# ReversingLabs Browser Extension Overview

> Browser extension for Chrome and Edge that integrates Spectra Analyze and Spectra Intelligence with automatic file scanning, URL checking, and IOC highlighting.

The [**ReversingLabs Browser Extension**](https://chromewebstore.google.com/detail/reversinglabs-browser-ext/hdnaiimefhaiglkbjdcioegcoofbnomm) enhances the usability of Spectra Analyze and Spectra Intelligence products directly from your browser. It enables seamless interaction, making it easier to access and analyze discovered Indicators of Compromise (IOCs).

## Features

- **Automatic highlighting**: IP addresses, URLs, domain names and file hash indicators are automatically highlighted on page.
- **Side panel integration**: indicator data is displayed in a side panel integrated into the browser.
- **Classification lookup**: indicator classification lookup can be performed without leaving the page.
- **File upload**: upload and analysis of files is available for Spectra Analyze users.
- **Context menu lookup**: submit and query items through the right-click context menu.
- **Safe URL**: safer browsing is ensured by checking URLs before they are opened.
- **Automatic scan**: downloaded files are automatically scanned and analyzed to detect potential threats.
- **Evidence Locker**: collect and save IOCs during investigations, with options to export lists as JSON or CSV for detection.
- **Pivoting & Drill-down**: Directly pivot from the extension to deep analysis pages in Spectra Analyze for file types, threat names, and network references.
- **Enriched Search**: One-click Google Search integration for IOC to gather external context instantly.

### API reference

The ReversingLabs browser extension uses specific APIs depending on which appliance you connect with the extension.

The following **Spectra Intellligence APIs** are used:

- [TCA-9999 (single user)](/SpectraIntelligence/API/CustomerUsage/tca-9999/): check if the provided credentials are valid.
- [TCA-0404](/SpectraIntelligence/API/NetworkThreatIntel/tca-0404/): submit URLs.
- [TCA-0403](/SpectraIntelligence/API/NetworkThreatIntel/tca-0403/): query for URL info.
- [TCA-0405](/SpectraIntelligence/API/NetworkThreatIntel/tca-0405/): query for domain info.
- [TCA-0406](/SpectraIntelligence/API/NetworkThreatIntel/tca-0406/): query for IPv4 info.
- [TCA-0407](/SpectraIntelligence/API/NetworkThreatIntel/tca-0407/): query for sample reputation.
- [TCA-0101](/SpectraIntelligence/API/FileThreatIntel/tca-0101/): query for sample info via hash.
- [TCA-0104](/SpectraIntelligence/API/FileThreatIntel/tca-0104/): query for sample AV info.
- [TCA-0202](/SpectraIntelligence/API/Automation/tca-0202-0203/): upload samples; can be used only with public files.

The following **Spectra Analyze APIs** are used:

- [License Information](/SpectraAnalyze/API%20Documentation/licensing/#license-information): check if the provided credentials are valid.
- [Submission API](/SpectraAnalyze/API%20Documentation/submissions): submit URLs and upload samples.
- [Network threat intel (URL)](/SpectraAnalyze/API%20Documentation/network-threat-intelligence/#url): query for URL info.
- [Network threat intel (domain)](/SpectraAnalyze/API%20Documentation/network-threat-intelligence/#domain): query for domain info.
- [Network threat intel (IP)](/SpectraAnalyze/API%20Documentation/network-threat-intelligence/#domain): query for IPv4 info.
- [Full Report API](/SpectraAnalyze/API%20Documentation/full-report-api/): query for sample info via hash.
- [Classification Status API](/SpectraAnalyze/API%20Documentation/classification-status-api/): query for classification info via hash.

## Requirements

**Warning: Enterprise mode**
For bulk deployment and management on a large number of systems, your organization must have a configured IT environment to enforce installation and configuration.

The ReversingLabs browser extension has been tested and confirmed to work on **macOS**, **Linux** and **Windows** operating systems with the following prerequisites:

- **Chromium-based browser**. Users must use a supported browser:
  - **Chrome** >= v116
  - **Edge** >= v133

- **ReversingLabs appliance account**. To be able to use the extension, users must have either of the following:
  - **Spectra Intelligence** account
  - **Spectra Analyze** account

## Installation and setup

The [**ReversingLabs Browser Extension**](https://chromewebstore.google.com/detail/reversinglabs-browser-ext/hdnaiimefhaiglkbjdcioegcoofbnomm) can be installed and managed individually or through enterprise deployment depending on the users' business needs and organization.

For a quick introduction to the ReversingLabs browser extension, watch the [**Getting Started**](https://www.youtube.com/watch?v=aD4DMFMNsJg) video on YouTube. This short walkthrough demonstrates how to install, configure, and use the core features of the extension.

For more detailed instructions, see:
- [Enterprise Deployment and Configuration](./enterprise-deployment.md)
- [Individual Installation and Setup](./individual-setup.md)

## Support

For any questions or concerns relating to the browser extension, contact support@reversinglabs.com.
