Skip to main content

Cloud-delivered Incident ResponderIncident Responder Documentation

Configure the Anomali ThreatStream API Service

Configure Anomali ThreatStream as a service to get entity and artifact reputations, upload entities and artifacts, and run other Anomali ThreatStream API actions.

  • Note the URL you use to access the Anomali ThreatStream API.

  • Note your Anomali ThreatStream API key.

  • If you use a proxy, ensure that you whitelist the URL you use to access the Anomali ThreatStream API.

  1. In the sidebar, click SETTINGSA grey gear icon, then select Core.

  2. Under SERVICE INTEGRATIONS, select Services.

  3. Select a service:

    • To configure a specific service, hover over a service, then click CONFIGURE. Use the search by vendor or filter by action to find a service.

    • To manually provide the relevant information for a service, click Configure a new serviceA dark blue plus sign..

    • To view all actions for a service, hover over a service, then click the information icon An icon of a grey i inside a grey circle..

  4. Enter information about the service:

    • Service Name – Enter a unique name for the service. By default, the service name is Anomali ThreatStream.

    • (Optional) Description – Describe the service.

    • (Optional) Owner – Enter the email address of the person or group responsible for the service. 

    • apiUser – Enter your Anomali ThreatStream username, typically the email address associated with your Anomali ThreatStream account.

    • apiKey – Enter the Anomali ThreatStream API key you previously noted.

    • apiURL – Enter the URL you use to access the Anomali ThreatStream API; for example, https://api.threatstream.com/api/<api_version>/<resource>/

  5. To validate the source, select TEST CONNECTIVITY.

  6. Select CREATE SERVICE.