ANY.RUN adds automated threat context to SentinelOne workflows

ANY.RUN has launched a native integration with SentinelOne that pushes malware analysis and threat intelligence into the Singularity platform for faster alert validation. The move is aimed at cutting false positives, reducing manual triage and helping SOC teams and MSSPs respond faster.

Why it matters: - The integration gives SOC teams and MSSPs faster context on alerts, which can reduce time spent on false positives and manual triage. - Security teams get verdicts and enrichment inside their endpoint workflow, which can speed decisions during active investigations.

What happened: - ANY.RUN announced a native integration with SentinelOne on September 28, 2026, in Dubai. - The integration combines ANY.RUN’s malware analysis and threat intelligence with SentinelOne’s Singularity Platform. - The workflow is designed to help defenders validate high-priority alerts with threat context in real time.

The details: - Security teams can use automated orchestration rules inside SentinelOne to remove manual triage steps. - The playbooks cross-reference suspicious files, URLs and indicators against known malicious behavior. - Analysts receive threat verdicts, malware family classification and indicator infrastructure details inside the SentinelOne incident log. - ANY.RUN’s Interactive Sandbox and Threat Intelligence feed the enrichment data into the platform. - The company says the workflow is intended to accelerate response times and reduce the operational burden on security teams. - The integration is positioned to standardize enrichment so every alert is backed by the same threat intelligence. - The approach is meant to help junior analysts work with more consistent evidence.

Between the lines: - The launch reflects a broader push to move threat analysis closer to the primary SOC console, where analysts already work. - Automated enrichment can matter most when alert volume is high and teams need faster first-pass decisions. - The focus on Tier 1 automation suggests the biggest gain is freeing staff for deeper hunting and higher-value investigations.

What's next: - ANY.RUN directs users to its Cybersecurity Blog for getting started information. - The companies are likely to position the integration as part of a broader effort to automate alert validation and reduce investigation friction.

The bottom line: - ANY.RUN is pushing threat intelligence directly into SentinelOne so analysts can get faster verdicts without leaving their main workflow.