Security investigations depend on evidence from across the environment, including systems that platform and SRE teams use to manage applications and infrastructure. While an alert may originate in a SIEM or endpoint tool, the logs needed to understand what happened can live in an observability platform like Observe.

For an analyst investigating a suspicious login, that could mean checking application and infrastructure logs to establish what the account accessed and what happened on the affected host. Gathering that evidence can require separate searches, unfamiliar query languages, or a request to the team that owns the data.

The new Anvilogic integration with Observe by Snowflake brings those searches into the analyst’s existing workflow. Security teams can query Observe logs and events alongside other connected repositories, review results identified by source, and use the telemetry their platform teams already collect. Queries run where the data lives, and there’s no need to build another ingestion pipeline or duplicate the underlying logs to make them searchable through Anvilogic.

What each platform brings to the investigation

Observe helps platform and SRE teams understand their applications and infrastructure using telemetry on a Snowflake foundation. That same telemetry can provide evidence security teams need when investigating suspicious activity.

Anvilogic connects Observe to Federated Search, allowing analysts to search its event datasets alongside supported SIEMs, data lakes, and security platforms. The integration uses Observe’s enriched data and native fields, while Anvilogic provides the search experience across repositories.

For customers, the value is being able to follow an investigation across the systems holding the evidence. Platform teams can continue using Observe for operational troubleshooting, while security teams use the relevant logs from their Anvilogic workflow.

“Our customers send their cloud, infrastructure, and application telemetry to Observe on Snowflake once, and they want every team that needs that data to be able to use it. With Anvilogic, security analysts can search the same data from their own workflow, so security and observability work from one copy instead of building separate pipelines to get there.” — Tom Batchelor, Field CTO, Observability, Snowflake

Following the evidence across tools

Consider an analyst reviewing an unusual login involving an application host. The authentication event establishes when the login occurred. Endpoint records may show activity on the host. Logs in Observe can help the analyst examine what the application and its infrastructure were doing during the same period.

Through Federated Search, the analyst can search for the host and time window across connected repositories. Results return with their sources identified, helping the analyst understand which system supplied each piece of evidence.

The analyst still evaluates what those events mean. The integration makes relevant data accessible without requiring a separate data pull before that evaluation can begin.

Analysts can ask questions in plain language, and Anvilogic generates the native queries. For those who want to write an Observe query directly, Advanced Search supports OPAL with syntax highlighting and autocomplete.

“Security teams already depend on the telemetry their platform teams send to Observe, but most analysts don’t work in Observe day to day, so getting to that data means switching tools or waiting on the team that owns it. We built the integration directly on Observe’s API, so that data shows up in the same search as everything else, queried in place, with no second copy and nothing deployed in the customer’s tenant.” — Mackenzie Kyle, Chief Product Officer, Anvilogic

Broader data access for SOC workflows

Agentic SecOps depends on access to the systems that hold relevant evidence. An investigation can be limited when application or infrastructure activity sits outside the data available to the SOC.

The Observe integration expands that access through Federated Search. Customers can make existing operational telemetry searchable through Anvilogic while continuing to use their SIEM, endpoint tools, and other connected repositories.

For teams using Observe by Snowflake, this extends the security value of their observability investment. It also lets them make that data available to security investigations without first deciding to consolidate the rest of their environment on one platform.

Teams moving off Splunk run detections across Splunk and their Snowflake data lake in parallel while they transition. During that window, an analyst's evidence is spread wider than usual, across the SIEM they're leaving, the data lake they're moving to, and the operational telemetry in Observe. Federated Search keeps the investigation whole across all three. Detections continue to run on supported detection platforms.

This release focuses on search. It supports read-only queries against Observe event datasets. Scheduled detections directly against Observe data, along with metrics and trace support, are on the roadmap.

Connecting Observe to Anvilogic

Customers configure the integration using their Observe URL, customer ID, and a service-account API token. Anvilogic automatically discovers event datasets, excluding internal monitoring and metric rollup datasets from discovery.

Queries execute through the Observe API, and the results return to Anvilogic. The underlying telemetry stays in Observe. The integration requires no deployment inside the Observe tenant and doesn’t create datasets.

Getting started

Anvilogic customers can find the Observe integration under Settings > Integrations > Available.

See it in action

Want to see how your team can search Observe telemetry alongside evidence from your connected security tools? Register for our upcoming webinar on November 17th. Our teams will discuss how you can:

• Reduce duplicate pipelines and storage between security and observability
• Give analysts access to operational telemetry during investigations
• Lower the overall cost of managing telemetry
• Make the transition gradually, without replacing your existing stack all at once