The "Analyze URLs with ANY.RUN Sandbox" workflow template is designed to enhance web security and threat intelligence by automating the analysis of URLs. By submitting a URL to the ANY.RUN Sandbox, users receive a comprehensive JSON report that includes a verdict, extracted Indicators of Compromise (IoCs), and an enrichment summary. This workflow is ideal for functions such as phishing detection and remediation of web security alerts, providing valuable insights for threat intelligence enrichment.

Use Cases

Function , Phishing , Remediate Web Security Alerts , Threat Intelligence Enrichment

Workflow Breakdown

Workflow accepts a URL as an input parameter.
The URL is submitted to the ANY.RUN Sandbox for a new analysis.
The completed analysis report is retrieved and a sandbox summary is generated.
Indicators of Compromise (IPs, URLs, file hashes) are extracted from the analysis.
A final enrichment summary is produced, combining the report details with the extracted IoCs as the workflow output.