Anomali: Anomali Security Operations Platform (ASOP)

The Anomali Cloud Service Offering consists of two integrated components: Security Analytics and ThreatStream, delivered as a unified cloud-native security platform. Security Analytics provides AI and cloud-native security information and event management (SIEM) capabilities including data collection and normalization from network devices, endpoints, applications, and cloud services; real-time event correlation and threat detection using machine learning algorithms; behavioral analytics and anomaly detection; incident response workflows; and query capabilities across petabytes of historical data stored in an integrated security data lake with configurable retention periods up to 7+ years. The platform supports ingestion of 30TB+ of data within hours and enables sub-second query response times across petabyte-scale datasets using natural language processing and AI-supported interfaces.

ThreatStream provides threat intelligence management capabilities including automated collection, normalization, and curation of threat intelligence from commercial feeds, open source intelligence, and information sharing centers; management of indicators of compromise (IOCs) and indicators of attack (IOAs) with automated deduplication and confidence scoring; correlation of external threat intelligence with internal security telemetry; distribution of actionable intelligence to integrated security tools via APIs and standard protocols; threat analysis and enrichment with MITRE ATT&CK framework mapping; and secure community-based threat sharing. The service operates as a multi-tenant Software-as-a-Service solution with role-based access controls, data encryption in transit and at rest, comprehensive audit logging, and RESTful APIs for integration with existing security infrastructure. Service boundaries include all data ingestion interfaces, processing engines, storage systems, user interfaces, APIs, and integration points necessary to deliver security analytics and threat intelligence management capabilities.