The "Enrich Case with Threat Intelligence Data - ANY.RUN TI Lookup" workflow template is designed to enhance case management and threat intelligence enrichment processes. It automates the extraction and analysis of observables such as IPs, URLs, hostnames, and file hashes from a case, using ANY.RUN's Threat Intelligence database. By validating and enriching these observables, the workflow provides updated threat verdicts and reputations, adding valuable insights and context to cases. This facilitates more informed decision-making in threat hunting and incident response activities.

Use Cases

Case Management , Threat Hunting , Threat Intelligence Enrichment

Workflow Breakdown

Gets case observables and prompts the analyst to select which to enrich.
Validates that the selected observables are supported types (IPs, URLs, hostnames, file hashes); exits if none qualify.
Loops over each selected observable and invokes a nested ANY.RUN TI Lookup workflow to perform the enrichment per observable.
The nested workflow updates each observable's reputation, sets a threat verdict, and adds a case note with TI summary and a deep-link to ANY.RUN.
Collects all per-observable results into an aggregated array and exits.