ANY.RUN TI Feed

Threat Intelligence Feeds provide data on the known indicators of compromise such as malicious IPs, URLs, Domains.

Data Enrichment & Threat Intelligence · ANY.RUN · Feed

Details

ID	`ANY.RUN TI Feed`
Provider	AnyRun
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/anyrun-sdk:1.0.0.10440656`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Threat Intelligence Feed provide data on the known indicators of compromise: malicious IPs, URLs, Domains

Generate your API key

Please contact your ANY.RUN account manager to get your API key.

Warning

Prefixed API keys and Basic Authentication for TI Feeds will not be supported in future releases.

Configure ANY.RUN Feed in Cortex

Navigate to Settings > Integrations > Servers & Services.
Search for ANY.RUN.
Click Add instance to create and configure a new integration instance.
Insert ANY.RUN TI Feeds API key into the Password parameter.
Please use “ANY.RUN” as username.
Click Test to validate the URLs, token, and connection.

Parameter	Description	Required
Password	Example: WmNfqnpo…2Sjon7mtvm8e	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

anyrun-get-indicators

Receive ANY.RUN Indicators

Base Command

anyrun-get-indicators

Input

Argument Name	Description	Required
collection	ANY.RUN indicator collection type. Supports: full, ip, url, domain. Possible values are: full, ip, url, domain.	Optional
match_type	Filter results based on the STIX object types.	Optional
match_id	IOC identifier.	Optional
match_revoked	Enable or disable receiving revoked feeds in report. Default is False.	Optional
match_version	Filter STIX objects by their object version. Default is last.	Optional
added_after	Receive IOCs after specified date. Format: YYYY-MM-DD.	Optional
modified_after	Receive IOCs after specified date. Format: YYYY-MM-DD.	Required
limit	Number of tasks on a page. Default, all IOCs are included. Default is 100.	Optional

Context Output

There is no context output for this command.

Configuration parameters

credentials — Username. (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
modified_after — Modified after.
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags
feedIncremental — Incremental Feed
tlp_color — Traffic Light Protocol Color

Commands (0)

This integration defines no commands.

Source

AnyRunFeed.py AnyRunFeed_test.py AnyRunFeed.yml AnyRunFeed_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: AnyRun
sectionorder:
- Connect
- Collect
commonfields:
  id: ANY.RUN TI Feed
  version: -1
configuration:
- display: Username.
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- display: 'Use system proxy settings'
  name: proxy
  type: 8
  required: false
  section: Connect
- display: 'Modified after.'
  name: modified_after
  defaultvalue: 2025-01-01
  type: 0
  required: false
  additionalinfo: Receive IOCs after specified date.
  section: Collect
- display: 'Fetch indicators'
  name: feed
  defaultvalue: 'true'
  type: 8
  required: false
  section: Collect
- display: 'Indicator Reputation'
  name: feedReputation
  defaultvalue: Bad
  type: 18
  required: false
  options:
  - 'None'
  - 'Good'
  - 'Suspicious'
  - 'Bad'
  section: Collect
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
- display: 'Source Reliability'
  name: feedReliability
  type: 15
  required: false
  section: Collect
  defaultvalue: A - Completely reliable
  options:
  - 'A - Completely reliable'
  - 'B - Usually reliable'
  - 'C - Fairly reliable'
  - 'D - Not usually reliable'
  - 'E - Unreliable'
  - 'F - Reliability cannot be judged'
  additionalinfo: 'Reliability of the source providing the intelligence data'
- display: ""
  name: feedExpirationPolicy
  defaultvalue: "never"
  type: 17
  required: false
  section: Collect
  options:
  - never
  - interval
  - indicatorType
- display: ""
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- name: feedFetchInterval
  display: 'Feed Fetch Interval'
  type: 19
  section: Collect
  defaultvalue: "120"
  required: false
- display: 'Bypass exclusion list'
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
  additionalinfo: 'When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.'
  defaultvalue: 'false'
- name: feedTags
  display: Tags
  type: 0
  section: Collect
  additionalinfo: Supports CSV values.
- additionalinfo: Whether the feed should pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  defaultvalue: 'true'
  display: Incremental Feed
  hidden: true
  name: feedIncremental
  type: 8
  section: Collect
  required: false
- display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
description: Threat Intelligence Feeds provide data on the known indicators of compromise such as malicious IPs, URLs, Domains.
display: ANY.RUN TI Feed
name: ANY.RUN TI Feed
script:
  dockerimage: demisto/anyrun-sdk:1.0.0.10440656
  subtype: python3
  runonce: false
  script: '-'
  type: python
  feed: true
tests:
- No tests
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam