US MSSP adds ANY.RUN threat feeds to SIEM to cut manual triage
Original title: American MSSP Company on Integrating Threat Intelligence to Scale Without Sacrificing Quality
The unnamed provider says five analysts gained 25% more capacity after sandbox and IOC feed integration.
An anonymous US MSSP that already used ANY.RUN Interactive Sandbox added Threat Intelligence Feeds into its SIEM. Matching indicators are tagged malicious during triage so analysts skip some manual IOC checks. ANY.RUN says, separately from this customer, about 30% of unique malicious IOCs in studied sandbox sessions were already in the feeds.
Unconfirmed: The MSSP is unnamed, and the 25% capacity figure comes from a vendor case study.
- The SOC team is one manager and five analysts.
- The company reports 25% greater SOC capacity without proportional hiring.
- Feeds supply malicious IPs, domains and URLs through a SIEM integration.
- ANY.RUN cites data from 16K+ SOCs and 700K security experts.
- Vendors
- ANY.RUN
From the original article
7 min read at any.run
After months of using ANY. RUN Interactive Sandbox, a US-based MSSP expanded its security stack with ANY. RUN Threat Intelligence.
any.run
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.