Recent posts
When an IOC hits the SOC, the clock is already running.
An IP address, domain, file hash, or suspicious URL can trigger a detection, but an analyst still needs to understand what it is, whether it is connected to known malicious activity, and what happened around it. The longer it takes to build that context, the longer an alert remains unresolved.
Threat context helps shorten that gap. By enriching telemetry with real-time intelligence and behavioral evidence, security teams can move from “What is this?” to “What should we do next?” much faster.
The Problem with Investigating IOCs in Isolation
Modern SOCs have plenty of telemetry. The problem is that much of it arrives without enough context to support an immediate decision.
SOC telemetry often surfaces individual pieces of evidence: a suspicious IP connection, a potentially malicious URL in an email, or an unusual file detected on an endpoint. None of these signals provides enough information on its own to determine the scope or significance of the activity.
An analyst may need to search several intelligence sources, investigate related infrastructure, check historical activity, and potentially submit the artifact to a sandbox. For a single alert, that may be manageable. Across thousands of alerts, it becomes a significant operational burden.
The challenge becomes even greater for MSSPs, where teams need to maintain consistent investigation quality across multiple customer environments.
The answer is not simply more intelligence — it is context that reaches the analyst at the right point in the workflow.
Real-Time Intelligence Can Give an Alert a Head Start
Not every alert needs to start with a manual investigation. If an IOC has already been observed in malicious activity, that context can be applied as soon as the indicator appears in telemetry.
Threat intelligence feeds make this possible by continuously supplying security teams with known malicious indicators and the context associated with them. When connected to detection systems, they can help identify suspicious IPs, domains, URLs, and other IOCs as they appear, giving analysts an initial assessment before they begin a deeper investigation.
ANY.RUN’s Threat Intelligence Feeds (TI Feeds) provide malicious IPs, domains, and URLs enriched with sandbox-based intelligence. The feeds draw on activity from more than 16,000 organizations and 700,000 security professionals, giving SOCs and MSSPs visibility into threats observed beyond their own environments.
That broader visibility can matter when attackers rotate infrastructure quickly. If an endpoint connects to a suspicious domain, the SOC can check it against current intelligence rather than waiting for an analyst to establish its history manually.
TI Feeds can be integrated into existing security infrastructure through API/SDK and STIX/TAXII, including SIEM, TIP, XDR, and other systems. Threat intelligence can therefore become part of the detection workflow rather than a separate destination analysts visit after an alert arrives.
Up to 30% of Malicious IOCs May Already Be in Your Intelligence
ANY.RUN’s internal analysis provides a useful indication of how this can work in practice.
Up to 30% of unique malicious IOCs discovered in Interactive Sandbox analyses had already been observed by ANY.RUN and were present in TI Feeds.
That means that when one of those IOCs appears in SOC or MSSP telemetry, the security system can potentially match it against existing intelligence before the analyst manually investigates the associated file or URL in the Sandbox.
This gives security teams an opportunity to identify and prioritize malicious activity earlier.
The value is not just knowing that an IOC is malicious. Existing intelligence can provide a starting point for the investigation: what has been observed, what infrastructure is associated with it, and whether the indicator has appeared in other malicious activity.
Instead of spending the first part of an investigation collecting basic context, analysts can focus on validating impact and deciding what response is appropriate.
Adding Behavioral Context to the Investigation
Threat intelligence can provide valuable context around an indicator, but analysts may still need to understand what a suspicious file, URL, or other artifact actually does. Behavioral analysis adds that evidence by executing the artifact in a controlled environment and capturing the activity it generates.
ANY.RUN’s Interactive Sandbox lets analysts investigate suspicious files and websites in isolated environments. Virtual machines start in under 10 seconds, with analysis reports available in around 40 seconds, helping SOCs and MSSPs get behavioral evidence quickly without waiting for a lengthy analysis cycle.
Reports capture processes, network connections, file and registry changes, screenshots, and MITRE ATT&CK techniques, giving analysts a detailed view of the activity behind an alert.
The results can also expand the investigation. A document that launches PowerShell and downloads another payload can reveal new hashes, domains, IPs, or other indicators. A phishing URL can expose redirects, scripts, additional domains, or downloaded files. These findings can then be investigated alongside existing threat intelligence, helping analysts connect individual artifacts to the broader activity.
Threat intelligence and behavioral analysis therefore work together: intelligence provides context from known activity, while sandbox analysis can generate new e
Investigate Beyond a Single IOC with ANY.RUN’s New Related Threat Context
A single IOC can point to activity far beyond the investigation where it was found. An IP address uncovered during sandbox analysis, for example, may have appeared in previous investigations, surfaced in activity targeting your industry, or already been linked to known threats.
ANY.RUN’s Related Threat Context brings these connections directly into Interactive Sandbox, giving Enterprise clients access to intelligence from a community of 700,000+ security professionals across 16,000+ organizations to help assess indicators and decide what to investigate next.
View a Sandbox analysis to see Related Threat Context in action
Related analyses give SOC teams more context around IOCs to guide response
Related Threat Context combines three sources of insight:
- Team Context: See whether your team has investigated the IOC before.
- Industry Context: Check how the IOC appears in activity across your industry.
- ANY.RUN Threat Intelligence: Discover known malicious indicators and related threat activity across the ANY.RUN ecosystem.
MSSPs can access Team Context and ANY.RUN Threat Intelligence to enrich investigations across their workflows, while Industry Context is designed for internal SOCs.
Related Threat Context also helps analysts quickly gauge how familiar an indicator is with “Never Seen Before” and “Commonly Seen” indicators.
When an IOC warrants a closer look, analysts can pivot to Threat Intelligence Lookup to explore it further or consult Threat Intelligence Reports for deeper insight into specific threats and campaigns.
The result: Less time spent chasing context across separate tools and more time understanding what an IOC means for the investigation at hand.
Better Context Can Reduce Unnecessary Escalation
The more context triage has upfront, the fewer cases need to move to senior analysts. When Tier 1 has access to current intelligence, behavioral evidence, and related investigation context, more cases can be resolved with confidence at the initial level. SOCs and MSSPs using ANY.RUN TI report a 30% reduction in Tier 1-to-Tier 2 escalations.
That does not mean eliminating escalation. It means reserving senior analyst time for cases that genuinely require deeper expertise.
When analyst capacity is under pressure, better context provided by ANY.RUN can reduce the workload on Tier 1, with a 20% decrease in Tier 1 workload.
For security leadership, those improvements translate into more capacity from the existing SOC rather than simply adding more people to handle growing alert volumes.
Connecting the Dots Across an Investigation
One of the strongest benefits of connecting sandboxing and threat intelligence is that the relationship works in both directions.
Threat Intelligence Feeds can identify an IOC discovered in telemetry as something already associated with malicious activity. When Sandbox analysis reveals additional infrastructure or indicators, those findings can be checked against the same intelligence to determine whether they are already known or require further investigation.
This creates a useful feedback loop. A suspicious attachment can lead to a domain, an IP address, additional files, and several ATT&CK techniques. Known indicators can be enriched through TI Feeds, while previously unseen indicators can be investigated further and potentially become valuable intelligence for future detection.
The same findings can then support threat hunting and detection engineering across the environment, helping analysts determine whether they are dealing with an isolated artifact or activity connected to a larger operation.
The investigation becomes iterative rather than linear: telemetry generates indicators, intelligence adds context, and analysis produces new evidence for the next investigation.
Conclusion
Threat context is most valuable when it reaches analysts early enough to influence what happens next. Real-time intelligence can enrich telemetry, sandbox analysis can reveal new evidence, and related context can connect those findings to broader threat activity.
Together, these capabilities reduce the time spent collecting and validating evidence, helping SOCs and MSSPs prioritize faster, investigate more efficiently, and make more confident response decisions.
The goal is simple: Put the right intelligence in front of analysts early enough to change the outcome of an investigation.
About ANY.RUN
ANY.RUN helps security teams investigate cyber threats and turn findings into actionable intelligence. Its solutions are used by 700,000+ cybersecurity professionals across 16,000+ organizations, including 74 of the Fortune 100.
With Interactive Sandbox, analysts can examine suspicious files and URLs in a safe, interactive environment and see malicious behavior as it unfolds.
Threat Intelligence Feeds bring malicious indicators into existing security workflows, while Threat Intelligence Lookup helps teams explore IOCs and uncover connections between threats. For a deeper view of threat actors, campaigns, and emerging activity, Threat Intelligence Reports provide additional research and analysis.
FAQ
Threat context is the intelligence and evidence that help security teams understand the significance of an indicator, including its history, associated infrastructure, known malicious activity, and relationships to other threats.
Real-time threat intelligence feeds enrich telemetry with known malicious indicators and associated context as events arrive. This helps analysts prioritize alerts, recognize known threats earlier, and spend less time researching indicators manually.
ANY.RUN Threat Intelligence Feeds provide malicious IP addresses, domains, and URLs enriched with sandbox-based intelligence. Drawing on activity observed across more than 16,000 organizations and 700,000 security professionals, they help security teams identify threats beyond their own environments.
Threat intelligence feeds provide context about known indicators, while sandbox analysis reveals how suspicious files and URLs behave in a controlled environment. Sandbox findings can uncover additional indicators and behaviors that analysts can investigate using threat intelligence.
Related Threat Context surfaces connections between indicators discovered during sandbox analysis and existing intelligence. It includes Team Context, Industry Context for eligible internal SOCs, and ANY.RUN Threat Intelligence, helping analysts identify previous investigations and related threat activity.
Analysts can examine suspicious files and URLs in ANY.RUN Interactive Sandbox to uncover behaviors, network connections, and additional IOCs. They can then use Related Threat Context, Threat Intelligence Lookup, and Threat Intelligence Reports to explore connections and investigate potential broader campaigns.
By giving Tier 1 analysts access to current intelligence, behavioral evidence, and related investigation context, threat enrichment helps them assess alerts with greater confidence. This can reduce unnecessary escalations while allowing senior analysts to focus on cases requiring deeper expertise.
MSSPs can use threat intelligence feeds to enrich customer telemetry and sandbox analysis to investigate suspicious artifacts. Related Threat Context adds visibility into previous team investigations and broader threat intelligence, supporting more consistent triage and investigation workflows across customer environments.
0 comments