Every day, dozens of malicious indicators—URLs, file hashes, network artifacts—crop up in one organization only to later appear somewhere else. A recent investigation by ANY.RUN into over 16,000 security operation center (SOC) teams reveals that ~30% of unique indicators of compromise (IOCs) found in sandbox investigations had already been captured in threat intelligence feeds prior to their official investigation. In practice, this means nearly one in three threats your SOC only just started investigating were already known elsewhere in your broader security community.
Why This Discovery Is Crucial for SOCs
This insight shows that threat intelligence sources are not just a ‘nice to have’—they offer real potential to speed up detection. If an IOC has already been linked to malicious behavior outside your environment, integrating that intelligence into your detection tools—SIEMs, SOARs, EDRs or XDRs—can allow you to spot attacks much earlier. Rather than waiting for confirmation, your systems may already have the signal hidden in network traffic or endpoint logs.
How Integrated Threat Intelligence Works in Practice
Integrated threat feeds, like those used in research from ANY.RUN’s sandbox investigations, don’t require retooling your SOC from scratch. Standard formats like STIX/TAXII and APIs enable seamless connection to the tools already in place. As one team collects telemetry, this shared intelligence harnesses collective investigations—now from more than 16,000 SOCs and over 700,000 security professionals—to populate the feed with fresh, high-confidence malicious IOCs and enrich investigations across dozens of environments.
These feeds allow for: earlier detection via correlation with known threats; smarter alert triage by enriching raw data with context; reduced manual overhead so analysts can spend more time on behavior analysis and less on basic IOC lookup; and more consistent workflows regardless of who’s on shift.
The IOCs being shared are claimed to be 99% unique—meaning they often aren’t found in other public or commercial intelligence sources. And when more visibility becomes available—where else an IOC has appeared, which infrastructure it is tied to, which campaigns it relates—the value compounds: each SOC doesn’t just get raw data but actionable context.
What Your SOC Should Do Now
Start by reviewing where your existing threat intelligence comes from. Are you already pulling in feeds from sandboxes or peer-case investigations? If not, connecting to external TI (threat intelligence) feeds could uncover threats your internal systems haven’t flagged yet. Also evaluate whether your tools support STIX/TAXII or API–based intelligence sharing.
Integrate threat feed data into detection pipelines and alert triage processes. Use it not just in after-action remediation, but proactively: any observed IOC matching a known malicious indicator should trigger faster alarms or deeper review. Prioritize, automate, and normalize that process.
Also take note: threat intelligence doesn’t replace investigation—it enhances it. Analysts will still need to validate, contextualize, and respond. But with reliable IOCs at hand, many investigations start already partially solved.
By leveraging what’s already known—in public and shared intelligence—your SOC can detect, prioritize, and respond to threats faster and with more confidence.
