# Spectra Intelligence Enrichment App Activation — Anomali ThreatStream

> Setup and configuration guide for Spectra Intelligence Premium Enrichment app in Anomali ThreatStream for IOC enrichment with file reputation and threat intelligence data.

## Overview

The Spectra Intelligence Premium Enrichment for Anomali ThreatStream allows users of Spectra Intelligence to enrich observables with information such as classification, malware family names and AV scanner results.

## Getting Started

Before you begin you will need the username and password of your Spectra Intelligence account.

## Activating the Enrichment

1. When logged into ThreatStream navigate to the App Store and search for ReversingLabs.

![ThreatStream App Store search results for ReversingLabs](./images/ThreatStreamIntelStore.png)

2. Select "ReversingLabs Spectra Intelligence" and in the dialog box select "I Have Credentials"

![Spectra Intelligence app activation dialog with credentials option](./images/ThreatStreamIntelActivation.png)

3. The "Credentials" link will appear. Select "Credentials":

![Spectra Intelligence app Credentials button](./images/ThreatStreamIntelCredentials.png)

4. The following fields are available under Credentials:

| Field | Required? | Description |
| --- | --- | --- |
| Spectra Intelligence Username | Required | Username of the Spectra Intelligence account you will use to access the ReversingLabs API |
| Spectra Intelligence Password |Required |Password associated with the account|
| Spectra Intelligence Address| Required | `https://data.reversinglabs.com` |
| Spectra Analyze Address | Optional | If your organization also has a Spectra Analyze appliance the address can be added here to allow for a pivot from an Observable into the appropriate Spectra Analyze page. |

5. Once the required fields are populated, select Activate
6. The enrichment is now active.

## Verifying the Enrichment

To verify the enrichment is active, select an observable and scroll down to the Enrichments section of the page. A new tab should be present labeled "REVERSINGLABS SPECTRA INTELLIGENCE" and the enrichment data should automatically load. The enrichment data provided will vary depending on the observable type and may look different from the screenshot below.

![ThreatStream Enrichments section showing ReversingLabs Spectra Intelligence data](./images/ThreatStreamIntelEnrichment.png)
