One of the best features Anvilogic offers is the Armory, which is full of various different pre-built detections; that was a huge improvement from any kind of pre-built detections we had in Splunk and saved a lot of time to really increase our coverage capability. I also appreciate the normalization process for log sources, normalizing them to a consistent schema where those alerts automatically apply is a nice feature and gives us a very clear-cut way to handle lots of different log sources in a centralized manner, ensuring that we are doing threat detection on those log sources. The normalization process has enhanced our log monitoring maturity; previously in Splunk, we had SIEM mapping set up for log sources, but it did not translate necessarily to immediate security value because there were not pre-built detections that leveraged that SIEM mapping. The ability for Anvilogic to have built-in curated detection logic that automatically applies once we normalize logs creates immediate maturity and value every time we normalize a log source. It gives us a target to identify if a log source should be normalized. If it should, we know the value and output from Anvilogic; if it should not, we can identify custom use cases and build custom logic in Anvilogic or hold onto those logs in our data lake without any detections running on them if it is more for compliance or incident response. Anvilogic plus Snowflake has vastly improved our total cost of ownership for the SIEM platform; we went from a pretty expensive platform in Splunk that was not vertically scalable due to budget limitations to a platform now that is far more efficient per terabyte of data ingested and processed per day. The savings per terabyte of data being ingested and monitored for security threats was a pretty significant percentage, which was a huge advantage. We now have budgetary space to scale up our solution as needed as the business grows. We have had to make difficult decisions to not ingest certain logs in the past due to budgetary restrictions, but now we can take a more liberal approach in accepting most requests and ingesting those logs into our SIEM because the cost to do so is not a problem for the company and for our internal budgets, which is huge.
