{"id":7901,"date":"2024-06-03T08:42:31","date_gmt":"2024-06-03T08:42:31","guid":{"rendered":"\/cybersecurity-blog\/?p=7901"},"modified":"2024-06-03T08:47:20","modified_gmt":"2024-06-03T08:47:20","slug":"technical-ti-use-case","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/","title":{"rendered":"What is a Common Use Case for Technical Threat Intelligence"},"content":{"rendered":"\n<p>Of the 4 levels of threat intelligence (strategic, operational, tactical, and technical), technical TI is at the bottom of the pyramid \u2014 but it&#8217;s no less important than the rest. \u00a0<\/p>\n\n\n\n<p>That&#8217;s because it helps SOC teams configure the security systems that are the first line of defense against known and emerging threats.&nbsp; &nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is Technical Threat Intelligence? &nbsp;<\/h2>\n\n\n\n<p>Technical Threat Intelligence focuses on indicators of immediate compromise like bad IP addresses or domains.&nbsp;<\/p>\n\n\n\n<p>This data is typically machine-readable. Systems like TIP, SIEM, IDS\/IPS and EDR can ingest and operationalize it, and SOC teams can then create new security rules or enrich existing ones. &nbsp;&nbsp;<\/p>\n\n\n\n<p>All popular security solutions can read technical TI data because they use a common format for sharing threat information \u2014 STIX.<\/p>\n\n\n\n<p>Here is an example of a technical threat intelligence data object from ANY.RUN\u2019s TI feeds:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{   \n\n  \"type\": \"ipv4-addr\",   \n\n  \"id\": \"ipv4-addr--8c851c0c-ee42-5e7e-af06-f849efc0ffb4\",   \n\n  \"value\": \"194.104.136.5\",   \n\n  \"created\": \"2022-04-20T15:05:54.181Z\",   \n\n  \"modified\": \"2024-02-19T11:21:47.728Z\",   \n\n  \"external_references\": &#91;   \n\n    {   \n\n      \"source_name\": \"ANY.RUN task c761d29c-a02a-4666-bc34-b89c4aab5cd1\",   \n\n      \"url\": \"https:\/\/app.any.run\/tasks\/c761d29c-a02a-4666-bc34-b89c4aab5cd1\"   \n\n    }  \n\n  ],   \n\n  \"labels\": &#91;   \n\n    \"RedLine\"   \n\n  ]   \n\n} <\/code><\/pre>\n\n\n\n<p>STIX is essentially JSON that&#8217;s been modified to better build connections between data elements likened indicators, tactics, techniques, and threat actors.\u00a0<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n\nGet a free sample of <span class=\"highlight\">ANY.RUN\u2019s TI Feed<\/span>&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/intelligence.any.run\/feeds\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=technical_ti_use_case&#038;utm_term=030624&#038;utm_content=linktofeeds\/\" rel=\"noopener\" target=\"_blank\">\nTry it free\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">What are common use cases for technical threat intelligence?&nbsp;<\/h2>\n\n\n\n<p>Technical TI revolves around collecting, analyzing, and disseminating threat data, which comes from TI Feeds and malware analysis sessions. &nbsp;<\/p>\n\n\n\n<p>This data includes:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IP Addresses.&nbsp;<\/li>\n\n\n\n<li>Malicious domain names.&nbsp;<\/li>\n\n\n\n<li>File hashes.&nbsp;<\/li>\n\n\n\n<li>System events (like command lines).&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Here\u2019s how different security teams use this data:&nbsp;<\/p>\n\n\n\n<p><strong>SOC analysts <\/strong>can load threat intel feeds into their SIEM and IDS\/IPS to identify attacks in real-time. When the systems detect a known bad IP connecting to the network, analysts can immediately block it and investigate further.&nbsp;<\/p>\n\n\n\n<p><strong>Incident responders<\/strong> use threat intel reports to quickly identify the root cause of a breach. For example, they can look up the specific servers a malware connects to, block those IPs in their firewalls, and scan the network for any compromised devices communicating with those addresses.&nbsp;<\/p>\n\n\n\n<p><strong>Vulnerability managers <\/strong>use threat intel to prioritize patching. They focus on vulnerabilities that are actively being exploited in the wild based on threat reports, rather than trying to patch everything at once. This helps them fix the most critical issues first and reduce risk more efficiently.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Where does technical TI data come from?&nbsp;<\/h2>\n\n\n\n<p>Technical TI data comes from threat feeds and malware analysis sessions, both manual and in sandboxes:\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"566\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-1024x566.png\" alt=\"\" class=\"wp-image-7903\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-1024x566.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-300x166.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-768x425.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-1536x849.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-2048x1132.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-370x205.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-270x149.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image-740x409.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Get technical TI data from <a href=\"https:\/\/intelligence.any.run\/feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=technical_ti_use_case&amp;utm_term=030624&amp;utm_content=linktofeeds\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN\u2019s threat intelligence feeds<\/a><\/figcaption><\/figure><\/div>\n\n\n<p><strong>TI feeds<\/strong> provide a stream of real-time data about new and emerging malware from an external source and plug into SIEM and TIP systems to constantly update them with new indicators. &nbsp;&nbsp;<\/p>\n\n\n\n<p><strong>Sandbox analysis sessions<\/strong> allow analysts to place and run malware in a controlled environment, while the malware sandbox collects and records all system events related to its activity. Analysts can then access this data through reports.\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"565\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-1024x565.png\" alt=\"\" class=\"wp-image-7904\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-1024x565.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-300x166.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-768x424.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-1536x848.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-2048x1130.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-370x204.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-270x149.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image2-740x408.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Sandbox analysis in ANY.RUN is an effective way to collect technical TI data<\/figcaption><\/figure><\/div>\n\n\n<p>The screenshot above shows an IOC report that the <a href=\"http:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=technical_ti_use_case&amp;utm_term=030624&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN sandbox<\/a> provides after running a malicious file. You can see what other information is available by going to <a href=\"https:\/\/app.any.run\/tasks\/15567773-ecef-4b04-a12f-2f4a3a469cf0\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=technical_ti_use_case&amp;utm_term=030624&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">this link<\/a>.\u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Using technical TI to collect threat data&nbsp;<\/h2>\n\n\n\n<p>With services like <a href=\"https:\/\/intelligence.any.run\/analysis\/lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=technical_ti_use_case&amp;utm_term=030624&amp;utm_content=linktolookup\" target=\"_blank\" rel=\"noreferrer noopener\">TI Lookup<\/a>, security teams can get a holistic understanding of the threat they\u2019re dealing with. For example, if a security team member notices unusual DNS connections to an IP they don&#8217;t recognize, they can use ANY.RUN&#8217;s Threat Intelligence Lookup to quickly query that IP address. \u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"565\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-1024x565.png\" alt=\"\" class=\"wp-image-7905\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-1024x565.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-300x166.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-768x424.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-1536x847.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-2048x1130.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-370x204.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-270x149.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/06\/image3-740x408.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">\u00a0Collect related threat data in ANY.RUN\u2019s TI Lookup<\/figcaption><\/figure><\/div>\n\n\n<p>ANY.RUN will provide more related evidence, like domain names, file hashes and ports \u2014 along with tactical intelligence: associated malware families and TTPs. With that information, you can determine if this is an intrusion and take steps to contain and remediate it.\u00a0<\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n\nTry the full power of <span class=\"highlight\">ANY.RUN TI Lookup<\/span>&nbsp;\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/intelligence.any.run\/plans\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=technical_ti_use_case&#038;utm_term=030624&#038;utm_content=linktoplans\/\" rel=\"noopener\" target=\"_blank\">\nTry it free\n<\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p>SOC teams operationalize this data to monitor system and network logs, automatically detecting and alerting entries that match known threat intelligence indicators. \u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN\u00a0\u00a0<\/h2>\n\n\n\n<p>ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">TI Lookup<\/a>, <a href=\"https:\/\/any.run\/cybersecurity-blog\/yara-search\/\" target=\"_blank\" rel=\"noreferrer noopener\">Yara Search<\/a>, and <a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-intelligence-feeds\/\" target=\"_blank\" rel=\"noreferrer noopener\">Feeds<\/a>, help you find IOCs or files to learn more about the threats and respond to incidents faster.\u00a0\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Advantages of ANY.RUN&nbsp;&nbsp;<\/h3>\n\n\n\n<p>ANY.RUN helps you analyze threats faster while improving detection rates. The platform detects common malware families with YARA and Suricata rules and identifies malware behavior with signatures when detection by family is not possible.&nbsp;<\/p>\n\n\n\n<p><strong>With ANY.RUN you can:<\/strong>&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detect malware in under 40s.&nbsp;<\/li>\n\n\n\n<li>Interact with samples in real time.&nbsp;<\/li>\n\n\n\n<li>Save time and money on sandbox setup and maintenance&nbsp;<\/li>\n\n\n\n<li>Record and study all aspects of malware behavior.&nbsp;<\/li>\n\n\n\n<li>Collaborate with your team&nbsp;<\/li>\n\n\n\n<li>Scale as you need.\u00a0<\/li>\n<\/ul>\n\n\n\n<p>Try the full power of ANY.RUN for free&nbsp;<\/p>\n\n\n\n<p><a href=\"https:\/\/any.run\/demo\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=technical_ti_use_case&amp;utm_term=030624&amp;utm_content=linktodemo\" target=\"_blank\" rel=\"noreferrer noopener\">Request free trial \u2192\u00a0<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Of the 4 levels of threat intelligence (strategic, operational, tactical, and technical), technical TI is at the bottom of the pyramid \u2014 but it&#8217;s no less important than the rest. \u00a0 That&#8217;s because it helps SOC teams configure the security systems that are the first line of defense against known and emerging threats.&nbsp; &nbsp; What [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":7907,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[57,10,34],"class_list":["post-7901","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifehacks","tag-anyrun","tag-cybersecurity","tag-malware-analysis"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What is a Common Use Case for Technical Threat Intelligence - ANY.RUN&#039;s Cybersecurity Blog<\/title>\n<meta name=\"description\" content=\"Learn how technical threat intelligence is used in organizations and see a real-world case of how technical TI is collected.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"What is a Common Use Case for Technical Threat Intelligence\",\"datePublished\":\"2024-06-03T08:42:31+00:00\",\"dateModified\":\"2024-06-03T08:47:20+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/\"},\"wordCount\":836,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\"],\"articleSection\":[\"Cybersecurity Lifehacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/\",\"name\":\"What is a Common Use Case for Technical Threat Intelligence - ANY.RUN&#039;s Cybersecurity Blog\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2024-06-03T08:42:31+00:00\",\"dateModified\":\"2024-06-03T08:47:20+00:00\",\"description\":\"Learn how technical threat intelligence is used in organizations and see a real-world case of how technical TI is collected.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Lifehacks\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What is a Common Use Case for Technical Threat Intelligence\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is a Common Use Case for Technical Threat Intelligence - ANY.RUN&#039;s Cybersecurity Blog","description":"Learn how technical threat intelligence is used in organizations and see a real-world case of how technical TI is collected.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"What is a Common Use Case for Technical Threat Intelligence","datePublished":"2024-06-03T08:42:31+00:00","dateModified":"2024-06-03T08:47:20+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/"},"wordCount":836,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["ANYRUN","cybersecurity","malware analysis"],"articleSection":["Cybersecurity Lifehacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/","url":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/","name":"What is a Common Use Case for Technical Threat Intelligence - ANY.RUN&#039;s Cybersecurity Blog","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2024-06-03T08:42:31+00:00","dateModified":"2024-06-03T08:47:20+00:00","description":"Learn how technical threat intelligence is used in organizations and see a real-world case of how technical TI is collected.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/technical-ti-use-case\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Lifehacks","item":"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/"},{"@type":"ListItem","position":3,"name":"What is a Common Use Case for Technical Threat Intelligence"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/7901"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=7901"}],"version-history":[{"count":3,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/7901\/revisions"}],"predecessor-version":[{"id":7910,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/7901\/revisions\/7910"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/7907"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=7901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=7901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=7901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}