Okay, I’ll admit I’m still pretty new to the security data side of things, but I’ve been tasked with setting up some alerting workflows in Anomali for our team. Everyone was excited about the “mobile app access” feature during the sales demo, so we got it rolled out.
After a few weeks, I’m starting to think it’s just a feature checkbox that doesn’t actually help us. Maybe I’m missing something? From a data pipeline perspective, it feels like an afterthought.
My main issue is with actionable workflows. On the desktop, I can triage, pivot, run queries, and update records with proper context. On the mobile app, it’s basically just a notification feed. If I get an alert, I can’t really *do* anything meaningful with it. I can’t easily cross-reference with our internal data in BigQuery, and I certainly can’t kick off any enrichment or validation scripts.
For example, I wanted to set up a simple rule: high-priority alert comes in -> app notifies me -> I can tap to trigger a lightweight Airflow DAG to pull related IOCs from our data warehouse for a quick check. But there’s no API hook or actionable button for that in the app. It’s just view-only.
It creates a weird, unsafe pattern for me. Either I ignore the app and wait until I’m at my desk (defeating the purpose), or I see something urgent and try to do a half-baked investigation on my phone, which feels error-prone. I’d rather have a really solid web UI that works on a mobile browser and invest the engineering time into better webhooks and API integrations for our on-call system.
Has anyone else found a practical use for the mobile app that I’m not seeing? Or have you managed to integrate it into a real data response workflow? I’m nervous about building any process around a tool that seems so limited.