During triage, analysts may overlook valuable threat intelligence simply because they don’t know it exists. Previous investigations, related malicious activity, and industry-specific observations could provide the context needed to decide what to investigate next. <\/p>\n\n\n\n
With Related Threat Context<\/strong>, now available to ANY.RUN Enterprise<\/a> clients, SOC and MSSP teams can immediately see these connections alongside IOCs found during Interactive Sandbox analysis and explore relevant findings. This helps Tier 1 analysts reduce<\/strong> time-to-triage<\/strong><\/a>, identify what deserves closer investigation, and make better-informed decisions about which cases to prioritize or escalate.<\/strong> <\/p>\n\n\n\n A Tier 1 analyst investigates a suspicious URL in ANY.RUN Interactive Sandbox<\/a>. The analysis reveals malicious behavior and several IOCs, but the analyst still needs to decide whether to close the case, investigate further, or escalate it. <\/p>\n\n\n\n Relevant context may already exist in previous team investigations, industry-related analyses, or<\/strong> ANY.RUN Threat Intelligence<\/strong><\/a>.<\/strong> Yet analysts may spend time searching for it manually or make decisions without knowing it’s available. <\/p>\n\n\n\n The result is longer time-to-triage, duplicated investigations, and unnecessary Tier 2 escalations.<\/strong> <\/p>\n\n\n\n Related Threat Context makes these connections visible directly in the Sandbox, helping analysts discover useful intelligence earlier and make faster, better-informed decisions<\/a>. <\/p>\n\n\n\n When ANY.RUN identifies an IOC during a sandbox analysis, Related Threat Context can surface three types of information. <\/p>\n\n\n\n Related Threat Context makes the transition from sandbox analysis to enrichment more visible. When an IOC has relevant history in the analyst’s industry, team investigations, or ANY.RUN TI<\/a>, that context appears directly in the Interactive Sandbox<\/a> and can guide the next step. <\/p>\n\n\n\n In practical terms: <\/p>\n\n\n\n Alert \u2192 Interactive Sandbox analysis \u2192 Related Threat Context \u2192 TI enrichment \u2192 Decision \u2192 Escalation or response<\/strong> <\/p>\n\n\n\n SOCs<\/a> and MSSPs<\/a> do not need to search threat intelligence first or know in advance that an IOC is worth investigating. They can see when additional context is available and decide whether it is relevant to the case. <\/p>\n\n\n\n This also gives the next analyst a clearer starting point, with related investigations and intelligence available instead of having to rebuild the context from scratch. <\/p>\n\n\n\n The impact of Related Threat Context extends beyond individual investigations. <\/p>\n\n\n\nThe Problem: Missing IOC Context Slows Down Triage <\/h2>\n\n\n\n
Solution: Accelerating SOC Triage with Related Threat Context <\/h2>\n\n\n\n
\n
\n
\n
From Analysis to Enrichment <\/h3>\n\n\n\n
Turning Threat Context into Operational Value <\/h3>\n\n\n\n
\n
\n
\n
\n