# Network Threat Intelligence API — Spectra Intelligence

> Spectra Intelligence Network Threat Intelligence APIs for investigating URLs, domains, and IP addresses, querying reputation data, and correlating network IOCs with files.

The Network Threat Intelligence APIs provide comprehensive capabilities for investigating and analyzing network-based indicators of compromise (IOCs), including URLs, domains, and IP addresses. These APIs enable security teams to assess threats, retrieve reputation data, and correlate network indicators with malicious files.

## Common Use Cases

### Check and manage network reputation

Quick reputation lookups for URLs, domains, and IP addresses to get an immediate assessment of whether a network location is associated with malicious activity.

- **[Network reputation (TCA-0407)](tca-0407.md)** - Query reputation data for URLs, domains, and IP addresses in single or bulk requests. Returns ReversingLabs classification, third-party detections, and malware association indicators.
- **[Network reputation (user override) (TCA-0408)](tca-0408.md)** - Override URL classifications within your organization. Useful for marking [false positives](/General/AnalysisAndClassification/FalsePositives) as known or flagging internal threats as malicious.

### Investigate a suspicious URL

Use TCA-0404 Analyze URL to submit URLs for analysis and get detailed reports through TCA-0403 URL threat intelligence. TCA-0403 can also retrieve intelligence reports for any URL in our database.

- **[Analyze URL (TCA-0404)](tca-0404.md)** - Submit URLs for analysis. Downloads and analyzes content, captures screenshots, and resolves infrastructure details.
- **[URL threat intelligence (TCA-0403)](tca-0403.md)** - Retrieve comprehensive threat intelligence reports for URLs in single or bulk requests, including classification, analysis metadata (site categorization, threat type details, site availability, DOM, redirect paths..etc.), screenshots, downloaded files, and third-party reputation data.

### Investigate a domain or IP address

Understand threat profiles, associated files, DNS records, and relationships with other network indicators.

- **[Domain threat intelligence (TCA-0405)](tca-0405.md)** - Retrieve domain reports in single or bulk requests, including reputation data, downloaded file statistics, DNS records, SSL certificates, related URLs, subdomains, and domain resolutions.
- **[IP threat intelligence (TCA-0406)](tca-0406.md)** - Retrieve IP address reports in single or bulk requests, including reputation data, downloaded file statistics, WHOIS information, GeoIP data, related URLs, and domain resolutions.

### Find malware samples associated with a network indicator

Correlate network indicators with file samples. These APIs help identify which files contain references to specific URIs, enabling threat hunting and malware analysis workflows.

- **[URI-to-hash search (TCA-0401)](tca-0401.md)** - Find file hashes that contain references to a specific URI (email, URL, IPv4 address, or domain) discovered during static analysis.
- **[URI statistics (TCA-0402)](tca-0402.md)** - Get statistical counts of known, malicious, and suspicious files associated with a specific URI.

## All Networking APIs


