{"id":18285,"date":"2026-02-04T07:34:45","date_gmt":"2026-02-04T07:34:45","guid":{"rendered":"\/cybersecurity-blog\/?p=18285"},"modified":"2026-02-05T12:19:12","modified_gmt":"2026-02-05T12:19:12","slug":"release-notes-january-2026","status":"publish","type":"post","link":"\/cybersecurity-blog\/release-notes-january-2026\/","title":{"rendered":"Release Notes: Workflow Improvements, MISP Integration & 2,000+ New Detections\u00a0"},"content":{"rendered":"\n

First month of the year, and we\u2019re starting it off with updates that support faster decisions and more predictable SOC operations. <\/p>\n\n\n\n

In January, we introduced a major workflow enhancement with the new ANY.RUN Sandbox<\/a> integration with MISP, alongside expanded detection coverage across behavior signatures, YARA rules, and Suricata. <\/p>\n\n\n\n

Let\u2019s find out what this means for your team. <\/p>\n\n\n\n

Product Updates <\/h2>\n\n\n\n

January brought another solid round of improvements focused on practical SOC workflows: faster alert validation, less manual back-and-forth, and earlier decisions that help stop incidents from growing into bigger problems. <\/p>\n\n\n\n

The main highlight of the month was the release of the ANY.RUN Sandbox integration with MISP<\/a>; an important step for teams that use MISP daily for threat intelligence and investigations. <\/p>\n\n\n\n

ANY.RUN x MISP: Boost Your Triage & Response <\/h3>\n\n\n\n

Most SOC teams spend too much time validating alerts, moving samples between tools, and filling in missing context. When execution evidence is separated from threat intelligence platforms, investigations slow down, MTTR increases, and SLAs come under pressure. <\/p>\n\n\n\n

With the ANY.RUN Sandbox<\/a> integration for MISP, analysts can now bring real execution behavior directly into MISP<\/strong>, turning it from a passive intelligence repository into an active investigation layer. <\/p>\n\n\n

\n
\"MISP
MISP \u201cPhishing attempt\u201d event enriched with ANY.RUN Sandbox and phishing-related tags<\/em><\/figcaption><\/figure><\/div>\n\n\n

Using native MISP modules, suspicious files and URLs can be sent straight from MISP into the ANY.RUN Sandbox, without any context switching or manual handoffs.  <\/p>\n\n\n\n

You can easily integrate the modules, using the following links: <\/p>\n\n\n\n