ANY.RUN promotes threat feeds and sandbox context for SOC triage
Original title: Cyber Threat Context for Early Response: Enriching SOC Telemetry with Real-Time Intel from 16K Organizations
The vendor says feeds drawn from more than 16,000 organizations can be pushed into SIEM, TIP, and XDR tools.
ANY.RUN describes using its Threat Intelligence Feeds and Interactive Sandbox to add context when a SOC or MSSP sees an IP, domain, hash, or URL. Feeds supply malicious IPs, domains, and URLs with sandbox-based intelligence and connect through API/SDK and STIX/TAXII. The company says virtual machines start in under 10 seconds and reports are available in around 40 seconds, capturing processes, network activity, file and registry changes, and MITRE ATT&CK techniques.
Unconfirmed: The claim that up to 30% of malicious IOCs were already in TI Feeds is ANY.RUN’s internal analysis.
- ANY.RUN cites activity from more than 16,000 organizations and 700,000 professionals.
- It says up to 30% of unique malicious sandbox IOCs were already in TI Feeds.
- Sandbox reports are described as available in around 40 seconds.
- An IronChain ransomware detection is shown only as a sandbox example.
- Integration targets include SIEM, TIP, XDR, and other systems.
From the original article
9 min read at any.run
When an IOC hits the SOC, the clock is already running. An IP address, domain, file hash, or suspicious URL can trigger a detection, but an analyst still needs to understand what it is, whether it is connected to known malicious activity, and what happened around it. The longer it takes to build that context, […]
any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.