BlueApps translate raw log data into normalized events for analysis by USM Anywhere, while Advanced Blueapps do much more, including collection and enrichment of log data, performing threat analysis, and providing workflow that coordinates response actions with the infrastructure and third-party applications to provide security orchestration. In addition, each Advanced BlueApp has a built-in dashboard in USM Anywhere.