{"id":7215,"date":"2024-03-05T08:54:03","date_gmt":"2024-03-05T08:54:03","guid":{"rendered":"\/cybersecurity-blog\/?p=7215"},"modified":"2024-09-26T11:27:00","modified_gmt":"2024-09-26T11:27:00","slug":"how-we-built-ti-lookup","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/how-we-built-ti-lookup\/","title":{"rendered":"How We Built Threat Intelligence Lookup"},"content":{"rendered":"\n

Creating a Threat Intelligence Lookup<\/a> platform is something we have wanted to do for years. With over 400,000 analysts using our sandbox, many of whom run public research sessions and share the results of their research, we’re accumulating roughly 600 million IOCs a year in our database. It was clear to us that information could bring immense value to SOC teams. <\/p>\n\n\n\n

Today, we want to raise the curtain a bit and talk about the main milestones (and roadblocks) we hit on the way, as well as the key decisions that shaped the product into what it is today \u2014 and where it’ll go next. <\/p>\n\n\n\n

Learn more about Threat Intelligence Lookup and what it can do<\/a>.<\/p>\n\n\n\n

ImagePath:”powershell” AND CommandLine:”$codigo”<\/figcaption><\/figure>\n\n\n\n

We wanted to link all events within a single sandbox session and make them searchable <\/h2>\n\n\n\n

There were two things we knew: providing a portal to search our database would bring immense value to our users, and we\u2019re the only company that can provide IOCs and events’ filelds extracted from 1.5 million interactive sandbox research sessions, where all events within a single session are linked (even if one event hasn\u2019t directly spawned the other). <\/p>\n\n\n\n

There were also many things we didn\u2019t know: how to make the search functionality as intuitive as our sandbox is, and what do we need to do to make sure everything works at scale? <\/p>\n\n\n\n

We\u2019ve set goals to ourselves: <\/h3>\n\n\n\n

1. Supporting wildcards and operators<\/strong>. Wildcards (*) let you quickly find relevant artifacts by substring (querying “vate” returns \u201cprivateloader\u201d). Operators enable you to narrow down results using AND, OR, and NOT conditions. (Note: You can already use AND, but we\u2019ll add OR and NOT in a future release).  <\/p>\n\n\n\n

2. The search had to be fast<\/strong>. We set a condition: users should receive results in seconds, not minutes. (The final render time we achieved is around 5 seconds). <\/p>\n\n\n\n

3. The UI had to be intuitive<\/strong>. We needed to design a simple and instantly accessible UI where even a first-time user could build a complex query.<\/p>\n\n\n\n\n

\n\n

\nTry Threat Intelligence Lookup
Search for linked IOCs using over 30 fields<\/span> \n<\/p>\n\n\nContact sales\n<\/a>\n<\/div>\n\n\n\n