ANY.RUN

This integration allows you to automate suspicious file and URL analysis with ANY.RUN Interactive Sandbox to reach verdicts faster, and enrich indicators with actionable context from ANY.RUN TI Lookup within Splunk SOAR workflows. Use cases: 1. Automated Sandbox Analysis: Detonate suspicious files and URLs using individual Splunk SOAR Actions or as part of automated playbooks. Retrieve verdicts and analysis results directly within the investigation workflow. 2. IOC Enrichment & Reputation Checks: Enrich hashes, IPs, domains, and URLs with threat context and quickly check URL and IP reputation. 3. Reporting & IOC Extraction: Retrieve detailed analysis reports and extract IOCs for further investigation and automated response actions. 4. Advanced Threat Hunting: Query ANY.RUN Threat Intelligence for indicators, related infrastructure, and MITRE ATT&CK techniques to investigate related threats. 5. Interactive Investigation: Open ANY.RUN sessions to interact with samples and investigate malicious behavior in depth. This integration helps SOC teams: 1. Accelerate threat validation: Get Sandbox verdicts and threat context faster within Splunk SOAR workflows. 2. Reduce manual work: Automate analysis, enrichment, and IOC extraction through SOAR playbooks. 3. Improve investigation quality: Combine behavioral analysis, detailed reports, and threat intelligence for more informed decisions. 4. Streamline response: Turn analysis results and extracted IOCs into actionable data for investigation and response workflows.