ANY.RUN TI Feed

Details

ID	`ANY.RUN TI Feed`
Provider	AnyRun
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/anyrun-sdk:1.0.0.10440656`
Supported Modules	Agentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

Threat Intelligence Feed provide data on the known indicators of compromise: malicious IPs, URLs, Domains

Generate your API key

Please contact your ANY.RUN account manager to get your API key.

Warning

Prefixed API keys and Basic Authentication for TI Feeds will not be supported in future releases.

Configure ANY.RUN Feed in Cortex

Navigate to Settings > Integrations > Servers & Services.
Search for ANY.RUN.
Click Add instance to create and configure a new integration instance.
Insert ANY.RUN TI Feeds API key into the Password parameter.
Please use “ANY.RUN” as username.
Click Test to validate the URLs, token, and connection.

Parameter	Description	Required
Password	Example: WmNfqnpo…2Sjon7mtvm8e	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

anyrun-get-indicators

Receive ANY.RUN Indicators

Base Command

anyrun-get-indicators

Input

Argument Name	Description	Required
collection	ANY.RUN indicator collection type. Supports: full, ip, url, domain. Possible values are: full, ip, url, domain.	Optional
match_type	Filter results based on the STIX object types.	Optional
match_id	IOC identifier.	Optional
match_revoked	Enable or disable receiving revoked feeds in report. Default is False.	Optional
match_version	Filter STIX objects by their object version. Default is last.	Optional
added_after	Receive IOCs after specified date. Format: YYYY-MM-DD.	Optional
modified_after	Receive IOCs after specified date. Format: YYYY-MM-DD.	Required
limit	Number of tasks on a page. Default, all IOCs are included. Default is 100.	Optional

Context Output

There is no context output for this command.

Configuration parameters

credentials — Username. (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
modified_after — Modified after.
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags
feedIncremental — Incremental Feed
tlp_color — Traffic Light Protocol Color

Commands (0)

This integration defines no commands.

Source

AnyRunFeed.py AnyRunFeed_test.py AnyRunFeed.yml AnyRunFeed_description.md

Download History Raw

import pytest
from AnyRunFeed import extract_indicator_data, convert_indicators


@pytest.fixture(scope="module")
def indicators() -> list[dict]:
    indicators = [
        {
            "created": "2022-02-23T07:34:19.000Z",
            "modified": "2025-05-17T20:15:39.130Z",
            "pattern": "[url:value = 'https://some_url']",
        }
    ]

    yield indicators
    del indicators


def test_extract_indicator_data_return_a_valid_type_and_value():
    indicator = {"pattern": "[url:value = 'https://some_url']"}
    assert extract_indicator_data(indicator) == ("url", "https://some_url")


def test_convert_indicators_returns_valid_demisto_indicators(indicators: list[dict]):
    assert convert_indicators(indicators) == [
        {
            "value": "https://some_url",
            "type": "URL",
            "fields": {
                "firstseenbysource": "2022-02-23T07:34:19.000Z",
                "first_seen": "2022-02-23T07:34:19.000Z",
                "modified": "2025-05-17T20:15:39.130Z",
                "last_seen": "2025-05-17T20:15:39.130Z",
                "vendor": "ANY.RUN",
                "source": "ANY.RUN TI Feed",
                "tags": [],
                "publications": [],
            },
        }
    ]


def test_convert_indicators_populates_communitynotes_for_domain_indicators():
    indicators = [
        {
            "created": "2022-02-23T07:34:19.000Z",
            "modified": "2025-05-17T20:15:39.130Z",
            "pattern": "[domain-name:value = 'some_domain.com']",
            "labels": ["malware"],
            "external_references": [
                {"source_name": "ANY.RUN", "url": "https://app.any.run/tasks/some-task-id"},
            ],
        }
    ]

    converted = convert_indicators(indicators)

    assert converted[0]["fields"]["tags"] == ["malware"]
    assert converted[0]["fields"]["publications"] == [
        {
            "title": "ANY.RUN",
            "link": "https://app.any.run/tasks/some-task-id",
            "source": "ANY.RUN TI Feed",
            "timestamp": "2022-02-23T07:34:19.000Z",
        }
    ]
    assert converted[0]["fields"]["communitynotes"] == [
        {
            "notes": "https://app.any.run/tasks/some-task-id",
            "timestamp": "2022-02-23T07:34:19.000Z",
        }
    ]