August 2022 Quarterly Product Release

The Anomali team continues to work with our customers to add their needed capabilities. With our August release, we’ve introduced new capabilities that continue our Focus to Enable Enterprise Organizations to Stay A Step Ahead of Adversaries.  

Key Highlights for this Quarter Include:

• Creating Extended Visibility with Anomali and MITRE ENGENUITY
• Routine task automation accelerating analyst mean-time-to-respond
• Scheduled Retrospective Search
• Automated Response for The Anomali Platform
• Lens + Support for MITRE ATT&CK Enterprise v10 and v11
• Simplified installation of Integrator 8.1

Anomali Attack Pattern Detection and MITRE ATT&CK®: 

In 2021, Anomali joined MITRE Engenuity’s Center for Threat-Informed Defense to collaborate on the Attack Flow Project to better understand adversary behavior and improve defensive capabilities. This partnership culminated with the public release of the project in March 2022. 

The Attack Flow project will provide context around adversary behavior and help security teams expertly profile the adversary. It will also enable them to protect the organization better before an attack, detect it in real-time, and respond post-attack.  

I’m excited about this project and the things to come. Listen below to an excerpt from our recent webinar explaining the project.

Routine Workflow Automation: 

Customers are always looking for solutions that make their life easier. This release introduces the first phase of our Routine Task Automation Framework within ThreatStream Cloud that adds support for the automation of routine analyst tasks. 

This first phase allows users to define an enrichment routine that can be triggered against a given indicator in an investigation. Users can create multiple automated routines to build up a library of regular workflows to create one-click actions instead of an involved sequence of enrichment pivots or transforms. 

Users can also share created routines cross-functionally to foster team collaboration and increase efficiencies.

Automating routine tasks in ThreatStream will help reduce noise by filtering out unwanted enrichment data, allowing analysts to focus and prioritize analysis efforts. 

Screenshot: Configuring a Routine Task Automation – running multiple (up to 20) enrichments with one button click

Scheduled Retrospective Search

One of the critical features of our cloud XDR solution is the ability to search for matches in an environment retrospectively. Customers can schedule automated retrospective searches to correlate against new intelligence findings automatically.  

This automated process will enable security teams to detect real-time threats in their environment and provides insights into new threat actors, bulletins, and other threat models.

Screenshot: Showing a list of already configured Retrospective Searches, scheduled to run at specific cadences

Automated Response for The Anomali Platform

Alerts within The Anomali Platform identify malicious IoCs within a customer’s environment that trigger a series of actions that enable an effective response. The key is distributing IOCs to clients’ security tools within appropriate timeframes for mitigation and remediation. 

With this release, we’ve enabled workflows allowing matched indicators to tag IOC content distributed to downstream security controls automatically. 

In this first phase, we’ve enabled a pre-defined set of the response-focused tags as an XDR Alert that can be correlated and pushed to the relevant configured destinations. 

Look for more info in upcoming releases.

Lens+  support for MITRE ATT&CK Framework v10 and v11

Lens is one of the best offerings we have at Anomali. Lens is a powerful natural language processing engine that quickly operationalizes threat intelligence by automatically scanning digital content. Lens can be deployed as a browser extension or a Microsoft Office application (Word, Excel, Outlook).

With this release, we’ve added support for MITRE ATT&CK Enterprise v10 & v11 and recognition of the latest MITRE variants. Users will now be able to view both MITRE TTP and Attack Pattern information and any risk scores, context, and event matches that might have been sighted in your environment. 

This update is currently available to Anomali Lens+ subscribers only.

Screenshot: Lens highlighting TTPs

Simplified installation of Integrator 8.1

Integrator is pivotal in operationalizing your intelligence to your security stack. With this release, we’ve simplified the installation process to significantly improve the customer experience when configuring new/existing extensions. 

This simplified installation process means that extensions only need to be configured once and can then be re-used as necessary. All configuration options will be presented individually (no need for manual editing of JSON configuration text.)  

In addition, we’ve added.

• Saved Search filtering – allows the use of ThreatStream saved search in both Source & Destination filters; instead of asking users to write new filters for Integrator, these are available to look up in ThreatStream via Integrator UI. (requires Version 2 of Intel API).
  • Saved search filters are copied into the destination filter and not dynamically updated.
• Digital Signatures – all Integrator download files (for both application and extensions) are now digitally signed with a trusted certificate.
  • Prevents windows from triggering AV alerts and allows secure delivery of the new extension process. (Digital Signatures is being added to Integrator 8.1 later in  September/October)
• Priority tagging now means that intelligence found via Match alerts and appropriately tagged with be prioritized in Integrator and not adversely affected by destination limits. 

These updates will eliminate much of the previously-required manual effort and be fully operational when all extensions have been repackaged by October. 

For a complete list of updates, check out the monthly release webinars available on Anomali University or reach out to your customer success manager.

Until next time.