{"id":23628,"date":"2026-10-08T07:46:28","date_gmt":"2026-10-08T07:46:28","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=23628"},"modified":"2026-10-08T07:48:40","modified_gmt":"2026-10-08T07:48:40","slug":"ti-feeds-elastic-webinar","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/ti-feeds-elastic-webinar\/","title":{"rendered":"Making Threat Intelligence Work for SOC Teams: ANY.RUN & Elastic Webinar Insights"},"content":{"rendered":"\n

Threat intelligence on its own is only data. Its value depends on how effectively SOC teams can turn it into action. <\/p>\n\n\n\n

Simply put, this was the premise of our recent webinar. <\/p>\n\n\n\n

The SOC and business impact<\/a> of threat intelligence depends largely on how quickly analysts can use it to validate threats, make confident decisions, and take action. <\/p>\n\n\n\n

Exploring how to make that happen was the focus of ANY.RUN<\/a>‘s recent joint webinar with Elastic, \u201cTurn Threat Intelligence Into SOC Action with ANY.RUN and Elastic Security.\u201d <\/p>\n\n\n\n

\n
Watch the full webinar<\/a><\/div>\n<\/div>\n\n\n\n

<\/p>\n\n\n\n

How It Went <\/h2>\n\n\n\n

ANY.RUN CTO Dmitry Marinov and Elastic Principal Solutions Architect Tammy Torbert came together for a live discussion on making threat intelligence work in daily SOC operations<\/a>. <\/p>\n\n\n\n

And we didn\u2019t stop at theory. The webinar included interactive tasks for the audience, a live demo of the ANY.RUN Threat Intelligence and Elastic Security integration<\/a>, and a Q&A session that gave us a chance to dive into even more practical questions from our viewers. <\/p>\n\n\n\n

A big thank you to the Elastic team for making this session happen, and to everyone who joined us, took part, and brought great questions to the discussion! <\/p>\n\n\n\n

Executive Takeaways <\/h2>\n\n\n
\n
\"\"
Three key requirements for threat intelligence, as discussed by ANY.RUN and Elastic<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n

So, what actually makes threat intelligence useful in daily SOC work? During our discussion, we narrowed it to three things: <\/p>\n\n\n\n

1. Threat Intelligence Has to Stay Relevant <\/h3>\n\n\n\n

Threat infrastructure changes quickly, and indicators can lose relevance just as fast. <\/p>\n\n\n\n

Solution: <\/strong>ANY.RUN Threat Intelligence Feeds<\/a> deliver continuously validated, high-confidence IOCs from real-world investigations by more than 16,000 SOC teams and 700,000 security professionals. This helps SOC teams keep detection workflows aligned with active threats. <\/p>\n\n\n\n

Outcome: <\/strong>Earlier identification<\/a> of known malicious activity, less manual IOC validation, and more analyst time for complex investigations. <\/p>\n\n\n\n

2. Context Helps Analysts Make Better Decisions <\/h3>\n\n\n\n

An IOC match can validate suspicious activity, but analysts still need to understand what happened and how urgently they should respond<\/a>. <\/p>\n\n\n\n

Solution: <\/strong>ANY.RUN Threat Intelligence connects IOC matches to behavioral evidence from Sandbox<\/a> analyses, helping analysts assess threat severity without relying on indicator matches alone. <\/p>\n\n\n\n

Outcome: <\/strong>Faster, more confident triage, better prioritization of high-risk incidents, and fewer unnecessary escalations. <\/p>\n\n\n\n

3. TI Works Better Inside Existing SOC Workflows <\/h3>\n\n\n\n

Manual IOC lookups, switching between systems, and moving data between sources all add time to investigations. <\/p>\n\n\n\n

Solution:<\/strong> Integrating ANY.RUN TI Feeds with Elastic Security brings fresh IOCs into alert correlation, prioritization, and detection workflows without requiring analysts to switch between systems.<\/p>\n\n\n\n

Outcome: <\/strong>Faster validation<\/a> of suspicious activity, fewer manual investigation steps, and more analyst capacity for complex cases. <\/p>\n\n\n\n

\n
Explore all ANY.RUN integrations <\/a><\/div>\n<\/div>\n\n\n\n

<\/p>\n\n\n\n

Putting It Into Practice: ANY.RUN Threat Intelligence and Elastic Security <\/h2>\n\n\n
\n
\"\"
ANY.RUN\u2019s TI Feeds integration brings real-world threat intelligence to existing SOC workflows<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n

The Threat Intelligence Feeds integration with Elastic Security brings fresh, high-confidence indicators directly into existing Elastic workflows. This helps teams: <\/p>\n\n\n\n