{
  "id": 17951801,
  "title": "Your New MTTR Shortcut — Introducing Related Threat Context",
  "url": "https://urgent.news/2026/11/03/your-new-mttr-shortcut-introducing-related-threat-context",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-03T10:48:31.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/your-new-mttr-shortcut-introducing-related-threat-context?source=rss"
  },
  "original_language": "en",
  "account": "Streamlining Security Investigations with Related Threat Context\n\nIn the fast-paced world of cybersecurity, every minute counts. To help security analysts triage threats more efficiently, ANY.RUN has introduced Related Threat Context. This powerful new feature reveals valuable intelligence during sandbox analysis, enabling teams to make informed decisions and reduce time-to-triage (MTTR).\n\nThe Problem: Time-Consuming Context Collection\n\nDuring triage, analysts often stumble upon IOCs but lack the necessary context to decide the next steps. They may manually search for related investigations, industry analyses, or ANY.RUN Threat Intelligence, wasting precious time and risking duplicated efforts. This not only slows down the triage process but also increases the risk of overlooking critical details, leading to unnecessary escalations and compromised security.\n\nRelated Threat Context to the Rescue\n\nRelated Threat Context addresses these challenges by surfacing actionable context directly in the Interactive Sandbox. When an IOC is identified, Analysts can immediately access three types of information:\n\n1. Industry Context: Shows whether the IOC has appeared in analyses related to the organization's industry. This helps internal SOCs prioritize indicators that may warrant closer investigation.\n\n2. Team Context: Connects IOCs with previous team sandbox analyses, enabling analysts to reuse existing findings, avoid duplicate investigations, and collaborate with colleagues across shifts.\n\n3. ANY.RUN Threat Intelligence: Highlights when additional intelligence is available and provides a direct path to Threat Intelligence Lookup (TI Lookup). Analysts can explore related samples, malicious infrastructure, and attack behavior from a single, centralized location.\n\nBy providing this context within the sandbox, Related Threat Context accelerates the transition from investigation to enrichment, allowing analysts to make faster, more informed decisions.\n\nThe Benefits: A More Efficient SOC\n\nThe introduction of Related Threat Context delivers numerous advantages to SOC and MSSP teams, including:\n\n1. Greater SOC Efficiency: Teams can prioritize threats faster without relying on constant manual enrichment efforts.\n\n2. Reduced MTTR: Analysts can reach relevant context and make investigation decisions sooner, cutting down on the time spent on each case.\n\n3. Proactive Defense: With greater access to actionable threat intelligence, teams can identify related activity and strengthen their detection and response capabilities.\n\n4. Higher SOC Maturity: A more connected approach to analysis, intelligence, and response fosters a more consistent and scalable SOC operating model.\n\nCutting Time-to-Triage and Accelerating SOC Response\n\nBy implementing Related Threat Context, organizations can shave off up to 21 minutes from their MTTR, significantly improving their security posture. This powerful feature not only reduces the time spent on each investigation but also empowers SOC and MSSP teams to move seamlessly from investigation to response, ultimately bolstering their overall security resilience.\n\nUse Case: Expanding Infrastructural Insights with Related Threat Context\n\nTo illustrate the impact of Related Threat Context, let's examine a real-world scenario involving a phishing campaign. During sandbox analysis, analysts might only uncover part of the infrastructure behind the attack. However, with Related Threat Context, they can quickly expand their picture by connecting the current sample with other scans and initiating further Threat Intelligence investigation.\n\n1. Access Related Analyses: During a sandbox session, click the Related analyses section in the top right corner to view connected malicious scans.\n\n2. Investigate Additional Scans: Select the relevant URL and open it in ANY.RUN Threat Intelligence Lookup to delve deeper into the infrastructure associated with the campaign.\n\n3. Filter and Compare Results: Filter the search results to display only malicious domains, facilitating a more focused investigation. Compare these results with those visible in the original sandbox analysis to identify additional candidates for further examination.\n\n4. Deepen Investigation: Investigate domains like \"ydgjgdbhoa.shifts.icu\" in TI Lookup to uncover more information about their association with Kali365-related activity.\n\nBy leveraging Related Threat Context, security teams can swiftly expand their understanding of the attack infrastructure, enabling more proactive defense measures and ultimately enhancing their overall security posture.",
  "summary": "Discover how ANY.RUN Related Threat Context connects IOCs to team investigations, industry observations, and threat intelligence to speed up SOC triage.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}