T1000 — Network Appliance for File Reputation

ReversingLabs T1000 Appliance provides on-premises access to an up-to-date copy of ReversingLabs Spectra Intelligence, the industry's most comprehensive source for threat intelligence and data reputation files.

With a local database, customers do not incur latency penalties and privacy risks associated with the Internet.

The T1000 Appliance uses a NoSQL database optimized for data replication, and supports advanced searches across billions of file records in milliseconds.

T1000 R1, XG, and Assure

T1000 R1, T1000 XG, and T1000 Assure share the same core data model, but XG and Assure expose additional sample metadata and analysis endpoints.

While R1 supports only the TCA-0101 (Malware Presence) API, XG additionally provides TCA-0104 (File Analysis), TCA-0103 (multi-AV scan records), and the XG-CFS forensic sampling service.

T1000 Assure provides the same APIs as XG, without the XG-CFS forensic sampling service. Assure isn't a standalone appliance — it's meant to be purchased together with Spectra Assure.

The table below compares the three configurations, along with File Inspection Engine in hash lookup mode (/check-sample), which performs a similar on-premises hash-based lookup but isn't a T1000 configuration.

Capability	R1	XG	Assure	FIE (hash lookup mode)
TCA-0101 (File Reputation/MWP)	Yes	Yes	Yes	Enrichment only, via with-threat-details (cloud)
TCA-0103 (XREF)	No	Yes	Yes	No
TCA-0104 (RLDATA)	No	Yes	Yes	No
RCA2*	Yes	Yes	Yes	No
XG-CFS	No	Yes	No	No
Spectra Assure integration API**	No	No	Yes	No
Multi-scanner detections	No	Yes (no history)	Yes (no history)	No
Hashes returned	SHA1 only	MD5, SHA1, SHA256	MD5, SHA1, SHA256	SHA1 (lookup key); no hash computation for other types

* RCA2 isn't a directly callable endpoint. It's used when the appliance is integrated with Spectra Analyze or Spectra Detect.

** The Spectra Assure integration API is internal and isn't directly callable. It's used when Assure is integrated with Spectra Assure.

For details on each configuration's specific capabilities and limitations, see T1000 R1, T1000 XG, and T1000 Assure.

T1000 vs. Spectra Intelligence (cloud)

info

The documentation for API endpoints titled TCA-XXXX is mirrored from Spectra Intelligence. The functionality is equivalent in terms of requests: URL structure, request parameters, and so on.

In terms of responses, certain information won't be present in T1000:

• multi-AV historical scan records
• hashes that are not SHA256, SHA1 or MD5:
  • SHA384
  • SHA512
  • RIPEMD160
  • SSDEEP
  • TLSH
• scanner metadata:
  • version used for this scanning report
  • update timestamp

Where such information is available with a direct call to Spectra Intelligence, T1000 will return null.

When sending requests, use the username and the password created with the Appliance management interface.

Response Status Codes

Code	Description
200	The request has succeeded.
400	The request could not be understood by the server due to malformed syntax.
401	The request requires user authentication.
403	The server understood the request, but is refusing to fulfill it.
404	The server has not found anything matching the request URI.
429	License has expired.
500	The server encountered an unexpected condition which prevented it from fulfilling the request.
503	The server is currently unable to handle the request due to a temporary overloading or maintenance of the server.