Question 1

What is SentinelOne Singularity?

Accepted Answer

SentinelOne Singularity is an AI-powered security platform for detecting, investigating, and responding to threats across endpoints and other attack surfaces. Its Hyperautomation capability adds no-code workflows that can automatically enrich alerts and execute response actions based on predefined conditions.

ANY.RUN adds behavioral malware & phishing analysis and real-time threat intelligence to these workflows, helping analysts validate threats and make response decisions with richer context.

Question 2

What ANY.RUN integrations are available for SentinelOne?

Accepted Answer

ANY.RUN provides three capabilities for SentinelOne Singularity: Interactive Sandbox, Threat Intelligence Lookup, and Threat Intelligence Feeds. Sandbox and TI Lookup work through SentinelOne Hyperautomation workflows for automated malware analysis and IOC enrichment, while TI Feeds deliver fresh indicators through SentinelOne’s native STIX/TAXII ingestion mechanism.

Question 3

How does ANY.RUN work with SentinelOne Hyperautomation?

Accepted Answer

ANY.RUN is available in SentinelOne Hyperautomation with ready-made workflows for malware & phishing analysis and threat intelligence enrichment. When an alert matches configured conditions, the workflow can automatically analyze a file or URL in ANY.RUN Interactive Sandbox or check an indicator with TI Lookup. Results are added to the alert Notes, together with a link to the full investigation.

SentinelOne Hyperautomation is a native no-code workflow engine that can trigger directly from alerts and use pre-built templates for common SOC processes.

Question 4

Can analysts continue an ANY.RUN investigation manually?

Accepted Answer

Yes. Automated workflows provide the initial verdict and threat context in SentinelOne Notes, and analysts can follow the included link to the ANY.RUN interface for deeper interactive investigation. This allows teams to automate routine triage while retaining full analyst control for complex cases.

Question 5

How does ANY.RUN improve triage in SentinelOne?

Accepted Answer

ANY.RUN helps SentinelOne analysts reach a verdict faster by automatically checking suspicious files, URLs, hashes, IPs, and domains as part of the alert workflow. Behavioral analysis and threat context are returned to the alert, helping Tier 1 and Tier 2 analysts determine whether a threat is malicious, suspicious, or benign and decide whether to close, escalate, or move to response.

Question 6

Why use ANY.RUN Threat Intelligence with SentinelOne?

Accepted Answer

ANY.RUN Threat Intelligence is generated from live malware and phishing investigations performed across 16,000 organizations, providing fresh and often unique indicators together with behavioral context. Bringing this intelligence into SentinelOne helps SOC teams detect emerging infrastructure earlier, enrich EDR alerts, improve threat hunting, and make faster escalation decisions.

Question 7

What is required to set up the integration?

Accepted Answer

Integrating Interactive Sandbox in your SentinelOne instance requires an active ANY.RUN Sandbox plan with API access, such as Enterprise Suite. You can view plans on this page or request a trial for your team by contacting our sales team.

For the TI Lookup integration, you need an active ANY.RUN Threat Intelligence subscription for the Core or Complete plan. Learn about the plans on this page or request a trial for your team by contacting our sales team.

For the TI Feeds integration, you need an active ANY.RUN Threat Intelligence subscription for the Live or Complete plan. Learn about the plans on this page or request a trial for your team by contacting our sales team.

Question 8

Do I need additional infrastructure to use this integration?

Accepted Answer

No additional infrastructure is required. Interactive sandbox and TI Lookup are cloud-based ANY.RUN services that connect through SentinelOne Hyperautomation, while TI Feeds can use SentinelOne’s existing STIX/TAXII ingestion capability. This lets organizations add automated malware analysis and operational threat intelligence without building a separate analysis or TI pipeline.

ANY.RUN & SentinelOne Singularity integration

Act on threats faster in SentinelOne

Available integrations

Interactive Sandbox

ANY.RUN Interactive Sandbox for SentinelOne

Use cases

Requirements

Threat Intelligence

ANY.RUN Threat Intelligence Lookup for SentinelOne

Use cases

Requirements

ANY.RUN Threat Intelligence Feeds for SentinelOne

Use cases

Requirements

Related resources

Why integrate ANY.RUN into your SOC/MSSP stack

Eliminate context switching

Scale operations efficiently

Reduce MTTR, meet SLAs

Other integrations and connectors

FAQ

What is SentinelOne Singularity?

What ANY.RUN integrations are available for SentinelOne?

How does ANY.RUN work with SentinelOne Hyperautomation?

Can analysts continue an ANY.RUN investigation manually?

How does ANY.RUN improve triage in SentinelOne?

Why use ANY.RUN Threat Intelligence with SentinelOne?

What is required to set up the integration?

Do I need additional infrastructure to use this integration?

Add ANY.RUN to your SentinelOne workflow