Phishing analysis
Keepnet + ANY.RUN integration
Run URLs and files in an interactive sandbox.
Lookup
Keepnet integrates with ANY.RUN to run URLs and files in an interactive sandbox.
What you get
- A verdict added to incidents automatically
- Usable as a condition in playbook rules
- Shown next to the other engines’ results
How it works
- An employee reports an email
- Keepnet sends its URLs and files to ANY.RUN
- The verdict joins the incident and can trigger a playbook
Data and permissions
| Data | Direction | Detail |
|---|---|---|
| URLs and files from reported emails | Out | Only what this engine checks |
| Verdict | In | Stored with the incident |
What you need
- Your own ANY.RUN API key
- Incident Responder
Set up
Company settings, Integrations: paste your API key.
Related integrations
- Works with
- Incident Responder
- Built by
- Keepnet
- Last updated
- October 2026
