How SOC Teams Improve Mean Time to Detect and Other KPIs with Threat Intelligence Feeds

/in

Security Operations Centers (SOCs) are under constant pressure to detect threats faster, respond more effectively, and reduce operational noise. Metrics like Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), False Positive Rate (FPR), and True Positive Rate (TPR) are more than just numbers — they define the health and impact of a business security posture. 

Threat intelligence feeds — curated, real-time data streams about emerging threats, vulnerabilities, and attacker tactics — play a pivotal role in optimizing these metrics hence SOCs’ performance. By integrating high-quality solutions, like ANY.RUN’s TI Feeds, teams can improve efficiency, accuracy, and proactive defense. 

1. Reducing Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) 

MTTD measures the average time taken to identify a security incident. Threat intelligence feeds provide real-time indicators of compromise (IOCs) such as malicious IP addresses, domains, or file hashes. By correlating these IOCs with network and endpoint data, SOCs can detect threats faster. Tools like SIEMs and EDRs use feeds to match artifacts against known malicious signatures in real time. 

MTTR tracks the time from detection to containment or resolution. Threat intelligence feeds enhance response by enabling automation and faster decision-making. 

As a result, known threats get detected immediately, not after hours of investigation, and analysts get context-rich alerts (e.g., malware family, MITRE technique), speeding up triage. 

ANY.RUN’s TI Feeds contain IOCs from real-world attack investigations across 15,000 companies. Namely:  

  • IP addresses. Digital markers of cybercriminal operations, often linked to Command-and-Control (C2) servers or phishing campaigns. 
  • Domains. Often used as staging points for cyberattacks. Domains provide a higher-level view of malicious activity, often connecting multiple IPs or malware instances within a single campaign. 
  • URLs. By link analysis, cybersecurity teams can uncover attack patterns, block harmful traffic, and prevent unauthorized access to systems and data. 
  • Port indicators (additional) offering insights into malicious connections. File hashes (additional) that help to identify and assess dangerous files.

Besides, ANY.RUN’s TI feeds provide detailed context on the indicators that enriches information and helps to assess the impact of each IOC. The contextual data includes:

  • External references: Links to relevant sandbox analyses of malware samples that let users observe an attack in detail and elements and extract actionable data about threat behaviors and adversary TTPs. 
  • Label: Name of the malware family or campaign. 
  • Detection timestamps: “Created” and “Modified” dates provide a timeline to understand if a threat is ongoing or historical. 
  • Related objects: File hashes and network indicators related to the indicator in question. 
  • Score: Value representing the severity level of the IOC. 

Request access to Threat Intelligence Feeds
and start improving SOC KPIs 



Reach out to us


2. Lowering False Positive Rate 

A high false positive rate overwhelms analysts with irrelevant alerts, reducing efficiency. Threat intelligence feeds improve alert accuracy by filtering out benign activity and prioritizing high-fidelity threats. 

TI Feeds validate alerts against known threat patterns. For example, a feed might confirm a suspicious IP as part of a botnet, reducing time spent investigating false positives. 

Fewer false positives streamline triage, allowing analysts to focus on genuine threats and improving overall SOC productivity. Some teams also measure Alert Fatigue Index as a ratio of irrelevant alerts to total alerts to evaluate employee burnout risk — TI Feeds help lower this risk as well.  

Understanding the severity of incidents (low, medium, high, critical) also helps SOCs allocate resources effectively. Threat intelligence feeds provide data to classify incidents accurately, prioritize high-impact threats, and improve incident management efficiency. 

3. Enhancing Threat Hunting Success Rate 

Proactive threat hunting — searching for threats before alerts are triggered — is a key SOC capability. Indicators provided by threat intelligence feeds help threat hunters build hypotheses and stay on top of emerging campaigns with freshly exposed IOCs linked to specific threats. Relevant sandbox sessions reveal TTPs, like specific phishing email patterns or command-and-control (C2) behaviors, guiding hunters to uncover hidden threats. For example, such analysis may highlight a new C2 protocol, prompting the search for matching network traffic. 

Targeted hunts increase the success rate of identifying threats proactively, reducing dwell time and preventing escalation. 

4. Reducing Dwell Time 

Dwell time, critical for measuring real-world SOC effectiveness, gauges how long a threat remains undetected in the environment. Threat intelligence feeds enhance visibility into stealthy threats, such as low-and-slow attacks. 

TI Feeds provide unique IOCs from sources including memory dumps, Suricata IDS detections, and internal threat categorization systems, enabling SOCs to detect anomalies that evade traditional signatures. A deeper research involving sandbox sample analysis might reveal a new obfuscation technique used by malware, prompting updated detection rules. 

Shorter dwell times limit attacker persistence, reducing potential damage and supporting compliance requirements. 

5. Increasing Automation Utilization 

Automation is an important metric for scaling SOC operations. Threat intelligence feeds integrate with security tools like SIEMs, SOAR platforms, or firewalls to automate detection and response. 

ANY.RUN’s TI Feeds connect with any vendor, including OpenCTI, ThreatConnect, QRadar, etc. They deliver machine-readable IOCs (e.g., STIX/MISP formats, the support of TAXII protocol) that can be ingested into automated workflows. For instance, a feed might update a firewall’s blocklist with malicious IPs in real time. Higher automation utilization reduces manual workloads, improves response times, and boosts cost efficiency. 

6. Supporting Coverage Rate 

Coverage rate measures the percentage of assets monitored by the SOC. Threat intelligence feeds enhance visibility by identifying new attack surfaces or blind spots. They provide insights into emerging threats targeting specific technologies (e.g., IoT devices, cloud environments), prompting SOCs to expand monitoring. For example, a feed might highlight attacks on a specific cloud API, leading to new telemetry sources. 

Improved coverage ensures comprehensive threat detection across the organization’s attack surface. 

7. Reducing Repeat Incident Rate 

Recurring incidents indicate gaps in remediation or prevention. Threat intelligence feeds provide root cause analysis and mitigation strategies to prevent recurrence. 

Owing to the integration with the Interactive Sandbox, the users of TI Feeds can access detailed post-incident data, such as attackers’ TTPs or misconfigurations exploited. For example, a feed might reveal an indicator related to a phishing campaign exploiting weak MFA settings, prompting stronger controls. Addressing root causes reduces repeat incidents, enhancing long-term security resilience. 

How to Integrate Threat Intelligence Feeds from ANY.RUN 

You can test ANY.RUN’s Threat Intelligence Feeds in STIX and MISP formats by requesting a trial on this page. 

  • Spot and block attacks quickly to prevent disruptions and damage.  
  • Keep your detection systems updated with fresh data to proactively detect emerging threats.   
  • Handle incidents faster to lower financial and brand damage.   

ANY.RUN also runs a dedicated MISP instance that you can synchronize your server with or connect to your security solutions. 

Conclusion 

Threat intelligence feeds deliver significant business value by enhancing SOC efficiency, reducing risk, and driving cost-effective security operations. By providing real-time, actionable insights, feeds empower organizations to minimize downtime, protect critical assets, and maintain compliance, ultimately safeguarding revenue and reputation.  

With seamless integration into SIEMs and SOAR platforms, ANY.RUN’s TI Feeds maximize automation and ensure comprehensive coverage, helping businesses achieve a robust security posture while improving key KPIs like MTTD, MTTR, and false positive rates. 

About ANY.RUN

ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search, and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.

Request trial of ANY.RUN’s services to test them in your organization → 

The post How SOC Teams Improve Mean Time to Detect and Other KPIs with Threat Intelligence Feeds appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More