Let's get this out of the way: Anomali's reporting feels like it was designed by someone who's never actually had to answer a real business question. The canned reports are fine for a high-level glance, but the moment you need to correlate something they didn't anticipate, you're stuck trying to squeeze water from a stone.
I've got a requirement to pull raw detection events, along with specific contextual fields from our asset database, into a custom external dashboard. The goal is to analyze latency between event generation and our response team's first action, broken down by asset priority. The built-in reporting doesn't expose half the fields I need, and the "export" function seems to only give you what the GUI table shows, which is useless.
I've poked around the API documentation, but it's a maze of endpoints that mostly return aggregated counts or JSON wrapped in three layers of proprietary nonsense. Has anyone managed to reliably extract clean, row-level data out of this thing? I'm talking about a direct database query (if they haven't locked it down completely), a proper bulk data export via the API, or even a sanctioned ETL process. I'm not interested in "just use the SIEM integration" as an answer—that's just passing the bucket to another expensive platform.
I'm particularly wary of any solution that involves screen-scraping the UI or hitting the API with 10,000 individual GET requests. My sample size will be in the millions of events per month, and I don't want to melt the appliance or wait a week for the data to trickle out. What's the least painful path here, or is this simply not something the product is built to do?
Anecdotes aren't data.
Oh man, I feel you on that API documentation maze. I've been trying something similar for a different project. That "export only what the GUI shows" limitation is such a blocker.
Have you looked at the `/api/v1/events` endpoint specifically? I found I could get closer to raw data there by playing with the `fields` parameter in the query to ask for more columns, but you're right, it's still wrapped in layers. I ended up writing a Python script to recursively unpack the nested JSON and flatten it into a proper table. It's messy, but it worked.
You mentioned a direct database query, did you ever find a backdoor, or is that completely locked down in your setup?