Related Threat Context: Cut Time-to-Triage with Actionable Context for Every IOC

During triage, analysts may overlook valuable threat intelligence simply because they don’t know it exists. Previous investigations, related malicious activity, and industry-specific observations could provide the context needed to decide what to investigate next. With Related Threat Context, now available to ANY.RUN Enterprise clients, SOC and MSSP teams can immediately see these connections alongside IOCs found during Interactive Sandbox analysis and explore relevant findings. This helps Tier 1 analysts reduce time-to-triage, identify what deserves closer investigation, and make better-informed decisions about which cases to prioritize or escalate. The Problem: Missing IOC Context Slows Down Triage A Tier 1 analyst investigates a suspicious URL in ANY.RUN Interactive Sandbox. The analysis reveals malicious behavior and several IOCs, but the analyst still needs to decide whether to close the case, investigate further, or escalate it. Relevant context may already exist in previous team investigations, industry-related analyses, or ANY.RUN Threat Intelligence. Yet analysts may spend time searching for it manually or make decisions without knowing it’s available. The result is longer time-to-triage, duplicated investigations, and unnecessary Tier 2 escalations. Related Threat Context makes these connections visible directly in the Sandbox, helping analysts discover useful intelligence earlier and make faster, better-informed decisions. Solution: Accelerating SOC Triage with Related Threat Context When ANY.RUN identifies an IOC during a sandbox analysis, Related Threat Context can surface three types of information. - Industry Context: Shows whether an IOC has appeared in analyses associated with the organization’s industry, helping internal SOCs prioritize indicators that deserve closer investigation. Industry data is anonymized, and a match is an additional signal rather than proof of targeting. This context is unavailable to MSSPs. - Team Context: Connects IOCs with previous team Sandbox analyses, allowing analysts to reuse existing findings, avoid duplicate investigations, and coordinate with colleagues across shifts. - ANY.RUN Threat Intelligence: Shows when additional intelligence is available and provides a direct path to Threat Intelligence Lookup (TI Lookup), where analysts can investigate related samples, malicious infrastructure, and attack behavior. From Analysis to Enrichment Related Threat Context makes the transition from sandbox analysis to enrichment more visible. When an IOC has relevant history in the analyst’s industry, team investigations, or ANY.RUN TI, that context appears directly in the Interactive Sandbox and can guide the next step. In practical terms: Alert → Interactive Sandbox analysis → Related Threat Context → TI enrichment → Decision → Escalation or response SOCs and MSSPs do not need to search threat intelligence first or know in advance that an IOC is worth investigating. They can see when additional context is available and decide whether it is relevant to the case. This also gives the next analyst a clearer starting point, with related investigations and intelligence available instead of having to rebuild the context from scratch. Turning Threat Context into Operational Value The impact of Related Threat Context extends beyond individual investigations. - Greater SOC efficiency: Teams can prioritize threats faster without relying on constant manual enrichment. - Lower MTTR: Analysts can reach relevant context and make investigation decisions sooner. - More proactive defense: Greater access to actionable threat intelligence helps teams identify related activity and strengthen detection and response. - Higher SOC maturity: A more connected approach to analysis, intelligence, and response supports a more consistent and scalable SOC operating model. Use Case #1: Uncover Additional Kali365 Infrastructure with Related Threat Context A sandbox analysis may reveal only part of the infrastructure behind a phishing campaign. Related Threat Context can help SOC and MSSP teams expand that picture by connecting the current sample with other scans and providing a starting point for further TI investigation. To access it, click the Related analyses section in the top right corner of the screen during a sandbox session. Let’s take this Kali365-related investigation, for example. In Related analyses, security teams can see a large number of malicious scans connected through the same URL. Analysts can then select that URL and open it in ANY.RUN Threat Intelligence Lookup to investigate the infrastructure associated with it. To focus the search, the results can be filtered to show only malicious domains. The next step is to compare these results with the domains already visible in the original sandbox analysis. In this case, only register[.]rsvpconnect-events[.]com appeared in the original scan. The other domains were not visible there, making them candidates for further investigation. For example, let’s check ydgjgdbhoa[.]shifts[.]icu in TI Lookup. The search shows that the domain is associated with Kali365-related activity. By following these connections, the analyst discovers additional domains associated with Kali365 that were missing from the original sandbox analysis. This gives Tier 1 concrete evidence to justify further investigation or escalation, rather than passing along the original IOC alone. The newly identified domains can be included in the case for Tier 2 to validate against internal SIEM or EDR telemetry and determine whether the related infrastructure has appeared in the organization’s environment. The outcome: Related Threat Context helps analysts identify the next investigation steps earlier, make better-informed triage decisions, and give Tier 2 a more actionable starting point without repeating the initial research. Use Case #2: Reduce Triage Time by Uncovering the Context Behind a Single IOC See how Related Threat Context helps analysts move from a single IOC to the bigger threat picture. In this example, a malicious IP discovered during a Sandbox analysis leads to related activity in ANY.RUN Threat Intelligence, revealing a recurring JavaScript → PowerShell → .NET delivery chain and giving analysts a clear direction for further investigation. Signals for Prioritization: Never Seen Before and Commonly Seen Related Threat Context also provides ready-made signals that help analysts decide where to focus their attention. Instead of requiring teams to interpret raw historical data themselves, these signals immediately show whether an indicator stands out or is commonly encountered in related activity. - Never Seen Before — the indicator has not appeared in the available related context before. This can signal that a SOC or MSSP is encountering something unusual or unique, making the indicator worth a closer look. - Commonly Seen — the indicator appears frequently across related activity. This can help analysts deprioritize indicators that are widely observed and often represent generic or non-specific activity, such as library loading, widgets, or common network connections. These signals are not verdicts. A Never Seen Before indicator is not automatically malicious, while a Commonly Seen indicator is not automatically harmless. Instead, they give security teams an immediate way to allocate attention and combine historical context with the object’s behavior, verdict, and other available evidence. What Changes for Different SOC Roles with Related Threat Context? The same context provides different value depending on where an analyst sits in the workflow. Triage: Make the Next Decision Faster For triage, Related Threat Context is primarily about answering questions like: Close it? Investigate further? Enrich it in TI? Escalate it? Teams can now make that decision with more evidence available at the point of triage instead of manually reconstructing the threat picture first. | Triage Bottleneck | Context available in Sandbox | Operational Effect | |---|---|---| | Analyst does not know whether the IOC is familiar to the team | Related Team analyses | Reuse previous findings and avoid restarting the investigation from zero | | IOC may have broader relevance to the organization | Industry observations for eligible internal SOCs | Add another signal when deciding which findings deserve closer examination | | Analyst needs more information than the Sandbox session provides | Direct path to related ANY.RUN TI data | Expand the investigation without first performing a separate IOC discovery step | | Tier 1 is uncertain whether escalation is justified | Combined behavioral and related context | Provide a stronger basis for closing, continuing, or escalating the case | Incident Response and Threat Hunting: Start with More Context For deeper investigation teams, the benefit is a better starting point. Related analyses, team knowledge, infrastructure, and TI context can accompany an escalation, allowing the next analyst to spend more time on the investigation itself rather than repeating the enrichment that came before it. SOC Leads and Managers: Make Team Knowledge Reusable As SOC teams grow, analysts on different shifts can encounter the same infrastructure without knowing that someone else has already investigated it. Related Threat Context creates a visible connection between those investigations. The team can compare the previous and current cases, involve the analyst who already has relevant knowledge, and determine whether previous findings were converted into detection, blocking, hunting, or response improvements. CISOs and Heads of SOC: Connect the Security Workflow For security leaders, the value is broader than enrichment. Connected context can support faster triage, fewer escalations caused purely by uncertainty, more focused use of Tier 2 expertise, better reuse of knowledge across shifts, and stronger visibility into activity relevant to the organization’s industry. Conclusion An IOC is rarely the end of an investigation. It can be the starting point for understanding related activity, validating previous findings, or deciding whether a case needs deeper analysis. Related Threat Context makes those connections visible while the analyst is already working in the Interactive Sandbox, helping turn an isolated finding into a more informed next step. The result is a more connected investigation workflow, where sandbox analysis and threat intelligence work together to support faster, better-informed security decisions. About ANY.RUN ANY.RUN provides cybersecurity solutions that help SOC and MSSP teams investigate threats, make faster and more informed decisions, and turn threat intelligence into practical actions across detection, investigation, and response. The company’s solutions include Interactive Sandbox for enterprise malware analysis and ANY.RUN Threat Intelligence with Threat Intelligence Lookup, Threat Intelligence Feeds, and Threat Intelligence Reports. That gives security teams access to continuously updated intelligence derived from live threat analysis. Today, ANY.RUN is trusted by more than 16,000 organizations and 700,000 security professionals worldwide. The company is SOC 2 Type II certified, with security controls designed to protect customer data. FAQ Related Threat Context shows whether IOCs found during an Interactive Sandbox analysis have appeared in previous team investigations, industry-related analyses, or ANY.RUN Threat Intelligence, giving SOCs and MSSPs additional context. Related Threat Context is available to ANY.RUN Enterprise clients. Internal SOCs can access industry, team, and ANY.RUN TI context, while MSSPs can use team and ANY.RUN TI context. Related Threat Context provides three types of context: Industry Context, Team Context, and ANY.RUN Threat Intelligence. Together, they show whether an IOC has appeared in relevant industry activity, previous team analyses, or broader TI data. No. Related Threat Context provides additional evidence for investigation and prioritization, but analysts still need to consider the IOC’s behavior, verdict, and other available evidence. An industry match shows that an IOC has appeared in analyses associated with the organization’s industry. It is an additional signal, not proof that the threat is targeting that industry or a specific victim. Never Seen Before means the IOC has not previously appeared in the available related context. Commonly Seen means it has appeared frequently. Neither signal is a verdict on its own. Yes. By surfacing relevant context directly in the Sandbox, it helps analysts make faster decisions about whether to close, investigate, enrich in TI, or escalate a case. Yes. SOC and MSSP analysts can follow connections from a Sandbox IOC into Threat Intelligence Lookup to investigate related domains, samples, infrastructure, and activity that may not have been visible in the original analysis. 0 comments