TL;DR: Anvilogic is an AI-powered Multi-Data Platform SIEM that seamlessly integrates with Splunk, Azure, and Snowflake to enable your team to detect and respond to threats across the data platforms you choose. Anvilogic simplifies the complexities detection engineering, tuning, maintenance, and threat hunting across all of your data platforms. SOC teams can leverage Anvilogic to rapidly deploy 1000s of detection rules, optimize detection rules, reduce false positives and negatives, automate rule maintenance, enhance threat hunting capabilities, triage alerts and enable efficient collaboration among security teams. Ultimately with Anvilogic, you can adopt a cost-effective security data lake for high volume use cases without ripping and replacing Splunk.

‍

As businesses are becoming more vulnerable to threats, the importance of SOC analysts and detection engineers increases. For all of us in cybersecurity we know these roles can be dynamic, to say the least. Analysts and Detection Engineers need to cooperate with other team members to build, deploy, tune, and maintain detections, onboard/normalize data, extract meaningful fields, respond to security incidents, search for and follow security events/alerts (that more often than not are false positives), and engage in security investigations. 

Furthermore, teams analyze and react to undisclosed hardware and software vulnerabilities, as well as, examine and research reports on exploits and vulnerabilities. Implementing security tools and strategies, while keeping up with processes and keeping people engaged are all part of the job, but how do you stay on top of trending threats when the backlog of false positives is causing alert fatigue? Make sure detections are fine-tuned when consumed by manually finding context and correlating signals? OR Manage budgets and decide on a strategy when the organization’s threat understanding and visibility are limited or disorderly?

‍The general vibe across the industry is that the current threat detection processes aren’t sustainable, with 77% of security professionals surveyed in the same ESG report desiring new ways to engineer detection rules. They also believe the work required to design, code, implement, and manage their threat detection rules is overwhelming and creates challenges. 

Detection engineers shouldn't be held back by security tools that require them not only to be a cybersecurity expert, but tools expert, software engineer, and problem solver to work around solutions that only solve parts of problems while making others more challenging or cost prohibitive.

Security analysts shouldn’t be inundated with an overwhelming amount of alerts only to find out it was a false positive.

Incident responders should have all the information when looking for indications or lateral movement, while also being able to easily create detections for the behavioral attack patterns.

Everyone in the SOC should have tools that work effectively and with you, to achieve your goals and make their jobs easier rather than making tradeoffs.

‍

The Complexities of Manually Building & Maintaining Detection Content

Start understanding how to make your investments and tools work better for you, so you will be saying “What alert fatigue or skills shortage? New Phone Who ‘Dis”

Today, your security team may be using Splunk for your logging repository. 

‍And we understand why. ‍

Splunk is a powerful togging repository used by many enterprise IT and security teams today. tool for analyzing data. The variety of add-ons, integrations, and apps is excellent, and through that ecosystem is when an organization can start to realize some extreme benefits.

Still, while Splunk can be a powerful log repository, it can also be a complex and manual process for security teams to build, tune, and maintain detection content for it, but it doesn’t need to be. You can help make Splunk even more powerful and force-multiply your team.

There are 3 things we know can be onerous and complex for even the best Splunk teams 

‍

1. Manual detection creation 

Is just that - manual. It is hard, time-consuming, and sometimes tedious to build, test and deploy all the searches you need to cover your detection gaps, address emerging threats, et al. for comprehensive surface protection. 

Building detections for a specific threat may take days or weeks, depending on the team's skill set and the complexity of the threat. This results in a constant backlog of detections and maintenance tasks. In many cases, the data is normalized for direct usage, which extends the time to build a detection.

Additionally, one has to be a Splunk & SPL expert to build/deploy the detection that is scalable and performant without impacting the Splunk search head. Oftentimes, the analyst has to use multiple systems:

☑️ Jira to track the progress

☑️ Confluence or other documentation systems to document all the details

☑️ Splunk to deploy the detection 

It is a pain to switch between the systems when they are not seamlessly integrated.

‍

2. Detection Lifecycle Management & High Volume False Positives

It’s not just about the initial deployment of threat detection. Your teams must also keep pace with versioning, maintaining, and tuning detections throughout their lifetime triage time; a process that can quickly dominate the time of your analysts. When it comes to “Detection Lifecycle Management” there are some main areas that contribute to the challenges of alert fatigue.

In many cases, the saved searches deployed within Splunk Enterprise or Splunk Enterprise Security (SIEM) are scheduled in batch intervals and the schedule is often around the same time. As the number of saved searches and detections increases to hundreds, there can be a performance implication on Splunk and sometimes it could bring the systems down. The deployment schedule optimization is a key challenge.

Threat actors continuously evolve over time and hence the detections need to evolve. Understanding the new variations, comparing the logic differences, and incorporating the changes is difficult. Since there is no version control or update management system built into Splunk, it is even harder to continuously maintain/update a detection.

Though the detections may come with standard noise filtering, there are always cases of benign scenarios that are very specific to each customer. Such scenarios are often revealed by triaging the alerts, and analysts end-up spending a good amount of their time on these.

‍

3. Correlating across different detection domains

Analysts also need to correlate across alerts to understand the full context of the threat story and see if anything additional is lurking in between techniques, tactics, and scenarios. This process is challenging across any organization, but for detection engineers using Splunk, it also requires SPL expertise. With an already small pool of cybersecurity talent available, those who also know SPL shrink the talent pool even further.

And if your organization is like most, you don’t only have Splunk, but a myriad of tools, platforms, etc. that require knowledge in other languages. This can get a team bogged down in a “skills gap/never enough people” situation or spending excessive time with the data and pivoting through tools, tabs, and spreadsheets to help correlate events and get a full understanding of detection coverage and behavioral attack patterns across domains. 

Anvilogic feels so natural with Splunk. We can customize detections really fast and get an alert out the door that works in our environment without a heavy lift. Because it’s not a black box, you can see the detection code and get ideas on how to build a better SPL search.

‍

Jason Murphy

VP Information & Cyber Security | St. George's University

‍

That’s why the partnership between Splunk and Anvilogic’s detection engineering and hunting platform becomes so important. Anvilogic is one of those amazing complements to Splunk: Like peanut butter to chocolate, the joint to its ball socket, the popcorn to its cinema, lime to its Corona, finding faults is to mom, passing the hash is to…err you get the idea.

‍

How does Anvilogic fill the gaps?

Anvilogic is an AI-powered multi-data platform SIEM that works with Splunk, Snowflake, Azure, and other data platforms to remove some of the complexities that detection engineers navigate when building and maintaining security detections and hunting across multiple security tools.

When it comes to Splunk specifically, Anvilogic enables security operations teams to create and deploy high-fidelity detections in minutes across cloud or on-prem logging without needing to be an SPL expert, mapping detections to MITRE ATT&CK to see coverage gaps, and automating tuning for alerts with generative AI.

This enables your security team to save thousands of hours and get more from your Splunk investment. 

‍Let’s start nerding out.

‍

Improve detection coverage with Anvilogic Armory 

Anvilogic’s security experts test, curate, build and share detection content across multiple query languages (SPL, SQL, KQL) for users to import, update and deploy to their Splunk environments. 

We invest a lot of time in threat research, map our detections to MITRE ATT&CK, to specific threat actors, and annotate what we call "use cases" with tons of metadata. That metadata also powers our recommendation algorithms, we are extremely transparent about how we arrive at a score; we're big believers in math over magic.

Additionally, Anvilogic is cloud-ready. Look at us as an automated ‘bridge’ for enterprise SOCs to easily move detections to the cloud. No need to rip-and-replace or throw away institutional practices, tools (SIEM/EDRs), or the detections built over years.

We also let you provide custom tags, import your existing detections, and use some in-house AI algorithms to map your content if necessary, without needing to upgrade your Splunk SIEM, Splunk Security Essentials, or other pre-existing rules to be standardized across all alert data.

‍

‍

‍

Operationalize MITRE ATT&CK and receive AI-based recommendations to improve maturity

A core feature of Anvilogic is its ability to automate MITRE ATT&CK mapping for end users. Not only can you replace manual spreadsheet tracking with automated coverage of MITRE ATT&CK techniques, but you can customize and scope your most relevant MITRE ATT&CK techniques, and then easily map detections to MITRE ATT&CK to identify coverage gaps against high-priority threats.

From there, our system provides AI-based recommendations of additional data sources to onboard for improved detection coverage. As the system becomes more intelligent, you’ll also receive a Maturity Score and recommendations to improve your detection posture. 

‍

‍

Automate detection-as-code to improve your detection engineering lifecycle

To tackle the struggles of lifecycle management, we make our *version* of version control,  very simple. 

Whenever you edit a use case rule, we create a new version for that rule, and you can revert and deploy, update and deploy or do rapid testing with ease. And, you can always compare the Armory version to your updated versions, with full version history. Anvilogic’s one-click deployment means that when your detection code is ready, you’re only a click away from deploying that code to your Splunk environment. 

‍

AI-powered detection tuning, maintenance, and recommendations

Gain personalized AI-guided insights and recommendations for detection tuning and maintenance for streamlined escalations and fast remediation, enabling teams to make informed decisions, effectively prioritize, and know the overall impact to alert volumes. Utilizing advanced algorithms and behavioral analytics teams minimize false positives, ensure accurate threat detection, and reduce unnecessary alerts.

Once you have all these rules deployed, you will inevitably need to tune some of them to ensure you're not spamming your triage team. This is where Anvilogic’s Tuning Insights comes into play. 

Our Tuning Insights feature leverages a series of AI algorithms to determine which rules have specific terms that repeat often and are likely to be unnecessary noise. We apply these algorithms on a per-use case basis, so you always know the impact upstream and downstream; meaning what rule’s behavior is modified, and how many fewer alerts your triage team can expect.

Thanks to our deep integration with Splunk via our app - we can immediately push down an allow list entry, with expiration if needed, so that you can squash false positives quickly. Anvilogic also reverses this for task insights. When the system determines a rule is ready to be promoted from warn to alert, you can automate that process as well.

‍

‍

‍

Build Your SPL Detections in Minutes, Without Being a Splunk Ninja

With Anvilogic, you can easily build effective and complex detections at scale, moving beyond IOCs to achieve true correlation across your consistent detections across various alert types without being an SPL expert. The simplicity of our system enables your team to keep up with the constantly evolving landscape of threats and reduce bottlenecks. 

Our low/no-code builder reinforces the fact that your detection engineers shouldn’t also need to double as software engineers. We have a special detection type called a "Threat Scenario" where we have constructed a very simple no-code builder that does all the grunt work of coaxing multi-stage attacks into complex SPL.  

‍

Let us show you how Anvilogic lets you detect threats with all of your security data across Splunk, Azure and Snowflake without a complex or costly rip-and-replace.

Explore our latest Customer Case Studies here.