the Anvilogic platform.

2. Click Set Password in the welcome package email. You are directed to set password page.

3. Enter the email address with which you have registered. This email address must match the email address that the welcome email was sent to.

4. Enter a password meeting the password requirements.

5. Re-enter the password for confirmation.

6. Review the Master service agreement and the privacy policy and click on the check box indicating your consent.

7. Click Submit.

After you log in, you will see the first screen of the guided onboarding.

Click Let's Start to begin.

This guide will help you log in, complete the guided onboarding to set threat priorities and integrate a data repository, get data in, and deploy detections.

Onboarding workflow

The following flowchart summarizes the tasks you will complete to get started.

Get started

The Anvilogic platform is supported on the highest versions of Google Chrome and Mozilla Firefox.

If you're ready, Log in and set your password to get started with your Anvilogic onboarding.

Need help?

After defining your company profile in the guided onboarding, select Splunk as the data logging platform.

Next step

Download and install the Anvilogic App for Splunk

See What's New for a summary of the most recent releases and their new features and enhancements.

Release 6.9

January 9, 2024

This release provides the following new features and enhancements:

• Continuous assessment of data feeds to provide assurance to the SOC team that the underlying data is being logged, collected, and extracted as expected.

• Ability to create custom threat groups.

• Ability to automatically escalate hunting insights by type.

Release 6.8.1

December 21, 2023

This release introduces the following new features and enhancements:

• Ability for Snowflake users to create additional enrichments in your Unified Detect queries.

• Ability to ingest Orca Security vendor alerts.

Release 6.8

December 14, 2023

This release provides the ability to push ExtraHop vendor alerts directly to the Anvilogic platform.

Release 6.7

November 30, 2023

This release provides bug fixes and performance enhancements.

Release 6.6

November 16, 2023

This release provides Enhanced health insight error details provided by MonteAI so that you can understand an error without knowing all the details about the error codes and error snippets.

Release 6.5

November 2, 2023

This release provides the following new features and enhancements on list view pages such as the Data Feeds, Threat identifiers, Threat Scenarios, and Macros:

• Searches are now applied to all content on the Anvilogic platform. Only filters apply to local content.

• On each page, the top 100 results are listed instead of the top 10, making it easier to find results using Cmd-F on Macs or Ctrl-F on Windows.

• Various performance and usability enhancements related to count results when applying filters and how data is fetched when searches are issued.

Release 6.4

October 19, 2023

Release 6.3

October 5, 2023

This release provides the following new features and enhancements:

• Ability to ingest Crowdstrike IDP vendor alerts.

• Ability to view the history of actions taken on any health insight.

Release 6.2

September 21, 2023

This release introduces the ability to automatically deploy new recommended threat identifiers that meet a minimum score threshold and specific data categories.

Release 6.1

September 7, 2023

This release introduces the ability to change the owner of any saved hunt on the Anvilogic platform.

Release 6.0

August 25, 2023

This release provides the following new features and enhancements:

• Productivity metrics in the maturity scoring algorithm take into account analyst activity along with health, tuning, and hunting insights.

• Usability enhancements and bug fixes.

Perform the following tasks to download and install the Anvilogic App for Splunk on Splunk Enterprise

1. Verify requirements

2. Download the Anvilogic App for Splunk

3. Install the Anvilogic App for Splunk

After defining your company profile in the guided onboarding, select a data repository:

Next step

Follow the instructions for your data repository.

• Integrate Splunk as your data repository

• Integrate Snowflake as your data repository

Supported versions

You can integrate the Anvilogic platform with Splunk Enterprise versions 9.0.x and 8.0 - 8.3.x.

Splunk Enterprise Security (ES) versions 5.0 - 7.0.x are supported.

Where to install the app

Install the Anvilgic App for Splunk on your Splunk search head. The server where you install the Anvilogic App for Splunk must meet the following requirements:

If you have multiple Splunk Enterprise instances, install the Anvilogic App for Splunk in only one of those environments.

Splunk Enterprise deployment considerations

For performance considerations, review the following factors in your Splunk Enterprise deployment:

• The number of concurrent users.

• The number of concurrent searches.

• The types of searches used.

When you deploy threat identifiers on the Anvilogic platform, saved searches are created in your Splunk deployment. You can use cron scheduler recommendations on the Anvilogic platform to manage the load on your Splunk deployment.

Splunk Enterprise resource and hardware considerations

Last updated 1 month ago

Supported versions

You can integrate the Anvilogic platform with Splunk Cloud Platform versions 8.0.x and higher. Splunk Enterprise Security (ES) versions: 5.0 - 7.0.x are supported.

If you are using the Splunk Cloud Platform Classic experience, you won't be able to accept tuning insights.

Allow IPs

If you are installing the Anvilogic App for Splunk on Splunk Enterprise Security (ES) search heads in Splunk Cloud Platform, and you also have search heads that are not on Splunk ES, you must allow all IPs to send to the Splunk Cloud HTTP event collector (HEC) endpoint on port 443 since Splunk Cloud Platform does not assign static IPs to the Splunk Cloud Platform search heads.

Remove the app from dual environments

If your environment includes Splunk ES running on Splunk Cloud Platform Victoria and Splunk Enterprise, the Anvilogic App for Splunk is installed in both environments. You must submit a support ticket with Splunk Support to remove the Anvilogic App for Splunk from one of those environments.

Next step

After verifying the requirements, Install the Anvilogic App for Splunk.

Download instructions

Perform the following steps to download the Anvilogic App for Splunk:

2. Click Login and log in with your Splunk account.

3. Type Anvilogic in the Search for apps field. Click on Anvilogic App for Splunk in the results.

4. Click Download.

Troubleshooting download permissions

If you don't have the permissions to download the app, you will see Download Restricted when you try to download the app.

If this happens, you must provide Anvilogic with your Splunk.com or Splunkbase username to satisfy Splunk's access control requirements. You must provide this username for each user who requires download access for the Anvilogic App for Splunk.

Perform the following tasks to find your Splunkbase username:

2. Click you user profile photo or avatar, then select My Profile.

3. Find your username at the top of the screen, such as kevin.hwang@anvilogic.com in the following example:

Download the Anvilogic App for Splunk from the Anvilogic platform

If needed, you can download the Anvilogic App for Splunk from the Anvilogic platform:

2. In the Anvilogic Splunk App field, click Download.

The downloaded file is an SPL (Splunk application package) file that can be installed in your Splunk environment.

The Anvilogic App for Splunk requires custom Splunk indexes used by the HTTP Event Collector (HEC) collector command for auditing, metrics and reporting:

Next step

Assign the avl_admin role.

Connect the app to the Anvilogic platform

Perform the following steps to complete your initial configurationand connect the Anvilogic App for Splunk to the Anvilogic platform:

1. In Splunk Web, select Apps > Anvilogic to access the Anvilogic App for Splunk.

2. If this is your first time installing the Anvilogic App for Splunk, you are prompted to set up the app. Click Continue to app setup page. To access the app configuration settings after the initial configuration, go to Settings > App Configuration.

3. Complete the general settings.

   1. On the Anvilogic platform, select Settings > Generate API Key. Copy the generated API key.

   2. Navigate to the Anvilogic App for Splunk.

   3. Select Setting > App Configuration.

   4. Click and expand the General Settings section.

   5. Click and expand the API Settings section.

   6. Paste the API key you copied earlier into the API Key field.

4. If your network requires a proxy to connect to Anvilogic, configure the proxy settings in the Anvilogic App for Splunk configuration page.

5. Click Save.

Verify the connection

In your Splunk instance, run the following Splunk search to verify your app's connection with the Anvilogic platform:

| avlmanage command=check_app_health

You can view your connection status along with other system health information in the Health Monitoring dashboard in the Anvilogic App for Splunk.

Next step

Review data feeds.

If you have existing detections, you can export them to a CSV file, then import the CSV into Anvilogic. Doing this helps you get an idea of what your MITRE coverage looks like, so you can address and strengthen the areas where you need additional coverage.

Next step

Review and deploy recommended content

Your data feeds are automatically categorized and synchronized to the Anvilogic platform every 7 days. When you add a data feed, you can view it on the Data Feeds page within 7 days.

Review the data feed category

To change or add categories to a data feed:

1. Click on the name of the data feed.

2. Click Tags.

3. In the Data Categories, field, enter the data categories you want associated with this data feed.

4. Click Update when you are finished.

Review the data feed quality

An initial quality feed assessment is made by the Anvilogic platform for any new data feed added to the Anvilogic platform.

Perform your own evaluation of the timeliness, logging level, field extraction, and monitoring scope for each data feed so you can assign a proper data feed quality. Feed quality is important because only Good quality feeds are used to generate recommendations on the Anvilogic platform.

To manually change the quality of a data feed:

1. Click on the name of the data feed.

2. Select one of the qualities from the Feed Quality dropdown.

3. Click Update when you are finished.

Next step

Customize roles

• avl_admin

• avl_senior_developer

• avl_developer

• avl_senior_triage

• avl_triage

• avl_readonly

You can customize the avl_senior_developer, avl_developer, avl_senior_triage, and avl_triage roles. The avl_admin and avl_readonly roles can't be modified.

For example, perform the following tasks to customize the capabilities allowed or restricted by the AVL Senior Developer role:

1. In the Anvilogic App for Splunk, select Settings > App Configuration.

2. Click User Settings to expand the section.

3. Click Customize AVL Senior Developer Role to expand the section for that role.

4. Deselect any capabilities you want to remove for this role, or select a capability to add it to the role.

5. Click Save.

Summary of roles and privileges

The following table lists the roles in the Anvilogic App for Splunk and the privileges granted by each role. You can customize the privileges enabled for each role as desired.

Next step

Configure the HEC collector commands.

Assumptions

This document assumes you have completed the guided onboarding:

• You have defined your company threat profile.

• You have integrated Snowflake as your data repository

Before you continue, make sure you are a user with administrator privileges on the Anvilogic platform.

Data onboarding summary

The following flowchart summarizes the process for getting your data into Snowflake.

Data onboarding steps

Pick one of the following next steps, depending on your infrastructure:

Self-managed pipelines

Anvilogic-managed pipelines

Next step

Review data feeds

The Anvilogic App for Splunk contains a custom Splunk command that uses the HTTP Event Collector (HEC) to send results from threat identifiers into the events of interest index. This command is critical to the frameworks ability to store events for advanced correlation, and manages auditing on all objects.

Perform the following steps to create inputs on a single search head. Some steps may vary if you are managing a search head cluster.

1. In Splunk Web, select Settings > Data inputs.

2. Select HTTP Event Collector > New Token.

3. Fill in relevant information:

   • Specify a name of avl_hec_token.

   • Leave the Source Name Override blank.

   • Enter HEC Input for Anvilogic Detection Framework as the description.

   • Leave the Output Group as none.

   • Leave the Enable indexer acknowledgement box unchecked.

4. Click Next to configure the input settings:

   • Source type = Automatic

   • App Context = Anvilogic (anvilogic)

   • index = anvilogic AND index = anvilogic_metrics

   • Default Index = anvilogic

5. Click Review, then click Submit.

6. Copy the token value.

Perform the following steps to update the global settings and enable the tokens:

1. In Splunk Web, select Settings > Data inputs.

2. Select HTTP Event Collector > Global Settings.

3. Ensure the following settings are enabled:

   • All Tokens: Enabled

   • Enable SSL - Check

   • HTTP Port Number = Default is 8088

Next step

Connect to the Anvilogic platform.

Architecture Diagram

Below is the generic architecture digram for how Anvilogic works on top of Splunk.

Diagram:

PDF Download:

Frequently Asked Questions (FAQs)

Architecture Diagram

Below is the generic architecture digram for how Anvilogic works on top of Azure.

Diagram:

PDF Download:

Frequently Asked Questions (FAQs)

The Anvilogic platform generates recommended content for you to deploy based on your threat priorities and good quality data feeds.

Where can I view recommended content?

Deploy recommended content

The table defines additional types of recommended content on the Anvilogic platform and how you can deploy them.

Next steps

Create users and assign privileges

Configure additional authentication settings

Splunk Cloud Platform Classic Experience

File a service ticket to have Splunk install the Anvilogic App for Splunk for you.

Splunk Cloud Platform Victoria Experience

Next step

Create the Anvilogic indexes.

Architecture Diagram

Below is the generic architecture digram for how Anvilogic works on top of Snowflake.

Overall Diagram:

ETL Parsing & Normalization Process

PDF Download:

Frequently Asked Questions (FAQs)

Follow the instructions in the Splunk documentation to install the Anvilogic App for Splunk in your environment:

You must restart Splunk to complete the installation.

Thank you for taking a free trial of Anvilogic. During this 30 day trial you will be given access to a shared Anvilogic platform account. While this account will not have any production data or connect to your security analytics environment, you can use this free trial environment to get a feel for a few of the available features and workflows in Anvilogic.

A pilot or product deployment will have far more capabilities and features, but using this environment will enable you to experience:

• Anvilogic’s detection engineering workflow, including adding detections to the workspace, creating tasks, and editing content

• Security detection content provided by Anvilogic’s purple-team-as-a-service (the Forge) in the Anvilogic Armory

• Building your own custom high-fidelity detections using Anvilogic’s no-code scenario builder

• Reviewing MITRE ATT&CK coverage and gaps

Problem: Detection engineering using current processes and tools is often slow, manual, and requires multiple people and systems to accomplish and track. Prior to Anvilogic, our customers said a single detection could take weeks to operationalize. This results in a time lag between threats in the wild and your ability to detect these threats and deliver high-quality, correlated alerts to the SOC, without generating noisy false positives.

Anvilogic Solution: We provide customers with both high-quality, correlated detection content and an integrated, automated platform to research, test, deploy, and maintain all of your detection content regardless of the data platforms and security tools in the environment.

The heart of the Anvilogic platform is to enable detection engineers to go from threats to detections in minutes, instead of days or weeks. In this section we will deploy a recommended detection in just a few clicks. In a full pilot, this would actually create a scheduled detection search against your data to look for suspicious activity. Let’s start in the main armory view (which will be covered more in depth in the next section).

From the main navigation on the left, hover over and click on “Armory”

Scroll down if necessary to see the “recommended detections” list. Click "See all" on the right, then click the Threat Identifiers button on the top. Choose any one of the recommended detections and click on its name. This will take you into a detailed view of the threat identifier use case.

Within this view you will see general information about the detection near the top including the name, data domain, MITRE ATT&CK techniques, killchain mappings, and a description of the detection. You will also see a list of the individual detection rules within the threat identifier use case. Every threat identifier will have 1 or more rules, where each rule is mapped to a particular combination of data repository and data category. There are expand/collapse arrows on the left side of each rule, which you can press to hide or show the details of the rule.

Notice that at least one of these rules will have a star icon near on the left side near the rule number. This indicates that this particular rule is recommended for your environment based on the good quality data in your data stores. If it isn’t already expanded, expand this rule by clicking on the expansion arrow on the left.

This expanded view of the rule contains summary data, the rule logic (including multiple versions of it if there is more than one), and tabs to see things such as threat examples, data source validator searches, risk scores, performance analytics, custom and standard tags, and default triage steps. Much of this metadata is used to enrich the alerts and warning signals that fire from this detection. You can also take a look at the rule logic, which contains the detection patterns, data manipulations, as well many macros used to retrieve data, normalize it, and enrich it. At the end of the logic, a description of the event is written and all the important fields are written to the events of interest index for further correlation.

Since we found this detection in the armory, in order to fully deploy it we will complete 2 basic steps: add it to our workspace as a local copy, then deploy it to our detection platform.

First, we need to make a local copy of it from the global copy in the Anvilogic armory, which we do by adding it to our workspace. Click on the blue “+ Workspace” button in the upper right corner. This will bring up the add to workspace dialog.

From here, you can check or uncheck additional boxes for different rules (recommended ones will be checked). You can and should also create an associated task in the lower part of the dialog (the default). You can change the status and priority or add a comment if you like, but leave the assignee set to your user name. Click the Add button to continue. You will then be taken to the local copy of the threat identifier in your workspace based on the armory copy.

You can click on the Edit button in the upper right corner if you want to make any changes to the rule at this point. In a full Anvilogic pilot you would be able to click a “Test” button here as well to work with and test the detection logic in your production environment before deploying the rule, though this feature is not available in our test drive environment.

Before deploying the rule, however, let’s take a look at the task you created in the previous step. From the main navigation on the left hover and then click on “Tasks.” This brings up the task view.

From here you should see the task to deploy the threat identifier detection you just created when you added it to your workspace. If you click on the Task ID you will see the details and history of the task itself.

To deploy the detection and get back to where we were previously, in the column entitled “Related Content ID #s” click on the rule ID (AVL_RXXXXX) on the right side of that column. You will then see the rule again with the Deploy button ready to go.

Click on the deploy button. This will bring up the rule deployment dialog. You will see that it offers some information as well as dependency checks (which you can ignore in this test drive).

You will notice that Anvilogic automatically recommends a cron expression that optimizes the best time to run this detection logic based on the current workload on the detection engine. You can drill into this further if you like by clicking on the “Suggest Optimal Schedules” link, but note that you will need to be in a pilot environment to see any meaningful data here. Now click the “Deploy” button and you will briefly see a message that the rule has been queued for deployment. In a full pilot environment, this could actually fully deploy the detection rule, or you can add another layer of testing and approval within the universal search engine platform for additional separation of duties.

You have now gone from threat to detect in minutes, without having to write a single line of code and all from a single, integrated platform that supports full auditing and separation of duties. Feel free to repeat this process for other detections that interest you, or even for trending topics and scenario based detections.

Pre-Reqs

• Anvilogic account

• Snowflake data repository connected to your Anvilogic account

Setting up FluentBit Config

1. Anvilogic will provide a S3 bucket and the corresponding access keys/ids (note these change for each integration) when you create a forward events integration in your Anvilogic deployment.
2. Create a credential file on the machine that fluentBit can read from. For example, /home/<username>/creds . Inside the file please paste the following config with your specific access key/id

[default]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

1. Since our credentials are already updated in the /home/<username>/creds file, we need to configure the service config file for Fluent Bit and set the path to this credential file (see image for reference). To do that, fire up your favorite text editor and edit the fluent-bit.service file located at /usr/lib/systemd/system/fluent-bit.service.

   1. Environment="AWS_SHARED_CREDENTIALS_FILE=/home/<username>/creds"

1. Then run the following commands in a terminal window

   1. sudo systemctl daemon-reload

   2. sudo systemctl start fluent-bit

2. Next we need to configure fluentbit to read our logs and send them to S3. In this example, I will be looking at apache2 access logs and sending them to S3.

[INPUT]
    Name              tail
    Tag               apache
    Path              /var/log/apache2/access.log
    Parser            apache2
    Mem_Buf_Limit     50MB

[OUTPUT]
    Name              s3
    Match             *
    bucket            avl-raw-prod-s3-111-12345678/sdi_custom_data-0
    region            us-east-1
    use_put_object    On
    Store_dir         /tmp/fluent-bit/s3
    s3_key_format     /$TAG/%Y/%m/%d/%H/%M/%S

Once you have pasted the above config into your fluentBit.conf file (typically located at /etc/fluent-bit/fluent-bit.conf)

• NOTE: You can also edit or add any of your own customer parsers for logs by editing the parser.conf file at /etc/fluent-bit/

• Once you have edited your fluent-bit.conf, please restart the fluentBit service sudo systemctl restart fluent-bit

  • You can validate that your config is working by heading to /tmp/fluent-bit/s3/ and looking inside that folder.

1. You can now confirm that data has landed in your snowflake account.

Please update the input section of this example config to fit your exact needs.

Choose Snowflake

After defining your company profile in the guided onboarding, select Snowflake as the data logging platform.

You must have admin privileges in Snowflake in order to complete the integration.

Connect Snowflake to the Anvilogic platform

Perform the following steps to complete the integration with Snowflake:

1. Input your Snowflake account identifier to establish a connection between your Snowflake instance and the Anvilogic platform.

2. Click Copy Code, then click Go to Snowflake to go to your Snowflake instance and run the copied SQL commands. This set of SQL commands creates the necessary Snowflake components, the anvilogic_service Snowflake user used by the Anvilogic platform, and assigns the necessary permissions to the anvilogic_admin role for the anvilogic_service user.

3. Perform the following tasks in your Snowflake instance:

   1. Open a new worksheet.

   2. Change the role from PUBLIC to ACCOUNTADMIN.

   3. Paste the copied SQL commands into the new worksheet.

   4. Click the All Queries checkbox to run all the commands.

   5. Click Run.

   6. Look for the Statement executed successfully message.
4. Return to the Anvilogic platform, then click Next.

5. Click Copy Code, then click Go to Snowflake to go to your Snowflake instance and run the copied SQL commands. This set of SQL commands creates the S3 storage integration and allows access to the anvilogic_service user so that a connection to your managed S3 bucket where Snowflake retrieves the data can be made.

6. Perform the following tasks in your Snowflake instance:

   1. Open a new worksheet.

   2. Change the role from PUBLIC to ACCOUNTADMIN.

   3. Paste the copied SQL commands into the new worksheet.

   4. Click the All Queries checkbox to run all the commands.

   5. Click Run.

   6. Look for the Statement executed successfully message.
7. Return to the Anvilogic platform, then click Add.

Next step

After you have defined your company's threat profile and connected Snowflake as a data repository, it's time to Get data into Snowflake.

Account Activation and Login

Landing Page

When you are signed in you will be taken to the Anvilogic Platform home page.

This page provides you with an overview of your current maturity score, MITRE ATT&CK coverage, detection summary, use cases in your workspace, and recommendations for additional detections to deploy. Feel free to click around.

Please note that some items in the free trial are intentionally disabled as they depend on integration with your security data lake. In a full Anviliogic pilot, you will have full functionality across all features. The intent of the free trial is to give you a taste of the capabilities of the Anvilogic platform without any configuration whatsoever. The rest of this guide will walk you through some of the common activities our customers use the Anvilogic platform for.

Navigation

Clicking the 3 bars in the upper left of the interface, or simply hovering over the icons on the left side will bring up the navigation menu. From here you can go back to the home page, or access many of the other areas of the platform. Feel free to explore the items here, but the rest of this guide will walk you through several of the key features enabled in this free trial environment.

Pre-Reqs

• Anvilogic account

• Snowflake data repository connected to your Anvilogic account

Setting up FluentBit Config

1. Anvilogic will provide a S3 bucket and the corresponding access keys/ids (note these change for each integration) when you create a forward events integration in your Anvilogic deployment.
2. Create a credential file on the machine that fluentBit can read from. For example, /home/<username>/creds . Inside the file please paste the following config with your specific access key/id

1. Since our credentials are already updated in the /home/<username>/creds file, we need to configure the service config file for Fluent Bit and set the path to this credential file (see image for reference). To do that, fire up your favorite text editor and edit the fluent-bit.service file located at /usr/lib/systemd/system/fluent-bit.service.

   1. Environment="AWS_SHARED_CREDENTIALS_FILE=/home/<username>/creds"

1. Then run the following commands in a terminal window

   1. sudo systemctl daemon-reload

   2. sudo systemctl start fluent-bit

2. Next we need to configure fluentbit to read our logs and send them to S3. In this example, I will be sending logs via Syslog and sending them to S3.

Once you have pasted the above config into your fluentBit.conf file (typically located at /etc/fluent-bit/fluent-bit.conf)

• NOTE: You can also edit or add any of your own customer parsers for logs by editing the parser.conf file at /etc/fluent-bit/

• Once you have edited your fluent-bit.conf, please restart the fluentBit service sudo systemctl restart fluent-bit

  • You can validate that your config is working by heading to /tmp/fluent-bit/s3/ and looking inside that folder.

1. You can now confirm that data has landed in your snowflake account.

Please update the input section of this example config to fit your exact needs.

Pre-Reqs

• Anvilogic account

• Snowflake data repository connected to your Anvilogic account

Setting up FluentBit Config

1. Anvilogic will provide a S3 bucket and the corresponding access keys/ids (note these change for each integration) when you create a forward events integration in your Anvilogic deployment.
2. Following the steps of the AWS CLI install, once you have done the installation correctly - Please run aws configure and paste in the access key and id provided. Once this is completed, validate that the credentials have been created - usually C:\Users\YourUsername.aws\credentials.

3. Once that has been validated, we need to create a system variable in order for fluentBit to read/use these credentials. To do so;

   1. Open the Start Menu and search for “Environment Variables.”

   2. Select Edit the system environment variables.

   3. In the System Properties window, click the Environment Variables button.

   4. Under System variables, click New.

   5. Enter the following:

      1. Variable name: AWS_SHARED_CREDENTIALS_FILE

      2. Variable value: C:\Users\YourUsername\.aws\credentials

   6. Next we need to configure fluentbit to read our logs and send them to S3. In this example, we will be ingesting the windows event logs. You can change what channels by simply adding or removing them.

      1. Please note, the bucket will be the bucket name/path.

         1. This could mean that it is sdi_customer_data-1 or -2 or -3.

Once you have pasted the above config into your fluentBit.conf file (typically located at C:\Program Files\fluent-bit\conf )

• NOTE: You can also edit or add any of your own customer parsers for logs by editing the parser.conf file at /etc/fluent-bit/

• Once you have edited your fluent-bit.conf, please restart the fluentBit application

1. You can now confirm that data has landed in your snowflake account.

Please update the input section of this example config to fit your exact needs.

Architecture Diagram

Below is the generic architecture digram for how Anvilogic works on top of a hybrid data environmet like Snowflake & Splunk

Diagram:

PDF Download:

Hybrid FAQ

Frequently Asked Questions (FAQs)

Create SQL Queries

• • Select Snowflake and PROCEED

• Drag GATHER DATA component from the right components list

• Select avl_get_snowflake_data_edr

• Drag Code Block or Filter component from the right components list to begin building queries

Problem: Detection engineering today mostly relies on simple patterns or string-based detection logic. These types of detections usually result in a lot of downstream noise in the form of false positive alerts delivered to the SOC triage team. This creates alert fatigue and added expense, which ultimately results in a weakened security posture.

Anvilogic Solution: Anvilogic’s approach to alerting involves a 2-tiered method of first collecting warning signals (like traditional pattern based detections looking for suspicious activity), and then correlating those warning signals into risk-based or scenario-based detections. This allows for a much higher fidelity of actionable alert to be delivered to the SOC triage and IR teams without all the noisy false positives. We provide out-of-the-box threat scenarios in our Armory, as well as give customers the ability to create their own scenarios without having to write a single line of detection code.

In a previous section we deployed a threat identifier. In most cases you would configure that threat identifier to collect warning signals as “events of interest” in an Anvilogic data store, but not necessarily generate an actionable alert. In order to ensure that the SOC triage team receives high quality alerts without a lot of noise, Anvilogic customers take advantage of our threat scenario detections. These can be used for risk-based alerting as well as more sophisticated and extremely flexible scenario-based detections, modeled on real-world behavioral attack patterns seen in the wild, or even based on custom patterns you can create in Anvilogic without writing a single line of code.

Let’s start by looking at an out-of-the-box threat scenario provided by Anvilogic. From the main navigation on the left hover and then click on “Armory,” taking you back to the main armory menu. On the top, click on the number below the “Threat Scenarios” label to see a filterable list of provided threat scenarios in the armory. Feel free to create a filter, drill into any of these, and explore the content.

Now click into the search box at the top of the screen, type “malicious file delivering malware,” and click the matching threat scenario at the top of the results. It will take you to the detailed view of the threat scenario.

You can explore the details of this threat scenario. You can see metadata about the kill chain phases and threat groups that use this scenario at the top, along with an expandable description. If you scroll down you will see a graphical representation of the logic and other metadata fields used for enrichment.

This particular scenario consists of 3 stages, 2 of which have multiple groups of events that could trigger it. The entire scenario is correlated based on a common host. It will fire when threat identifier rules matching group 1 criteria are followed by group 2 and group 3 identifiers for a common host within the described time frames. You can click on any group to see details about the threat identifiers.

You can also click the bracket icon (< >) on the upper right of the scenario logic definition section to see the underlying logic as code.

At this point, you could potentially deploy this scenario as long as you have a minimum set of underlying threat identifiers deployed (we make it easy to check this and get them deployed if you need to do so). Instead, let’s explore how easy it is to actually create one of these threat scenarios from scratch without writing any of that underlying code.

From the main navigation menu on the left, click the + icon for New Content near the top.

Select “Threat Scenario” then hit “Proceed.” This will open the new threat scenario no-code builder with a blank threat scenario.

Give your use case a title in the box near the top. Now let's create a scenario. You can follow my example or choose different criteria, but it is best to select conditions from the dropdown lists that have a non-zero number on the left in parenthesis, indicating that you have at least 1 detection deployed that matches that condition.

Click into stage 1 and rename it to “initial access.” Click inside of Group 1 to pull up the definition dialog.

For the first condition, leave “filter by” set to MITRE ATT&CK and hit the drop down for “choose conditions.” From there, select “Initial Access.” You should see at least 1 threat identifier that meets this criteria. Click “add more conditions,” leave the “and” operator, and this time change the “filter by” to “use case categories” and “choose conditions” to “Hacking/Unauthorized Access.” Click the “add” button to save it.

Now look above stage 1 and click into the “entities of interest” box. Leave “correlated host” checked, and check the box for “correlated IP” also.

Now let’s add another stage. Click “Add Stage” then click the diamond with the time in between the stages. You can change it, e.g. to 60 minutes between the first 2 stages correlated across a common host or IP, then hit “update.”

Now change the name of stage 2 to “Execution,” click inside its group 1 box, and set the condition to MITRE ATT&CK execution phase. You should see at least 1 threat identifier selected. Hit “add” to save this stage.

Repeat the process one more time by adding another stage, renaming and drilling into group 1, filtering by MITRE ATT&CK privilege escalation and Data Domain endpoint, clicking “add” to save it.

Your final threat scenario should look something like this.

Click on the bracket icon (< >) on the right side of the scenario definition to see the underlying code that the scenario builder created for you.

At this point, you can hit Save in the upper right corner. From the main navigation menu on the left, click the “Scenarios” icon. This takes you to a list of scenarios in your workspace. Reverse sort on the Last Modified column on the right and you should see the threat scenario you just created at the top.

Problem: Detection engineering using current processes requires specialized sets of skills including security domain expertise as well as data platform query skills across potentially multiple data platforms and languages. It is difficult to create good-quality content quickly enough to keep up with emerging threats.

Anvilogic Solution: Our expert team of security researchers acts like a purple-team-as-a-service, providing our customers with a constant flow of high-quality, correlated detection content. It is developed in labs using real-world attack tools modeled on real-world attack patterns. This content is delivered in a very timely manner (particularly for severe and urgent threats), and spans different data platforms, log sources, and security tools in the environment.

There are many ways to explore and deploy the detections Anvilogic’s Forge team provides to our customers. We have deployed content in the previous section, but now let’s take some time to delve more deeply into the content in the Armory. Let’s start at the main Armory page.

From the main navigation on the left, hover over and click on “Armory”

As you can see, there is a large amount of content available in the armory, and there are many ways to find what you want. Anvilogic’s purple-team-as-a-service is constantly creating new content, both to deepen coverage of existing known threats, and to address new and emerging threats, campaigns, and vulnerabilities. We are able to roll out detections to the armory for instant deployment very quickly for critical vulnerabilities, ensuring our customers can protect their organizations in minutes when these events occur.

The actual detection content falls into 3 major categories:

• Threat Identifiers - These are specific detections looking for patterns or strings in log events that indicate something suspicious has occurred. Alerts from your vendor security products (e.g. an EDR) can also be fed into Anvilogic directly, generating their own threat identifiers. Note that most threat identifiers don’t generate alerts to your triage team on their own - rather they generate warning signals (“events of interest”) that are then used as parts of higher fidelity detections based on risk or real-world threat scenarios. You can, however, generate alerts for higher-fidelity threat identifiers as well.

• Threat Scenarios - These are correlated detections based on the warning signals created by Threat Identifiers and security vendor alerts. These correlations are based on real-world attack patterns and known adversary behaviors, which yields much better results than merely looking for indicators of compromise or simple pattern-based detections. This is how Anvilogic helps detection engineers deliver much better, actionable results to the SOC without a lot of noisy false positives.

• Macros - These are the building blocks of data collection, normalization, and enrichment used within threat identifiers. They allow our detections to gather, normalize, enrich, and tune detection rules easily and inline with your detection searches, creating more useful warning signals and alerts without the need for additional backend enrichment through a SOAR.

You can click on any of the numbers at the top to see the detection content under the labels including the full armory, type of content described above, or broken down by MITRE ATT&CK tactic, platform coverage, or domain coverage. You can further filter any of these views using the filters on the left for a very granular way to find content.

In addition, you can use the search bar at the top of any Anvilogic window to instantly search for detection content using any search criteria.

Going back to the main Armory page (back button on the browser, or main navigation - armory), as you scroll down the page you will see a few key groupings of detections in addition to the counts and breakdowns near the top. These include:

Here you can see if you are covered for this trending topic, read the threat intelligence summary, mass deploy the content, or drill into and deploy individual detection content.

• Recommended Detections - Anvilogic will automatically recommend specific detection content based on your custom priorities, coverage gaps, and available good quality data. Each recommended detection is marked with a star and a recommendation score on a scale of 1 to 100. If you hover over the score, you will see why the particular detection is recommended and what contributed to that score.

• Recommended Detection Packs - Detection packs are collections of detections mapped to a specific data platform (e.g. Splunk, Snowflake, Azure, or Devo), specific data category (e.g. Windows Events), and specific MITRE ATT&CK tactic (e.g. Initial Access) that you can deploy en masse. These are a great way to generate a lot of relevant warning signals when getting started with the platform, without overwhelming the SOC with alerts.

Monte Copilot comes equipped with specific tools to help answer questions you are asking in real-time. Tools are used to collect information across different security resources so that each answer is as accurate as possible.

Ask Monte Copilot questions about IP addresses, URLs, domains, processes and commands with and without arguments, encoded and plain text processes and commands, and file hashes.

For example, you can ask whether or not a specific IP address is suspicious, ask for an explanation of a particular PowerShell command, or ask Monte Copilot to write a specific command for you.

Current tools

Current tools used by Monte Copilot, in alphabetical order:

Overview

Licensing Model

Monte Copilot's licensing model is Metered-Based, measuring the number of questions per day. Due to the non-deterministic nature of its compute requirements—depending on the number of queries, active users, and integrations with external tools (e.g., VirusTotal, Shodan)—pricing based on CPU usage would be complex and unpredictable. By contrast, the "questions per day" metric offers a more predictable and consistent way to measure usage, allowing for better alignment with day-to-day work and past usage patterns.

License Entitlements

Licensing Tiers

Anvilogic offers three licensing tiers based on the number of questions per day, allowing you to select the most suitable option for your organization:

• Tier 1 (Lowest)

• Tier 2

• Tier 3

The tiers, defined by the number of questions per day, are recommended based on your estimated usage—taking into account the size of your organization and the number of analysts. However, you are free to select a different daily question limit than the one suggested, based on your specific needs.

Usage Tracking and Metrics

Usage of Monte Copilot is tracked as described below:

• Anvilogic tracks the number of questions asked by all of your analysts during interactions with Monte Copilot. These metrics are presented to you for monitoring usage.

• The question counter resets daily at midnight UTC.

• Any question that Monte Copilot cannot answer will not be counted towards your usage.

Billing Details

Pricing Model

The following pricing models are available:

• Free Trail

  By default, when you get started with Anvilogic, you will receive a 30-day trial license. During this period, you will be allocated up to 15 questions per day.

• Paid Plan:

  You can purchase any of the available licensing tiers, with pricing determined based on the number of questions processed. Higher tiers benefit from reduced pricing per question compared to lower tiers, reflecting the economies of scale from larger volumes.

Billing Cycle

Anvilogic offers standard billing cycles of 1-year and 3-year terms, giving clients the flexibility to choose between annual or multi-year commitments depending on their operational needs.

Overages

Once you reach your daily question limit, Anvilogic temporarily locks further access to Monte Copilot for the remainder of the day. You will regain access after the question counter resets at midnight UTC.

License Upgrade and Downgrade Process

Upgrade Process

Downgrade Process

Contact Anvilogic

High Level Architecture

Anvilogic on Splunk Detailed Architecture

Anvilogic on Snowflake Detailed Architecture

Anvilogic on Azure Detailed Architecture

Hybrid - Anvilogic on Splunk & Snowflake Detailed Architecture

Architecture Diagram

Below is the generic architecture digram for how Anvilogic works on top of Databricks.

Diagram:

PDF Download:

Frequently Asked Questions (FAQs)

Create SQL Queries with Monte AI

• • Select Snowflake and PROCEED

• Drag GATHER DATA component from the right components list

• Select avl_get_snowflake_data_edr

• Drag Code Block or Filter component from the right components list to begin building queries

• Begin to type in a question, or leverage any of the example questions to get started

What is FluentBit?

FluentBit is an open source streaming tool that can be used to send data to Anvilogic to ingest into Snowflake.

Data Type Examples:

Thank you for taking the time to work through this guide and exploring just some of what Anvilogic offers security operations teams. We invite you to continue to play with and explore this environment for up to 30 days from your initial invitation. You can explore more of the armory content, get more of a feel for the detection engineering workflow, or create more threat scenarios. We are here to help if you have any questions - just reach out to the Anvilogic representative who gave you access to the test drive.

• A full deep dive demo of the platform, including components not covered in the test drive such as insights and triage

• A workshop to explore specific components more deeply

• A pilot of the Anvilogic platform in your environment and with your real data

Anvilogic Solution: Anvilogic provides industry- and geography-specific templates for understanding the threat landscape, including how to prioritize adversary groups and attacker techniques. These are fully customizable and can evolve with your organization as your footprint and the threat landscape change. These priorities will form the basis of using Anvilogic to provide continuous assessment of your data and detection coverage maturity.

One of the main features Anvilogic provides is continuous assessment and an improvement framework around the state of your data feeds and detections as measured against a customized subset of the MITRE ATT&CK Framework. We help you understand and tailor priorities for your organization, industry, and geography. We have already done the initial priorities setup in the test drive account, but you can view, explore, and edit this.

From the main navigation on the left, hover over “Maturity Score” -> click Threat Priorities.

This will open the Threat Priorities view.

You can view or edit the Platform Priorities from the initial screen. You can then click on Threat Groups to bring up the list of priorities MITRE ATT&CK Threat Groups.

Again, you can view (multiple pages), edit priorities, search for specific groups, and check/uncheck the filter to hide unprioritized groups.

From here, you can click on Techniques in the Outputs section and see how the Platforms and Threat Groups selected in the previous steps are automatically reflected in a prioritized list of MITRE ATT&CK techniques. You can hover and click on the arrow on a given technique to view or change the sub-techniques and priority level of each technique and sub-technique.

Lastly you can click on Data Categories to see a paginated view of MITRE ATT&CK data categories required to cover the platforms and techniques defined in the previous steps. The selected categories and their priorities are automatically derived from the platforms and techniques, but you can view and edit their priorities in this screen as well.

At this point, you have reviewed and edited your priorities, setting the bar for required high-quality data sources and detection technique coverage. This will impact your maturity score and give you guidance and recommendations on how to improve detection coverage. If you made any changes, you can use the Save button in the upper right, or simply navigate away without saving them.

Anvilogic Solution: Anvilogic provides a platform for continuous assessment of an organization’s security posture measured against the MITRE ATT&CK Framework. We give you a platform for setting priorities specific to your organization, and then baselining your existing data feeds and technique coverage. On an ongoing basis, as you use Anvilogic to deploy detections and connect to your data platforms, it will automatically keep an updated assessment of your data feeds and technique coverage, showing you where you are strong as well as highlighting your most critical gaps in data and detection coverage, giving you a framework for improvement.

Now that we’ve set our organization-specific priorities, we can see how our existing data feeds and detections measure up to the standards we need to achieve, and where we can improve with the most impact. This type of continuous assessment and improvement framework is available in Anvilogic through our Maturity Score functionality.

From the main navigation on the left, hover over and click on “Maturity Score”

You will see an overall maturity score here, as well as Contributing Scores based on Feed, Detection, and Productivity. Note that you will not see much change over time in this test drive environment, and that productive score will only become relevant in an environment connected to your production data stores, as in a full Anvilogic pilot.

You can set a custom date range for the maturity score history by clicking the calendar icon in the upper left corner of the chart. Expanding this out to a wide range will enable you to see some of the changes to the environment that have impacted the score by also scrolling down to see details for the time period.

Scroll back to the top and Click on the Feed Score under contributing scores. This will give you details on how the feed score is derived and how to improve it.

Note that the circle chart on the left indicates where you have coverage and where you lack coverage based on your custom prioritized data categories. Click on the darkened part of the circle or the number above the “Add Missing Feeds” label to see the data feeds you are missing, which provides customers with a framework for prioritizing the onboarding of their most critically needed feeds.

You can also click on the number above the “Enhance Feed Quality” label to view data feeds where the quality is below the “good” threshold.

Click on one of the numbers in the “Data Feeds” column to see a list of data feeds in that category which should include at least 1 data feed with quality that is not “good.” Click on the name of a data feed to see how Anvilogic can help you assess the quality of your data feeds and the dimensions on which data quality is measured. Cancel out when done.

Navigate back to the main maturity score view by clicking the main navigation on the left, hovering over and clicking on “Maturity Score.” This will bring up the main maturity score view as before. Now click on the detection score near the top to bring up the detection score detail view.

From here you can see how many of your prioritized MITRE ATT&CK techniques and sub-techniques you have deployed detections for (including legacy detections as well as detections deployed through the Anvilogic platform), as well as where you high, medium and low priority technique gaps are. In the Technique Coverage section, click the slider under Recommendations and set it to “On” and then scroll down a bit. You will see a filterable matrix of techniques with a star icon indicating ones where there are recommendations. You can hover over any square in the matrix and see the current coverage state.

The green color of a square represents the depth of coverage. As you hover over a square you can see how many rules you have deployed for that technique and its sub-techniques, as well as how many rules are recommended. Click on the highlighted “X rules recommended” for one of the squares with a star to see how easy it is to find detections you can deploy to have an immediate impact on your technique coverage. This will take you to a filtered view of the armory showing rules you can deploy right now that will cover that technique.

Thank you for signing up for Anvilogic Lab. During this trial you will be given access to a shared Anvilogic platform account.

You will get instant access to a full Anvilogic environment loaded with sample data in Snowflake without the need to configure or connect anything in your environment. You will be able to create and test your own custom security detections against common high-value data sources using our Unified Detect Builder with our MonteAI Assistant.

Here are some cool things you can try out in Anvilogic Labs:

Brief Lab Tutorial

Monte Copilot is fully integrated with internal and external tools to help you make informed decisions and aid every phase of the investigation, threat hunting, and detection building cycle.

Access Monte Copilot

Click Ask MonteAI on the top navigation bar within the Anvilogic platform.

Watch the introductory video to learn how you can use Monte Copilot, or click skip the video. If you skip the video, you can replay it again later by clicking Play the Tutorial.

Feedback

Feedback on the accuracy of responses is critical to us. Please help to improve by providing feedback in the following manner:

Limitations

Take note of the following limitations in Monte Copilot at this time:

• The context within any conversation is maintained for 15 questions. After 15 questions, clear the conversation and begin a new conversation.

• Question input is capped at 2,000 characters.

• Monte Copilot is currently not able to search or query any data sets; this functionality is coming soon.

• Monte Copilot is not yet trained with Anvilogic-based information, such as your detections, priorities, and data feeds. This improvement is coming soon.

• The majority of Monte Copilot's beta features are tools that help with the explainability of events in a log or alerts, including entities within alerts such as IPs, hashes, and command line parameters.

Deploy New Detections

• Homepage -> Use Cases -> View Recommended Detections

• Select one of the recommended use cases

• • Adding to your workspace creates your own private branch of the use case that can be fully version controlled and deployed to your Snowflake environment

• • Once added, your new rule ID will be created and your use case can be modified

Edit a Use Case

Once you have added the use case to your workspace, you will be able to EDIT or CLONE the use case. You are free to edit the logic or the tags.

Test and Deploy

Once you have added the use case to your workspace, you will be able to TEST and/or DEPLPY the use case.

• Test - will execute the job on the connected Snowflake instance, looking back the last 60 minutes. This can be used to help understand the potential volume of the events that get returned before you deploy

• Deploy - will create a scheduled task on your connected Snowflake database that will execute on the defined schedule chosen.

Set Threat Priorities

Maturity Score

Keep track of all the detections you are deploying and how it improves your Maturity Score

Maturity Score History

View a history of all of your activity to date here. MS History gives you an easy way to track your progress and how you have improved your detection coverage overtime.

Detection Score

Navigate to the Detection section to see a MITRE Heatmap of your deployed detections.

Want to improve your score?

• Click on the Donut chart and select uncovered techniques

• Flip the recommendations switch to ON

Detection Armory

The Anvilogic detection armory has thousands of out of the box use cases you can deploy to your environment to immediately begin detecting suspicious activity aligned to those techniques.

• Select Threat Identifiers (select see more on fields to filter by)

  • Filter by Rule Format -> Snowflake

Create SQL Queries

• • Select Snowflake and PROCEED

• Drag GATHER DATA component from the right components list

• Select avl_get_snowflake_data_edr

• Drag Code Block or Filter component from the right components list to begin building queries

--example
process_name = 'cmd.exe'

Create SQL Queries with Monte AI

• • Select Snowflake and PROCEED

• Drag GATHER DATA component from the right components list

• Select avl_get_snowflake_data_edr

• Drag Code Block or Filter component from the right components list to begin building queries

• Begin to type in a question, or leverage any of the example questions to get started

Controls

The table summarizes the security controls in place for AI on the Anvilogic platform.

Measure

The Measure function employs quantitative, qualitative, or mixed-method tools, techniques, and methodologies to analyze, assess, benchmark, and monitor AI risk and related impacts. It uses knowledge relevant to AI risks identified in the MAP function.