ANY.RUN Threat Intelligence Feeds deliver newly observed indicators through STIX/TAXII, API, and SDK. The intelligence is drawn from sandbox investigations submitted by a global community, with each IOC linked to its session for full context. These feeds support alert enrichment, retrospective searches, and blocking decisions in SIEM, SOAR, TIP, and firewalls.