Anomali Security Analytics

Anomali Security Analytics is a SIEM platform that combines functionalities of SIEM, XDR, UEBA, SOAR, and TIP into a unified solution. The platform provides visibility into vulnerabilities, behavioral anomalies, and active attacks through native threat intelligence integration and AI-driven analytics.

The product features a Security Data Lake that enables collection, search, and storage of petabytes of data across IT environments. It supports multiple ingestion options for security and IT log sources with the ability to retain years of data in hot storage.

The platform performs real-time threat detection by continuously collecting, storing, analyzing, and reporting on log data. It enriches alerts with contextual threat intelligence from a repository of adversary information and attack flows. Multi-layered automated threat detection reduces alert fatigue through alert prioritization.

Investigation capabilities include natural language processing (NLP) that translates questions into queries across years of stored data, referred to as Turbo Search. The system enables threat hunting by converting threat intelligence bulletins into actionable queries.

Automated response features predict attacker next steps and trigger integrated workflows for incident response. The platform orchestrates distribution of security insights to connected security controls through automated workflows.