
US MSSP adds ANY.RUN threat feeds to SIEM to cut manual triage
The unnamed provider says five analysts gained 25% more capacity after sandbox and IOC feed integration.
17 stories, newest first · one card per story

The unnamed provider says five analysts gained 25% more capacity after sandbox and IOC feed integration.

The vendor says related analyses draw on 16,000-plus SOC teams and a community of more than 700,000 professionals.

A vendor demo follows an Adobe PDF link into a Microsoft OAuth phish and shows 70-plus related analyses.

The vendor says SIEM, SOAR, TIP, EDR and XDR integrations can match those indicators before a manual investigation.

Enterprise analysts see industry, team, and threat-intelligence links next to sandbox indicators instead of searching manually.

The vendor says sandbox-derived IOCs can automate matching and cites its own overlap and detection figures.
The vendor says Tier 1 closure rose from 20% to 70%, while a cited study found 42% of alerts uninvestigated.

ANY.RUN's September digest adds 76 behavior signatures, 16 YARA rules, and 1,098 Suricata rules plus TI reports on IronToll and CSuite phishing.

Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.

N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.

A five-person security team at a German manufacturer protecting 10,000 endpoints cut triage time by 15 minutes per alert after adopting ANY.RUN's cloud sandbox.

Phishing drives 80% of attacks on US companies; FBI recorded 158,436 BEC victims and over $20B in losses from 2013-2023.

ANY.RUN linked 601 RMM-tool phishing cases across 46 countries, with the US the top target at 45% of observed activity.

ANY.RUN says manual triage bottlenecks erode MSSP margins and promotes its Threat Intelligence Lookup and sandbox to cut Tier 1 workload by up to 20%.

ANY.RUN's August 2026 roundup shows US and EU firms hit via Microsoft 365 session hijacking, remote-tool abuse, and hiring lures.

Mirage2FA phishing-as-a-service campaign hit ~4,500 organizations, mostly US, stealing Microsoft 365 passwords and session cookies to bypass 2FA.
ANY.RUN urges SOC teams and MSSPs to adopt intelligence-driven threat monitoring to reduce mean time to respond.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views