The "Enrich Case with URL Analysis in ANY.RUN Sandbox" workflow template is designed to enhance case management and threat intelligence enrichment by automating the analysis of URLs. Triggered from a Torq Case, it submits URLs to the ANY.RUN Sandbox for analysis, retrieves detailed reports, and extracts Indicators of Compromise (IoCs). The workflow updates the case with threat levels, scores, and behavioral tags, and attaches relevant reports and IoCs, streamlining the process of handling phishing and web security alerts.

Use Cases

Case Management , Phishing , Remediate Web Security Alerts , Threat Intelligence Enrichment

Workflow Breakdown

Triggered from a Torq Case via "Run a workflow"; extracts case observables and validates that a URL is present.
Submits the URL to ANY.RUN Sandbox, attaches the live sandbox link to the case, and enters a polling loop until analysis completes.
Retrieves the completed report and extracts IoCs (IPs, URLs, file hashes) from the analysis output.
Updates the matching observable's reputation, attaches a case note with threat level, scores, and behavioral tags, and updates observable enrichment.
If the verdict is malicious or suspicious, runs parallel actions to attach the HTML report and (when IoCs exist) attach an IOC.csv to the case.