ANY.RUN Task
Overview
ANY.RUN Interactive Sandbox connector permits to detonate files and URLs in a cloud sandbox, returning detailed behavioral reports with network activity, dropped files, and MITRE ATT&CK mappings.
ANY.RUN's Interactive Sandbox is a cloud-based service that provides SOC teams with a simple way to analyze cyber threats, enabling rapid threat intelligence and deep analysis in a secure environment.
This connector enables OpenCTI users to submit files and URLs for real-time analysis in the cloud sandbox. It returns detailed reports including network activity, dropped files, and MITRE ATT&CK technique mappings, enriching observables directly within OpenCTI.
Key benefits: • Streamlined Triage and Detection: Automate threat analysis to receive actionable verdicts and prioritize incidents effectively • Shorter MTTD and MTTR: Gain a full understanding of threat behavior in seconds • Higher Detection Rates: Deep visibility into complex threats through advanced detection mechanisms • Minimized Workload: Reduce analyst workload by automating repetitive analysis tasks • Stronger Security: Use sandbox reports to refine rules, update playbooks, and train detection models