What is your primary use case for Anvilogic?

My main use case for Anvilogic is for detection engineering, and I manage all of my use cases and alerts in the AVLs through Anvilogic. A specific example of how I use Anvilogic for detection engineering and managing alerts is that we use it with Splunk, and through the Splunk logs that we send and store there, we create logics for user logins when they shouldn't have access, brute force cases, and other detection scenarios. I also use Anvilogic for allow listing. As much as I use it for logics, I also allow list with the tool. It has some capabilities for researching my infrastructure and identifying which use cases I would need or which defenses I have covered insufficiently.

Anvilogic serves as my cybersecurity company's platform that provides detection, SIEM support, and SOC investigation, along with the implemented MITRE ATT&CK framework. A specific example of how I use Anvilogic in my daily work is that it provides threat detection, reports, detailed reports, detection engineering, and threat hunting, which is quite good. Anvilogic's threat hunting feature has made my work easier because it supports advanced threats and attack scenarios, analyzing across platforms to detect both known and unknown threats, which proves very useful for my organization. Anvilogic has changed how my team thinks about detection by improving detection engineering, reducing false-positive alerts, and integrating hybrid SIEM and data lake architectures, and so far, it has been beneficial. What surprised me the most about Anvilogic once I started using it is the automation capability, which automatically detects and investigates threats such as malware and provides us with reports, making the automation aspect very strong in this software. Since onboarding, my usage has evolved. During the first 90 days, the software wasn't configured properly, and we were just understanding its basics. As use cases increased daily, we altered and modified some policies and rules to reduce false-positive reports.

Anvilogic serves as our main SIEM and detection engineering platform. We use Anvilogic to create alerts based on our data, and the AI capability to detect alerts based on whatever data we are feeding into it is a feature that our team at Kroll particularly values. We have SentinelOne data, which is our EDR, and we have EDR data directly set up through Anvilogic input without using any third-party tool to get that data. Anvilogic has integrations directly in place, and we are using the SentinelOne input through Anvilogic. Since we uploaded or ingested that data, Anvilogic has started to give us suggestions about what alerts could be fired through that data. Anvilogic has flagged the threat identifiers through which we can build some use cases or modify them for our use. Anvilogic has also helped us understand what is a false positive and what could be a promising use case for our company in particular, providing valuable support. Regarding how Anvilogic supports our detection engineering, the uniqueness is about AI, which we did not have in Splunk earlier. This helps us not only to close the false positives but also features AI to write our queries. This capability lifts a lot of burden from the SOC team as they do not have to focus on how to write a query but can concentrate on investigating an alert or a use case, which has really caught my eye, and I am glad we have onboarded that feature.

I primarily use Anvilogic as a wrapper over SIM, mainly Splunk, but it can also be applied to other SIM platforms like Kibana. I utilize it for versioning the rules and detection logic I write, which can get stale or require enhancement. For example, if I wrote a detection rule for detecting script execution that needed additional logic, I used Anvilogic to maintain those versions or to build behavioral detection patterns, which is complicated in Splunk alone. Anvilogic allows me to extract a plethora of information, including mapping TTPs assigned for detection logic, which effectively helps in setting quarterly coverage agendas, thus illustrating its vital role in detection strategy and management presentations. The first thing that would break without Anvilogic is the complex detection logic involved in creating behavioral patterns, which yield high-fidelity alerts. Additionally, losing the control over Splunk SPL queries, due to lack of version control provided by Anvilogic, would pose a nightmare for any detection engineering team. The deployment model for Anvilogic was private.

My main use case for Anvilogic is for triage in the SOC. That's the primary use case.

The primary use case for Anvilogic is detection velocity and keeping version control of the detections. We're still not fully deployed, so it's not in production yet.

The main use cases for Anvilogic are around detections and detection engineering, trying to accomplish everything from identifying, prioritizing threats, baselining current capabilities, and, based on the threat prioritization, identifying the gaps and recommended use cases that we will have to deploy to bridge those gaps. These are the use cases that we have deployed.

It serves as the glue between all my vendor telemetry and gives us the capability to build our own detection capabilities in a very advanced way. We have moved off of single-based detections into threat scenarios, which gives us significantly higher fidelity detection capability.

We use Anvilogic as an SOC detection engineering platform. In addition to that, we use it for hunting and investigation purposes.

Our use cases for Anvilogic primarily revolve around detection engineering. We ingest the logs to figure out our cybersecurity score and improve detection.