Cyber Threat Context for Early Response: Enriching SOC Telemetry with Real-Time Intel from 16K…

An IP address, domain, file hash, or suspicious URL can trigger a detection, but an analyst still needs to understand what it is, whether it is connected to known malicious activity, and what happened around it. The longer it takes to build that context, the longer an alert remains unresolved.

Threat context helps shorten that gap. By enriching telemetry with real-time intelligence and behavioral evidence, security teams can move from "What is this?" to "What should we do next?" much faster.

The Problem with Investigating IOCs in Isolation

Modern SOCs have plenty of telemetry. The problem is that much of it arrives without enough context to support an immediate decision.

SOC telemetry often surfaces individual pieces of evidence: a suspicious IP connection, a potentially malicious URL in an email, or an unusual file detected on an endpoint. None of these signals provides enough information on its own to determine the scope or significance of the activity.

An analyst may need to search several intelligence sources, investigate related infrastructure, check historical activity, and potentially submit the artifact to a sandbox. For a single alert, that may be manageable. Across thousands of alerts, it becomes a significant operational burden.

The challenge becomes even greater for MSSPs, where teams need to maintain consistent investigation quality across multiple customer environments.

The answer is not simply more intelligence — it is context that reaches the analyst at the right point in the workflow.

Identify up to 58% more threats and strengthen your organization's defenses against evasive attacks. Expand Threat Coverage

Real-Time Intelligence Can Give an Alert a Head Start

Not every alert needs to start with a manual investigation. If an IOC has already been observed in malicious activity, that context can be applied as soon as the indicator appears in telemetry.

Threat intelligence feeds make this possible by continuously supplying security teams with known malicious indicators and the context associated with them. When connected to detection systems, they can help identify suspicious IPs, domains, URLs, and other IOCs as they appear, giving analysts an initial assessment before they begin a deeper investigation.

ANY.RUN's Threat Intelligence Feeds (TI Feeds) provide malicious IPs, domains, and URLs enriched with sandbox-based intelligence. The feeds draw on activity from more than 16,000 organizations and 700,000 security professionals, giving SOCs and MSSPs visibility into threats observed beyond their own environments.

That broader visibility can matter when attackers rotate infrastructure quickly. If an endpoint connects to a suspicious domain, the SOC can check it against current intelligence rather than waiting for an analyst to establish its history manually.

TI Feeds can be integrated into existing security infrastructure through API/SDK and STIX/TAXII, including SIEM, TIP, XDR, and other systems. Threat intelligence can therefore become part of the detection workflow rather than a separate destination analysts visit after an alert arrives.

Up to 30% of Malicious IOCs May Already Be in Your Intelligence

ANY.RUN's internal analysis provides a useful indication of how this can work in practice.

Up to 30% of unique malicious IOCs discovered in Interactive Sandbox analyses had already been observed by ANY.RUN and were present in TI Feeds.

That means that when one of those IOCs appears in SOC or MSSP telemetry, the security system can potentially match it against existing intelligence before the analyst manually investigates the associated file or URL in the Sandbox.

This gives security teams an opportunity to identify and prioritize malicious activity earlier.

Get 99% unique, high-confidence IOCs to improve threat visibility across your security stack. Integrate TI Feeds

The value is not just knowing that an IOC is malicious. Existing intelligence can provide a starting point for the investigation: what has been observed, what infrastructure is associated with it, and whether the indicator has appeared in other malicious activity.

Instead of spending the first part of an investigation collecting basic context, analysts can focus on validating impact and deciding what response is appropriate.

Adding Behavioral Context to the Investigation

Threat intelligence can provide valuable context around an indicator, but analysts may still need to understand what a suspicious file, URL, or other artifact actually does. Behavioral analysis adds that evidence by executing the artifact in a controlled environment and capturing the activity it generates.

ANY.RUN's Interactive Sandbox lets analysts investigate suspicious files and websites in isolated environments. Virtual machines start in under 10 seconds, with analysis reports available in around 40 seconds, helping SOCs and MSSPs get behavioral evidence quickly without waiting for a lengthy analysis cycle.

Reports capture processes, network connections, file and registry changes, screenshots, and MITRE ATT&CK techniques, giving analysts a detailed view of the activity behind an alert.

The results can also expand the investigation. A document that launches PowerShell and downloads another payload can reveal new hashes, domains, IPs, or other indicators. A phishing URL can expose redirects, scripts, additional domains, or downloaded files. These findings can then be investigated alongside existing threat intelligence, helping analysts connect individual artifacts to the broader activity.

Investigate Beyond a Single IOC with ANY.RUN's New Related Threat Context

A single IOC can point to activity far beyond the investigation where it was found. An IP address uncovered during sandbox analysis, for example, may have appeared in previous investigations, surfaced in activity targeting your industry, or already been linked to known threats.

ANY.RUN's Related Threat Context brings these connections directly into Interactive Sandbox, giving Enterprise clients access to intelligence from a community of 700,000+ security professionals across 16,000+ organizations to help assess indicators and decide what to investigate next.

View a Sandbox analysis to see Related Threat Context in action

Related Threat Context combines three sources of insight:

• Team Context: See whether your team has investigated the IOC before.
• Industry Context: Check how the IOC appears in activity across your industry.
• ANY.RUN Threat Intelligence: Discover known malicious indicators and related threat activity across the ANY.RUN ecosystem.

MSSPs can access Team Context and ANY.RUN Threat Intelligence to enrich investigations across their workflows, while Industry Context is designed for internal SOCs.

Related Threat Context also helps analysts quickly gauge how familiar an indicator is with "Never Seen Before" and "Commonly Seen" indicators.

When an IOC warrants a closer look, analysts can pivot to Threat Intelligence Lookup to explore it further or consult Threat Intelligence Reports for deeper insight into specific threats and campaigns.

The result: Less time spent chasing context across separate tools and more time understanding what an IOC means for the investigation at hand.

Discover how Related Threat Context can speed up triage in your SOC. See How to Integrate in Your SOC

Better Context Can Reduce Unnecessary Escalation

The more context triage has upfront, the fewer cases need to move to senior analysts. When Tier 1 has access to current intelligence, behavioral evidence, and related investigation context, more cases can be resolved with confidence at the initial level. SOCs and MSSPs using ANY.RUN TI report a 30% reduction in Tier 1-to-Tier 2 escalations.

That does not mean eliminating escalation. It means reserving senior analyst time for cases that genuinely require deeper expertise.

When analyst capacity is under pressure, better context provided by ANY.RUN can reduce the workload on Tier 1, with a 20% decrease in Tier 1 workload.

For security leadership, those improvements translate into more capacity from the existing SOC rather than simply adding more people to handle growing alert volumes.

Connecting the Dots Across an Investigation

One of the strongest benefits of connecting sandboxing and threat intelligence is that the relationship works in both directions.

Threat Intelligence Feeds can identify an IOC discovered in telemetry as something already associated with malicious activity. When Sandbox analysis reveals additional infrastructure or indicators, those findings can be checked against the same intelligence to determine whether they are already known or require further investigation.

This creates a useful feedback loop. A suspicious attachment can lead to a domain, an IP address, additional files, and several ATT&CK techniques. Known indicators can be enriched through TI Feeds, while previously unseen indicators can be investigated further and potentially become valuable intelligence for future detection.

The same findings can then support threat hunting and detection engineering across the environment, helping analysts determine whether they are dealing with an isolated artifact or activity connected to a larger operation.

The investigation becomes iterative rather than linear: telemetry generates indicators, intelligence adds context, and analysis produces new evidence for the next investigation.

Conclusion

Threat context is most valuable when it reaches analysts early enough to influence what happens next. Real-time intelligence can enrich telemetry, sandbox analysis can reveal new evidence, and related context can connect those findings to broader threat activity.

Together, these capabilities reduce the time spent collecting and validating evidence, helping SOCs and MSSPs prioritize faster, investigate more efficiently, and make more confident response decisions.

The goal is simple: Put the right intelligence in front of analysts early enough to change the outcome of an investigation.