This workflow template facilitates threat intelligence enrichment by submitting a file URL to ANY.RUN for dynamic malware analysis. It automates the process of analyzing suspicious files: the workflow starts with the submission of the file URL, then waits for ANY.RUN to complete the analysis, periodically checking the status. Once the analysis is successfully concluded, the workflow extracts the verdict and other relevant output details, which can be utilized for threat assessment and decision-making within security operations.
Use Cases
Threat Intelligence Enrichment
Workflow Breakdown
Submit the URL of the file to ANY.RUN for analysis
Wait for the analysis to complete, periodically check the status until complete
If the analysis was successful, send the verdict with the workflow output.
Vendors
Utils, ANY.RUN
Workflow Output
Analysis information on the file scan from ANY.RUN
Tips
Trigger this workflow as a nested workflow to include file scan analysis to a parent workflow