{"id":16661,"date":"2025-11-05T08:00:22","date_gmt":"2025-11-05T08:00:22","guid":{"rendered":"\/cybersecurity-blog\/?p=16661"},"modified":"2026-09-24T09:10:14","modified_gmt":"2026-09-24T09:10:14","slug":"all-integrations-and-connectors","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/","title":{"rendered":"Unified Security for Fast Response: All ANY.RUN Integrations for SIEM, SOAR, EDR, and More"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>\u2019s malware analysis and threat intelligence products are used by 16K SOCs and 700K analysts. Thanks to flexible <a href=\"https:\/\/any.run\/api-documentation\/\" target=\"_blank\" rel=\"noreferrer noopener\">API<\/a>\/<a href=\"https:\/\/github.com\/anyrun\/anyrun-sdk\" target=\"_blank\" rel=\"noreferrer noopener\">SDK<\/a> and ready-made connectors, they <a href=\"https:\/\/any.run\/integrations\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktointegrationspage\" target=\"_blank\" rel=\"noreferrer noopener\">seamlessly integrate<\/a> with security teams\u2019 existing software to expand threat coverage, reduce MTTR, and streamline performance. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For security leaders, integrations help turn existing technology investments into more effective SOC workflows. By bringing malware and phishing analysis, as well as fresh threat intelligence directly into established processes, teams can expand detection coverage, reduce manual work and tool switching, and accelerate response. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s how ANY.RUN\u2019s solutions can transform your security. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Interactive Sandbox: Detect Evasive Phishing &amp; Malware <\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"645\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-1024x645.webp\" alt=\"sandbox analysis\" class=\"wp-image-23213\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-1024x645.webp 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-300x189.webp 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-768x483.webp 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-1536x967.webp 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-370x233.webp 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-270x170.webp 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png-740x466.webp 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Sandbox-for-MSSP-2048x1289.png.webp 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><strong><em>Interactive Sandbox provides SOCs with fast threat detection capabilities<\/em><\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN\u2019s <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a> provides a real-time, cloud-based environment for detonating and analyzing suspicious files, URLs, and scripts across Windows, Linux, Android, macOS systems. It lets analysts perform user actions like launching executables or opening links needed to trigger kill chains and force hidden payloads to reveal themselves, enabling faster detection and response.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The sandbox integrates with other solutions like SOAR platforms in an <a href=\"https:\/\/any.run\/cybersecurity-blog\/automated-interactivity-stage-two\/\" target=\"_blank\" rel=\"noreferrer noopener\">automated mode<\/a>, which means it can fully detonate complex phishing and malware attacks on its own, including by solving CAPTCHAs and scanning QR codes. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By embedding sandbox analysis into existing workflows, organizations can increase SOC capacity, standardize triage, and get more value from their existing SIEM, SOAR, and EDR investments. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is faster, more consistent threat investigation without increasing operational complexity: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Real-Time Threat Visibility:<\/strong> Observe attack chains as they unfold, with 90% of threats detected within 60 seconds, accelerating mean time to detect (MTTD). <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Higher Detection Rates:<\/strong> Uncover low-detection attacks (e.g., multi-stage malware, CAPTCHA-protected phishing) with up to 58% more threats identified, reducing missed incidents. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Automated Efficiency:<\/strong> Cut manual analysis time with automated interactivity, reducing Tier 1 workload by 20% and enabling junior analysts to handle complex cases independently. <\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Connectors and integrations for Interactive Sandbox <\/h3>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-258\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"6\"\n           data-wpID=\"258\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/splunk-enterprise\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"01\" data-link-url=\"https:\/\/any.run\/integrations\/splunk-enterprise\/\" data-link-text=\"Splunk Enterprise\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Splunk Enterprise<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/misp.github.io\/misp-modules\/expansion\/#anyrun-sandbox-submit\"  rel=\"\" target=\"_blank\" data-cell-id=\"02\" data-link-url=\"https:\/\/misp.github.io\/misp-modules\/expansion\/#anyrun-sandbox-submit\" data-link-text=\"MISP\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">MISP<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/strangebee.com\/integration\/anyrun\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"60\" data-link-url=\"https:\/\/strangebee.com\/integration\/anyrun\/\" data-link-text=\"The Hive\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">The Hive<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-E9F8FF\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/ibm-qradar-soar\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"10\" data-link-url=\"https:\/\/any.run\/integrations\/ibm-qradar-soar\/\" data-link-text=\"IBM Security Radar SOAR\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">IBM Security Radar SOAR<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-E9F8FF\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/microsoft-defender-integration\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"11\" data-link-url=\"https:\/\/any.run\/integrations\/microsoft-defender-integration\/\" data-link-text=\"Microsoft Defender\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Microsoft Defender<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-E9F8FF\"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/microsoft-sentinel-integration\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"12\" data-link-url=\"https:\/\/any.run\/integrations\/microsoft-sentinel-integration\/\" data-link-text=\"Microsoft Sentinel\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Microsoft Sentinel<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/www.dataminr.com\/integration-partners\/any-run\/ \"  rel=\"\" target=\"_blank\" data-cell-id=\"50\" data-link-url=\"https:\/\/www.dataminr.com\/integration-partners\/any-run\/ \" data-link-text=\"ThreatConnect\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">ThreatConnect<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/www.tines.com\/solutions\/products\/any-run\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"41\" data-link-url=\"https:\/\/www.tines.com\/solutions\/products\/any-run\/\" data-link-text=\"Tines\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Tines<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-E9F8FF wpdt-tc-000000 wpdt-underline\"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/splunkbase.splunk.com\/app\/7474\"  rel=\"\" target=\"_blank\" data-cell-id=\"12\" data-link-url=\"https:\/\/splunkbase.splunk.com\/app\/7474\" data-link-text=\"SplunkSOAR\u00a0\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">SplunkSOAR\u00a0<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/docs.blinkops.com\/docs\/integrations\/any-run\"  rel=\"\" target=\"_blank\" data-cell-id=\"20\" data-link-url=\"https:\/\/docs.blinkops.com\/docs\/integrations\/any-run\" data-link-text=\"Blink\u00a0\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Blink\u00a0<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/cloud.google.com\/chronicle\/docs\/soar\/marketplace-integrations\/any-run\"  rel=\"\" target=\"_blank\" data-cell-id=\"21\" data-link-url=\"https:\/\/cloud.google.com\/chronicle\/docs\/soar\/marketplace-integrations\/any-run\" data-link-text=\"Google Security Operations\u00a0\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Google Security Operations\u00a0<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"C4\"\n                    data-col-index=\"2\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/d3security.com\/integrations\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"22\" data-link-url=\"https:\/\/d3security.com\/integrations\/\" data-link-text=\"D3 Security\u00a0\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">D3 Security\u00a0<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/torq.io\/integrations\/#integrations\"  rel=\"\" target=\"_blank\" data-cell-id=\"42\" data-link-url=\"https:\/\/torq.io\/integrations\/#integrations\" data-link-text=\"Torq\u00a0\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Torq\u00a0<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/www.sumologic.com\/help\/docs\/platform-services\/automation-service\/app-central\/integrations\/any.run\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"31\" data-link-url=\"https:\/\/www.sumologic.com\/help\/docs\/platform-services\/automation-service\/app-central\/integrations\/any.run\/\" data-link-text=\"Sumo Logic\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Sumo Logic<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-tc-000000 wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"C5\"\n                    data-col-index=\"2\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/apphub.swimlane.com\/swimbundles\/swimlane\/sw_anyrun\"  rel=\"\" target=\"_blank\" data-cell-id=\"42\" data-link-url=\"https:\/\/apphub.swimlane.com\/swimbundles\/swimlane\/sw_anyrun\" data-link-text=\"Swimlane\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Swimlane<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/opencti-integration\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"51\" data-link-url=\"https:\/\/any.run\/integrations\/opencti-integration\/\" data-link-text=\"OpenCTI\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">OpenCTI<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-E9F8FF wpdt-underline\"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/SentinelOne\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"42\" data-link-url=\"https:\/\/any.run\/integrations\/SentinelOne\/\" data-link-text=\"SentinelONE\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">SentinelONE<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-E9F8FF wpdt-empty-cell \"\n                                            data-cell-id=\"C6\"\n                    data-col-index=\"2\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                                            <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-258'>\ntable#wpdtSimpleTable-258{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-258 td, table.wpdtSimpleTable258 th { white-space: normal !important; }\n.wpdt-tc-000000 { color: #000000 !important;}\n.wpdt-bc-E9F8FF { background-color: #E9F8FF !important;}\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Please note:<\/strong> If your solution is not on the list, ANY.RUN\u2019s <a href=\"https:\/\/any.run\/api-documentation\/\" target=\"_blank\" rel=\"noreferrer noopener\">API<\/a> or Python-based SDK (see docs on <a href=\"https:\/\/github.com\/anyrun\/anyrun-sdk\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub<\/a> or <a href=\"https:\/\/pypi.org\/project\/anyrun-sdk\/\" target=\"_blank\" rel=\"noreferrer noopener\">PyPi<\/a>) make it possible to build custom integrations around your existing security architecture.<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nStrengthen threat detection across your SOC <br>\nDetect up to <span class=\"highlight\">58%<\/span> more threats with ANY.RUN.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktosnandboxlanding#contact-sales\" target=\"_blank\" rel=\"noopener\">\nIntegrate Sandbox\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">Threat Intelligence Feeds: Expand Threat Coverage <\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"474\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-1024x474.png\" alt=\"\" class=\"wp-image-23155\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-1024x474.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-300x139.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-768x356.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-1536x711.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-2048x949.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-370x171.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-270x125.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/ss02-740x343.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>TI Feeds offer 99% unique IOCs to identify the latest threats early<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktofeedslanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Feeds<\/a> deliver real-time, high-confidence malicious indicators (IPs, domains, URLs) supplied in STIX\/TAXII. The indicators are sourced from analyses of the latest malware and phishing attacks performed by <a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-from-organizations\/\" target=\"_blank\" rel=\"noreferrer noopener\">16,000 organizations<\/a> and 700,000 analysts in ANY.RUN\u2019s Interactive Sandbox.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thanks to being powered by one of the largest malware analysis communities, these feeds provide 99% unique IOCs, not found in other sources, that are updated in real time. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For security leaders, this means an extended threat coverage without adding another standalone workflow for analysts. As a result, SOCs gain up-to-date visibility into emerging threats while reducing the manual effort required to collect, validate, and operationalize intelligence: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Strengthen threat coverage:<\/strong> Live intelligence helps teams identify emerging attacks early on. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Accelerate response: <\/strong>IOCs come with sandbox reports and investigation context for faster decision-making. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Improve SOC efficiency: <\/strong>Filtering prioritizes high-risk indicators, reducing unnecessary analyst workload. <\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Connectors and integrations for TI Feeds<\/h3>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-259\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"6\"\n           data-wpID=\"259\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/splunk-enterprise\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"10\" data-link-url=\"https:\/\/any.run\/integrations\/splunk-enterprise\/\" data-link-text=\"Splunk Enterprise\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Splunk Enterprise<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/github.com\/anyrun\/anyrun-integration-misp\"  rel=\"\" target=\"_blank\" data-cell-id=\"11\" data-link-url=\"https:\/\/github.com\/anyrun\/anyrun-integration-misp\" data-link-text=\"MISP\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">MISP<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/files.any.run\/images\/anyrun_ti_feeds_ms_sentinel_integration_guide.pdf?_gl=1*fmoihl*_gcl_au*MTIwMTI1NzY0MS4xNzg4NzU5MzEy*_ga*MTE5Njg2NTE5MC4xNzg4NzU5MzEy*_ga_53KB74YDZR*czE3ODk5Nzk2MDYkbzUxJGcxJHQxNzg5OTkwNDcxJGo2MCRsMCRoNzIyODMwMzgx\"  rel=\"\" target=\"_blank\" data-cell-id=\"40\" data-link-url=\"https:\/\/files.any.run\/images\/anyrun_ti_feeds_ms_sentinel_integration_guide.pdf?_gl=1*fmoihl*_gcl_au*MTIwMTI1NzY0MS4xNzg4NzU5MzEy*_ga*MTE5Njg2NTE5MC4xNzg4NzU5MzEy*_ga_53KB74YDZR*czE3ODk5Nzk2MDYkbzUxJGcxJHQxNzg5OTkwNDcxJGo2MCRsMCRoNzIyODMwMzgx\" data-link-text=\"Microsoft Sentinel\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Microsoft Sentinel<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/files.any.run\/images\/anyrun_ti_feeds_threatq_guide.pdf?_gl=1*rtdxyi*_gcl_au*MTIwMTI1NzY0MS4xNzg4NzU5MzEy*_ga*MTE5Njg2NTE5MC4xNzg4NzU5MzEy*_ga_53KB74YDZR*czE3ODk5Nzk2MDYkbzUxJGcxJHQxNzg5OTkwNTQ1JGo2MCRsMCRoNzIyODMwMzgx\"  rel=\"\" target=\"_blank\" data-cell-id=\"41\" data-link-url=\"https:\/\/files.any.run\/images\/anyrun_ti_feeds_threatq_guide.pdf?_gl=1*rtdxyi*_gcl_au*MTIwMTI1NzY0MS4xNzg4NzU5MzEy*_ga*MTE5Njg2NTE5MC4xNzg4NzU5MzEy*_ga_53KB74YDZR*czE3ODk5Nzk2MDYkbzUxJGcxJHQxNzg5OTkwNTQ1JGo2MCRsMCRoNzIyODMwMzgx\" data-link-text=\"Threat Quotient\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Threat Quotient<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/github.com\/anyrun\/anyrun-integration-rapid7\/tree\/main\"  rel=\"\" target=\"_blank\" data-cell-id=\"50\" data-link-url=\"https:\/\/github.com\/anyrun\/anyrun-integration-rapid7\/tree\/main\" data-link-text=\"RapidInsightIDR\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">RapidInsightIDR<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/microsoft-defender-integration\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"51\" data-link-url=\"https:\/\/any.run\/integrations\/microsoft-defender-integration\/\" data-link-text=\"Microsoft Defender\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Microsoft Defender<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/apps.xforce.ibmcloud.com\/extension\/85034cf13916e0512bcd1b65061fd134\"  rel=\"\" target=\"_blank\" data-cell-id=\"60\" data-link-url=\"https:\/\/apps.xforce.ibmcloud.com\/extension\/85034cf13916e0512bcd1b65061fd134\" data-link-text=\"IBM Security QRadar SIEM\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">IBM Security QRadar SIEM<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/microsoft-defender-integration\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"51\" data-link-url=\"https:\/\/any.run\/integrations\/microsoft-defender-integration\/\" data-link-text=\"Microsoft Defender\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Microsoft Defender<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/www.elastic.co\/docs\/reference\/integrations\/ti_anyrun\"  rel=\"\" target=\"_blank\" data-cell-id=\"00\" data-link-url=\"https:\/\/www.elastic.co\/docs\/reference\/integrations\/ti_anyrun\" data-link-text=\"Elastic\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Elastic<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/opencti-integration\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"51\" data-link-url=\"https:\/\/any.run\/integrations\/opencti-integration\/\" data-link-text=\"OpenCTI\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">OpenCTI<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/SentinelOne\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"42\" data-link-url=\"https:\/\/any.run\/integrations\/SentinelOne\/\" data-link-text=\"SentinelONE\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">SentinelONE<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline wpdt-empty-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                                            <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-259'>\ntable#wpdtSimpleTable-259{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-259 td, table.wpdtSimpleTable259 th { white-space: normal !important; }\n.wpdt-bc-CCFFCE { background-color: #CCFFCE !important;}\n<\/style>\n\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nExpand coverage with real-time threat intelligence  <br>\nGet <span class=\"highlight\">99% unique IOCs<\/span> directly in your security stack.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktotifeedslanding#contact-sales\" target=\"_blank\" rel=\"noopener\">\nIntegrate TI Feeds\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Please note:<\/strong> If your solution is not on the list, you can easily set up a custom integration using ANY.RUN\u2019s <a href=\"https:\/\/any.run\/api-documentation\/\" target=\"_blank\" rel=\"noreferrer noopener\">API<\/a> or Python-based SDK (see docs on <a href=\"https:\/\/github.com\/anyrun\/anyrun-sdk\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub<\/a> or <a href=\"https:\/\/pypi.org\/project\/anyrun-sdk\/\" target=\"_blank\" rel=\"noreferrer noopener\">PyPi<\/a>). <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Threat Intelligence Lookup: Contextualize Alerts <\/h2>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"585\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-1024x585.png\" alt=\"Threat Intelligence Lookup gives more context for deeper analysis\" class=\"wp-image-22934\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-1024x585.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-768x439.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-1536x877.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-2048x1170.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-370x211.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/09\/TI-lookup-740x423.png 740w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><strong><em>TI Lookup lets SOC teams get instant IOC context across threats, industries and regions<\/em><\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> is a powerful solution designed to streamline and accelerate malware investigations, from proactive monitoring to incident response.  <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SOC teams can use it to quickly get actionable context for over <a href=\"https:\/\/any.run\/cybersecurity-blog\/ti-lookup-search-parameters\/\" target=\"_blank\" rel=\"noreferrer noopener\">40 different types<\/a> of Indicators of Compromise (IOCs), Attack (IOAs), and Behavior (IOBs), from an IP address and a domain to a mutex and a process name.  <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"595\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png-1024x595.webp\" alt=\"\" class=\"wp-image-23214\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png-1024x595.webp 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png-300x174.webp 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png-768x447.webp 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png-370x215.webp 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png-270x157.webp 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png-740x430.webp 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/bigti_1.png.webp 1510w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><strong><strong><em>Use AI-powered search to look up threats and indicators using natural language, no complex query building needed. TI Lookup <\/em><\/strong><\/strong><\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Each indicator in TI Lookup&#8217;s database is linked to a sandbox session, where it was observed, providing analysts with a complete view of the attack, including its TTPs. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When integrated into existing SOC workflows, this context becomes available almost instantly, supporting more independent Tier 1 decision-making, and reserving senior analyst capacity for cases that genuinely require escalation. <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Triage alerts faster<\/strong>: Two-second access to millions of past analyses confirms if an IOC belongs to a threat, cutting triage time. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Shorten response time<\/strong>: Indicator enrichment with behavioral context and TTPs guide precise containment strategies. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce unnecessary escalations<\/strong>: Provides Tier 1 analysts with the info to make decisions independently, reducing escalations to Tier 2. <\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Connectors and integrations for TI Lookup <\/h3>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-260\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"5\"\n           data-wpID=\"260\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/strangebee.com\/integration\/anyrun\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"31\" data-link-url=\"https:\/\/strangebee.com\/integration\/anyrun\/\" data-link-text=\"TheHive\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">TheHive<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/kb.torq.io\/en\/articles\/16052149-any-run\"  rel=\"\" target=\"_blank\" data-cell-id=\"01\" data-link-url=\"https:\/\/kb.torq.io\/en\/articles\/16052149-any-run\" data-link-text=\"Torq\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Torq<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/apps.xforce.ibmcloud.com\/extension\/06dbb4c6b59fc59ed9c277b0bb1a3f7d\"  rel=\"\" target=\"_blank\" data-cell-id=\"10\" data-link-url=\"https:\/\/apps.xforce.ibmcloud.com\/extension\/06dbb4c6b59fc59ed9c277b0bb1a3f7d\" data-link-text=\"IBM Security QRadar SOAR\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">IBM Security QRadar SOAR<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/files.any.run\/images\/anyrun_content_pack_for_google_secops.pdf?_gl=1*ytjz2w*_gcl_au*MTIwMTI1NzY0MS4xNzg4NzU5MzEy*_ga*MTE5Njg2NTE5MC4xNzg4NzU5MzEy*_ga_53KB74YDZR*czE3ODk5Nzk2MDYkbzUxJGcxJHQxNzg5OTg3NTUxJGozNiRsMCRoNzIyODMwMzgx\"  rel=\"\" target=\"_blank\" data-cell-id=\"30\" data-link-url=\"https:\/\/files.any.run\/images\/anyrun_content_pack_for_google_secops.pdf?_gl=1*ytjz2w*_gcl_au*MTIwMTI1NzY0MS4xNzg4NzU5MzEy*_ga*MTE5Njg2NTE5MC4xNzg4NzU5MzEy*_ga_53KB74YDZR*czE3ODk5Nzk2MDYkbzUxJGcxJHQxNzg5OTg3NTUxJGozNiRsMCRoNzIyODMwMzgx\" data-link-text=\"Google SecOps SOAR\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Google SecOps SOAR<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/splunk-soar\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"20\" data-link-url=\"https:\/\/any.run\/integrations\/splunk-soar\/\" data-link-text=\"Splunk SOAR\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Splunk SOAR<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/splunk-enterprise\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"21\" data-link-url=\"https:\/\/any.run\/integrations\/splunk-enterprise\/\" data-link-text=\"Splunk Enterprise\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Splunk Enterprise<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/www.tines.com\/library\/stories\/1331102\/?name=analyze-files-in-any-run-sandbox\"  rel=\"\" target=\"_blank\" data-cell-id=\"02\" data-link-url=\"https:\/\/www.tines.com\/library\/stories\/1331102\/?name=analyze-files-in-any-run-sandbox\" data-link-text=\"Tines\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">Tines<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-bc-CCFFCE wpdt-underline\"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/opencti-integration\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"51\" data-link-url=\"https:\/\/any.run\/integrations\/opencti-integration\/\" data-link-text=\"OpenCTI\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">OpenCTI<\/a>                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        <a class=\"wpdt-link-content\" href=\"https:\/\/any.run\/integrations\/SentinelOne\/\"  rel=\"\" target=\"_blank\" data-cell-id=\"42\" data-link-url=\"https:\/\/any.run\/integrations\/SentinelOne\/\" data-link-text=\"SentinelONE\" data-link-target=\"true\" data-link-nofollow=\"0\" data-link-noreferrer=\"0\" data-link-sponsored=\"0\" data-link-btn-status=\"0\" data-link-btn-class=\"\" data-link-content=\"wpdt-link-content\">SentinelONE<\/a>                    <\/td>\n                                                <td class=\"wpdt-cell wpdt-underline wpdt-bc-CCFFCE wpdt-empty-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                                            <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-260'>\ntable#wpdtSimpleTable-260{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-260 td, table.wpdtSimpleTable260 th { white-space: normal !important; }\n.wpdt-bc-CCFFCE { background-color: #CCFFCE !important;}\n<\/style>\n\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nAccelerate investigations across your SOC. <br>\nGet actionable threat context in as little as <span class=\"highlight\">2 seconds<\/span>.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktotilookuplanding#contact-sales\" target=\"_blank\" rel=\"noopener\">\nIntegrate TI Lookup\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Please note:<\/strong> If your solution is not on the list, you can easily set up a custom integration using ANY.RUN\u2019s <a href=\"https:\/\/any.run\/api-documentation\/\" target=\"_blank\" rel=\"noreferrer noopener\">API<\/a> or Python-based SDK (see docs on <a href=\"https:\/\/github.com\/anyrun\/anyrun-sdk\" target=\"_blank\" rel=\"noreferrer noopener\">GitHub<\/a> or <a href=\"https:\/\/pypi.org\/project\/anyrun-sdk\/\" target=\"_blank\" rel=\"noreferrer noopener\">PyPi<\/a>). <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Integrate ANY.RUN\u2019s Solutions in Your SOC <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN brings malware analysis and threat intelligence into the SIEM, SOAR, EDR, and other systems already supporting daily security operations, equipping your SOC with the visibility, speed, and efficiency needed to stay ahead.   <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With ready-made connectors flexible <a href=\"https:\/\/any.run\/api-documentation\/\" target=\"_blank\" rel=\"noreferrer noopener\">API<\/a>\/<a href=\"https:\/\/github.com\/anyrun\/anyrun-sdk\" target=\"_blank\" rel=\"noreferrer noopener\">SDK<\/a>, organizations can strengthen existing security investments rather than rebuild their stack: expand threat coverage, reduce repetitive analyst work, accelerate investigations, and scale SOC capacity more efficiently. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nExpand coverage and accelerate response by <span class=\"highlight\">21 mins<\/span><br>with ANY.RUN\u00a0\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/integrations\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktointegrations\" target=\"_blank\" rel=\"noopener\">\nExplore all integrations<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Trusted by over 700,000 cybersecurity professionals and 16,000+ organizations in finance, healthcare, manufacturing, and other critical industries, <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a> helps security teams investigate threats faster and with greater accuracy.    <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noreferrer noopener\">Interactive Sandbox<\/a> accelerates incident response by allowing you to analyze suspicious files in real time, watch behavior as it unfolds, and make confident, well-informed decisions.    <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Lookup<\/a> and <a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=all_integrations&amp;utm_term=051125&amp;utm_content=linktofeedslanding\" target=\"_blank\" rel=\"noreferrer noopener\">Threat Intelligence Feeds<\/a> strengthen detection by providing the context your team needs to anticipate and stop today\u2019s most advanced attacks.    <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1789986885477\"><strong class=\"schema-faq-question\">Which platforms does ANY.RUN Interactive Sandbox integrate with?<\/strong> <p class=\"schema-faq-answer\">ANY.RUN Interactive Sandbox integrates with Splunk SOAR, Microsoft Sentinel, Microsoft Defender, Google Security Operations, ThreatConnect, Tines, Torq, and many more. Custom integrations are also available through the ANY.RUN API and SDK.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789986900208\"><strong class=\"schema-faq-question\">Which platforms does ANY.RUN TI Feeds integrate with?<\/strong> <p class=\"schema-faq-answer\">ANY.RUN TI Feeds integrate with Elastic Security, Microsoft Sentinel, Microsoft Defender, Splunk, QRadar SIEM, and other security solutions. TI Feeds can also be delivered via STIX\/TAXII.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789986912477\"><strong class=\"schema-faq-question\">Which platforms does ANY.RUN TI Lookup integrate with?<\/strong> <p class=\"schema-faq-answer\">ANY.RUN TI Lookup integrates with Splunk, Torq, Tines, QRadar SOAR, and other security solutions, bringing threat context directly into existing investigation workflows.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789986934342\"><strong class=\"schema-faq-question\">Does ANY.RUN integrate with Splunk?<\/strong> <p class=\"schema-faq-answer\">Yes. ANY.RUN supports Splunk integrations across its threat intelligence and malware analysis products, including Interactive Sandbox actions and TI Lookup in Splunk SOAR and threat intelligence delivery for Splunk environments.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789986944080\"><strong class=\"schema-faq-question\">Does ANY.RUN integrate with Microsoft Sentinel?<\/strong> <p class=\"schema-faq-answer\">Yes. ANY.RUN integrates with Microsoft Sentinel, enabling security teams to bring threat intelligence from TI Feeds and malware analysis capabilities from Interactive Sandbox into Microsoft security workflows.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789986952542\"><strong class=\"schema-faq-question\">Does ANY.RUN integrate with Microsoft Defender?<\/strong> <p class=\"schema-faq-answer\">Yes. ANY.RUN supports integrations with Microsoft Defender for threat intelligence and sandbox analysis, helping teams enrich detection and investigation workflows with additional threat context.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1789986976307\"><strong class=\"schema-faq-question\">Does ANY.RUN integrate with Elastic Security?<\/strong> <p class=\"schema-faq-answer\">Yes. ANY.RUN TI Feeds integrate with Elastic Security to deliver fresh threat indicators directly into existing detection, triage, and investigation workflows.<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>ANY.RUN\u2019s malware analysis and threat intelligence products are used by 16K SOCs and 700K analysts. Thanks to flexible API\/SDK and ready-made connectors, they seamlessly integrate with security teams\u2019 existing software to expand threat coverage, reduce MTTR, and streamline performance. For security leaders, integrations help turn existing technology investments into more effective SOC workflows. By bringing [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":16663,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[81],"tags":[57,10,34],"class_list":["post-16661","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-integrations-connectors","tag-anyrun","tag-cybersecurity","tag-malware-analysis"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>All ANY.RUN Integrations for SIEM, SOAR, EDR, and More\u00a0<\/title>\n<meta name=\"description\" content=\"Discover how ANY.RUN&#039;s malware analysis and threat intelligence products can integrate seamlessly with your SOAR, SIEM, TIP, or EDR solution.\u00a0\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"headline\":\"Unified Security for Fast Response: All ANY.RUN Integrations for SIEM, SOAR, EDR, and More\",\"datePublished\":\"2025-11-05T08:00:22+00:00\",\"dateModified\":\"2026-09-24T09:10:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/\"},\"wordCount\":1269,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Integrations.jpg\",\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\"],\"articleSection\":[\"Integrations &amp; connectors\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#respond\"]}]},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/\",\"name\":\"All ANY.RUN Integrations for SIEM, SOAR, EDR, and More\u00a0\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Integrations.jpg\",\"datePublished\":\"2025-11-05T08:00:22+00:00\",\"dateModified\":\"2026-09-24T09:10:14+00:00\",\"description\":\"Discover how ANY.RUN's malware analysis and threat intelligence products can integrate seamlessly with your SOAR, SIEM, TIP, or EDR solution.\u00a0\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986885477\"},{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986900208\"},{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986912477\"},{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986934342\"},{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986944080\"},{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986952542\"},{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986976307\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#primaryimage\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Integrations.jpg\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2025\\\/11\\\/Integrations.jpg\",\"width\":2100,\"height\":1020,\"caption\":\"ANY.RUN integrations\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Integrations &amp; connectors\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/category\\\/integrations-connectors\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Unified Security for Fast Response: All ANY.RUN Integrations for SIEM, SOAR, EDR, and More\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/any.run\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/www.any.run\\\/\",\"https:\\\/\\\/x.com\\\/anyrun_app\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/30692044\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/author\\\/a-bespalova\\\/\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986885477\",\"position\":1,\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986885477\",\"name\":\"Which platforms does ANY.RUN Interactive Sandbox integrate with?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"ANY.RUN Interactive Sandbox integrates with Splunk SOAR, Microsoft Sentinel, Microsoft Defender, Google Security Operations, ThreatConnect, Tines, Torq, and many more. Custom integrations are also available through the ANY.RUN API and SDK.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986900208\",\"position\":2,\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986900208\",\"name\":\"Which platforms does ANY.RUN TI Feeds integrate with?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"ANY.RUN TI Feeds integrate with Elastic Security, Microsoft Sentinel, Microsoft Defender, Splunk, QRadar SIEM, and other security solutions. TI Feeds can also be delivered via STIX\\\/TAXII.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986912477\",\"position\":3,\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986912477\",\"name\":\"Which platforms does ANY.RUN TI Lookup integrate with?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"ANY.RUN TI Lookup integrates with Splunk, Torq, Tines, QRadar SOAR, and other security solutions, bringing threat context directly into existing investigation workflows.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986934342\",\"position\":4,\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986934342\",\"name\":\"Does ANY.RUN integrate with Splunk?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. ANY.RUN supports Splunk integrations across its threat intelligence and malware analysis products, including Interactive Sandbox actions and TI Lookup in Splunk SOAR and threat intelligence delivery for Splunk environments.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986944080\",\"position\":5,\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986944080\",\"name\":\"Does ANY.RUN integrate with Microsoft Sentinel?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. ANY.RUN integrates with Microsoft Sentinel, enabling security teams to bring threat intelligence from TI Feeds and malware analysis capabilities from Interactive Sandbox into Microsoft security workflows.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986952542\",\"position\":6,\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986952542\",\"name\":\"Does ANY.RUN integrate with Microsoft Defender?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. ANY.RUN supports integrations with Microsoft Defender for threat intelligence and sandbox analysis, helping teams enrich detection and investigation workflows with additional threat context.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986976307\",\"position\":7,\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/all-integrations-and-connectors\\\/#faq-question-1789986976307\",\"name\":\"Does ANY.RUN integrate with Elastic Security?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. ANY.RUN TI Feeds integrate with Elastic Security to deliver fresh threat indicators directly into existing detection, triage, and investigation workflows.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"All ANY.RUN Integrations for SIEM, SOAR, EDR, and More\u00a0","description":"Discover how ANY.RUN's malware analysis and threat intelligence products can integrate seamlessly with your SOAR, SIEM, TIP, or EDR solution.\u00a0","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"Unified Security for Fast Response: All ANY.RUN Integrations for SIEM, SOAR, EDR, and More","datePublished":"2025-11-05T08:00:22+00:00","dateModified":"2026-09-24T09:10:14+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/"},"wordCount":1269,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Integrations.jpg","keywords":["ANYRUN","cybersecurity","malware analysis"],"articleSection":["Integrations &amp; connectors"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#respond"]}]},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/","url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/","name":"All ANY.RUN Integrations for SIEM, SOAR, EDR, and More\u00a0","isPartOf":{"@id":"https:\/\/any.run\/"},"primaryImageOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#primaryimage"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Integrations.jpg","datePublished":"2025-11-05T08:00:22+00:00","dateModified":"2026-09-24T09:10:14+00:00","description":"Discover how ANY.RUN's malware analysis and threat intelligence products can integrate seamlessly with your SOAR, SIEM, TIP, or EDR solution.\u00a0","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986885477"},{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986900208"},{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986912477"},{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986934342"},{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986944080"},{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986952542"},{"@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986976307"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#primaryimage","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Integrations.jpg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2025\/11\/Integrations.jpg","width":2100,"height":1020,"caption":"ANY.RUN integrations"},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Integrations &amp; connectors","item":"https:\/\/any.run\/cybersecurity-blog\/category\/integrations-connectors\/"},{"@type":"ListItem","position":3,"name":"Unified Security for Fast Response: All ANY.RUN Integrations for SIEM, SOAR, EDR, and More"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/x.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"},{"@type":"Question","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986885477","position":1,"url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986885477","name":"Which platforms does ANY.RUN Interactive Sandbox integrate with?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"ANY.RUN Interactive Sandbox integrates with Splunk SOAR, Microsoft Sentinel, Microsoft Defender, Google Security Operations, ThreatConnect, Tines, Torq, and many more. Custom integrations are also available through the ANY.RUN API and SDK.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986900208","position":2,"url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986900208","name":"Which platforms does ANY.RUN TI Feeds integrate with?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"ANY.RUN TI Feeds integrate with Elastic Security, Microsoft Sentinel, Microsoft Defender, Splunk, QRadar SIEM, and other security solutions. TI Feeds can also be delivered via STIX\/TAXII.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986912477","position":3,"url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986912477","name":"Which platforms does ANY.RUN TI Lookup integrate with?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"ANY.RUN TI Lookup integrates with Splunk, Torq, Tines, QRadar SOAR, and other security solutions, bringing threat context directly into existing investigation workflows.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986934342","position":4,"url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986934342","name":"Does ANY.RUN integrate with Splunk?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Yes. ANY.RUN supports Splunk integrations across its threat intelligence and malware analysis products, including Interactive Sandbox actions and TI Lookup in Splunk SOAR and threat intelligence delivery for Splunk environments.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986944080","position":5,"url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986944080","name":"Does ANY.RUN integrate with Microsoft Sentinel?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Yes. ANY.RUN integrates with Microsoft Sentinel, enabling security teams to bring threat intelligence from TI Feeds and malware analysis capabilities from Interactive Sandbox into Microsoft security workflows.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986952542","position":6,"url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986952542","name":"Does ANY.RUN integrate with Microsoft Defender?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Yes. ANY.RUN supports integrations with Microsoft Defender for threat intelligence and sandbox analysis, helping teams enrich detection and investigation workflows with additional threat context.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986976307","position":7,"url":"https:\/\/any.run\/cybersecurity-blog\/all-integrations-and-connectors\/#faq-question-1789986976307","name":"Does ANY.RUN integrate with Elastic Security?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Yes. ANY.RUN TI Feeds integrate with Elastic Security to deliver fresh threat indicators directly into existing detection, triage, and investigation workflows.","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/16661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=16661"}],"version-history":[{"count":19,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/16661\/revisions"}],"predecessor-version":[{"id":23361,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/16661\/revisions\/23361"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/16663"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=16661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=16661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=16661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}