# Spectra Analyze Enrichment App Activation — Anomali ThreatStream

> Setup and configuration guide for Spectra Analyze Premium Enrichment app in Anomali ThreatStream for IOC enrichment with file analysis and classification data.

## Overview

The Spectra Analyze Premium Enrichment for Anomali ThreatStream allows users of Spectra Analyze to enrich observables with information such as classification, malware family names and AV scanner results.

## Getting Started

Before you begin you will need the URL of your Spectra Analyze appliance and an API key. To create an API key in the Spectra Analyze interface refer to the documentation of Spectra Analyze.

## Activating the Enrichment

1. When logged into ThreatStream navigate to the App Store and search for ReversingLabs.

![ThreatStream App Store search results for ReversingLabs Spectra Analyze](./images/ThreatStreamAnalyzeStore.png)

2. Select "ReversingLabs Spectra Analyze" and in the dialog box select "I Have Credentials"

![Spectra Analyze app activation dialog with credentials option](./images/ThreatStreamAnalyzeActivaton1.png)

3. The "Credentials" link will appear. Select "Credentials".

![Spectra Analyze app Credentials button](./images/ThreatStreamAnalyzeCredentials.png)

4. The following fields are available under Credentials:

FieldRequired?Description
Spectra Analyze TokenRequiredAPI token configured in the Spectra Analyze interface.
Spectra Analyze HostRequiredThe URL of the Spectra Analyze Appliance
Verify SSL CertificateOptional`true` or `false`
ReversingLabs Sandbox PlatformOptionalOne of: `windows11``windows10``windows7``macos_11``linux`

5. Once the required fields are populated, select Activate
6. The enrichment is now active.

## Verifying the Enrichment

To verify the enrichment is active, select an observable and scroll down to the Enrichments section of the page. A new tab should be present labeled "REVERSINGLABS SPECTRA ANALYZE" and the enrichment data should automatically load. The enrichment data provided will vary depending on the observable type and may look different from the screenshot below.

![ThreatStream Enrichments section showing ReversingLabs Spectra Analyze data](./images/ThreatStreamAnalyzeEnrichment.png)
