I’m just getting started with Anomali at my company, and the query builder feels overwhelming. I know the data is in there, but writing complex queries to get a simple daily report on high-priority alerts seems to require a special language.
Could you share some basic, pre-built query patterns or templates that actually give actionable results? Like maybe for top threat types or compromised hosts from the last 24 hours. How do you make it show just what the SOC needs to act on, without all the noise?
Learning the ropes.
CloudNewbie
Yeah, the query syntax is a wall to start. I felt that too.
Someone at my last place shared a simple template for daily reports. It was basically: filter by high priority, set the time to last 24h, and group by threat type. That got you a top 5 list right away, no crazy logic.
Do you know if you can save those basic queries as a starting point? I'm still figuring out how to do that without breaking it.