ANY.RUN & Palo Alto Networks Cortex XSOAR integration

Automate investigations in Cortex XSOAR

Integrate ANY.RUN malware & phishing analysis and threat intelligence with Cortex XSOAR to automate triage, enrich incidents with threat context, and detect emerging threats faster.

Contact sales

Available integrations

Interactive Sandbox

ANY.RUN Interactive Sandbox for Cortex XSOAR

Automate malware and phishing analysis in Cortex XSOAR to reduce manual triage and accelerate incident investigation.

ANY.RUN's Interactive Sandbox integration with Cortex XSOAR

  • Automate file and URL detonation with Cortex XSOAR playbooks, including private Sandbox sessions for sensitive submissions.

  • Automatically enrich incidents with sandbox verdicts, risk scores, and behavioral context.

  • Extract indicators of compromise and sync them with Sentinel Threat Intelligence.

  • Prioritize and classify incidents based on risk and observed behavior.

  • Investigate more threats with less manual work and make faster, evidence-based decisions.

Use cases
Alert triage
Phishing analysis
Malware analysis
Requirements

ANY.RUN Sandbox plan with API access

Related resources
Setup details Blog: Integration overview Joint solution brief
Contact sales

Threat Intelligence

ANY.RUN Threat Intelligence Lookup for Cortex XSOAR

Enrich Cortex XSOAR incidents with threat context to validate suspicious activity, prioritize critical risks faster, and reduce the chance of missed threats.

ANY.RUN Threat Intelligence Lookup integration with Cortex XSOAR

  • Check domains, hashes, IPs, and URLs with ANY.RUN TI Lookup directly from Cortex XSOAR.

  • Run intelligence checks from incidents or through Cortex commands without leaving the existing investigation workflow.

  • Get reputation data, verdicts, and behavioral threat context directly in Cortex XSOAR to support incident triage.

  • Use ANY.RUN alongside other installed threat intelligence sources to validate suspicious indicators.

  • Reduce investigation time and Tier 2 escalations with faster access to threat context.

Use cases
IOC enrichment
Alert validation
Investigation
Requirements

ANY.RUN Threat Intelligence plan with TI Lookup access

Related resources
Setup details Blog: Integration overview Joint solution brief
Contact sales

ANY.RUN Threat Intelligence Feeds for Cortex XSOAR

Bring fresh threat intelligence into Cortex XSOAR to identify emerging threats earlier, strengthen detection coverage, and reduce exposure to malicious activity.

ANY.RUN Threat Intelligence Feeds integration with Cortex XSOAR

  • Receive fresh malicious IPs, domains, and URLs from ongoing real-world malware investigations for timely detection and correlation.

  • Correlate threat intelligence with incoming alerts to identify and prioritize high-risk activity.

  • Use fresh indicators to build detection rules and expand coverage against emerging threats.

  • Automate threat hunting and response workflows with Cortex XSOAR playbooks.

  • Increase detection coverage while reducing the manual workload required to keep defenses up to date.

Use cases
Detection
Threat hunting
Alert correlation
Requirements

ANY.RUN Threat Intelligence plan with TI Feeds access

Related resources
Setup details Blog: Integration overview Joint solution brief
Contact sales

Why integrate ANY.RUN into your SOC/MSSP stack

Eliminate context switching

Keep investigations and decision-making in one place to avoid delays and lost context.

Scale operations efficiently

Handle more threats with the same team by adding ANY.RUN’s capabilities.

Reduce MTTR, meet SLAs

Achieve faster response by unifying your security operations into a single flow.

Other integrations and connectors

Explore more ways to bring ANY.RUN into your security operations for stronger detection, faster triage, and earlier response.

Sandbox
TI Lookup

Splunk SOAR automates incident response and security operations workflows. Accelerate investigations and act on threats faster with ANY.RUN.

Sandbox
TI Feeds

Enhance Microsoft Sentinel with sandbox analysis and curated threat intelligence for faster detection and investigation.

Sandbox
TI Lookup
TI Feeds

SentinelOne Singularity is an AI-powered XDR platform. ANY.RUN integrations help SOC teams investigate and respond faster.

See all integrations

FAQ

What is Cortex XSOAR?
What is included in the ANY.RUN integration for Cortex XSOAR?
How does Cortex XSOAR automate malware analysis with ANY.RUN?
How can I enrich Cortex XSOAR incidents with threat intelligence?
Does ANY.RUN integrate with Cortex XSIAM?
How do ANY.RUN Threat Intelligence Feeds integrate with Cortex XSOAR?
What is required to set up the integration?
Do I need additional infrastructure to use this integration?

Integrate ANY.RUN into Cortex XSOAR workflows

Reach out to request a quote or discuss your specific use case with our sales team, including security and compliance needs.

+1
Choose
I accept ANY.RUN Terms of Use
By submitting the form, I agree to allow ANY.RUN to process my contact information, contact me, and share my details with its partners in accordance with the Privacy Policy.