ReversingLabs module.
ReversingLabs enriches your organization's file hash, URL, domain, and IP IOCs with file reputation and malware classification from your A1000 appliance. It is the widest coverage of the six bring-your-own-key providers, and the only one that answers on file hashes, which makes it the one to reach for if malware reporting is a large part of what flows into your account. Rather than an API key, it asks for the address of your own Spectra Analyze appliance and a login for it, so the reputation data you get is your organization's own licensed data.
You need a ReversingLabs Spectra Analyze (A1000) appliance reachable on a public https://
address, plus a username and password for it. Liberty91 calls the appliance directly, so an
appliance that only answers inside your network cannot be used.
How to connect ReversingLabs
- Confirm your Spectra Analyze (A1000) appliance is reachable on a public
https://address and note a username and password that can query it. - In Liberty91, go to Modules, open the Analysis Modules section, and click the ReversingLabs tile.
- Fill in Appliance URL, Username, and Password.
- Turn on Active and click update.
Checking the connection
There is no separate Test button, because saving is the health check. When you save, Liberty91 calls your appliance with the details you entered and reports what came back. A green Connected banner means the credentials work, and a red banner means they do not. If you leave the page and return later, a blue Status banner shows the result of the last save rather than re-testing.
| Message | What it means |
|---|---|
API key validated | The credentials work and the module is ready to enrich |
Invalid host configuration | The appliance URL is not usable. Check it is a public https:// address with no typo |
Invalid credentials | The appliance rejected the username or password |
ReversingLabs returned an unexpected response | The appliance answered, but not with anything Liberty91 recognises |
ReversingLabs rate limit reached, try again later | The appliance is throttling requests for the moment. Nothing is wrong with the credentials |
Could not reach ReversingLabs | Liberty91 got no response at all. Check the appliance is up and reachable from the internet |
ReversingLabs returned HTTP <code> | The appliance answered with something unexpected, and the code says what |
Leave the Password field blank when you save and the stored password is kept. That is how you turn Active off and on again, or correct the username, without retyping it. Credentials are encrypted at rest and never sent back to the browser, so the field looks empty even when a password is stored.
The module also shows IOCs enriched as a running total, which is the quickest way to confirm that indicators really are being processed.
What you get from ReversingLabs enrichment
Every MD5, SHA-1, SHA-256, URL, domain, and IP indicator that arrives after the credentials are saved is looked up on your appliance, and the classification it returns becomes one of the four verdicts used across the platform, together with a score from 0 to 100.
| ReversingLabs classification | Verdict |
|---|---|
malicious | Malicious |
suspicious | Suspicious |
goodware | Benign |
| Anything else, including nothing on file | Unknown |
A malicious classification scores 90, or the appliance's own risk score multiplied by 10 where that comes out higher.
In the platform you see a ReversingLabs chip on the indicator's row and in its panel, showing
the classification and then the threat name where the appliance has one, which is often the
fastest way to put a family name to a hash. In an IOC CSV export, REVERSINGLABS appears in
the enrichment_providers column, and over the API the same value comes back in the
enrichment_providers and enrichments fields on the IOC endpoints, where
you can also filter for it with ?enrichment_provider=REVERSINGLABS.
A ReversingLabs verdict of Benign carries the same weight as any other benign reading: it caps the indicator's confidence, on the principle that a vendor recognising something as known-good should stop it reading as a high-confidence threat. See IOC enrichment and decay scoring for the full calculation.
Permissions and limits
Any member of the billing account can configure this module. There is no Owner or Admin gate on it, unlike the ransomware domain alerts, which are restricted.
- One set of appliance credentials per billing account, shared by everyone on it.
- Saving is rate-limited to 12 attempts a minute per user, so repeated retries pause briefly.
- Enrichment runs in batches of up to 100 indicators.
Frequently asked questions
What do I need before I can connect ReversingLabs?
A reachable Spectra Analyze (A1000) appliance on a public https address, plus a username and password for it. Liberty91 calls the appliance directly, so it has to be reachable from the internet.
Which indicators does ReversingLabs enrich?
MD5, SHA-1, and SHA-256 hashes, plus URLs, domains, and IP addresses. It is the widest coverage of the six bring-your-own-key providers.
Do I have to retype the password to turn the module off and on?
No. Leave the password field blank when you save and the stored password is kept, so you can flip Active off or on without it.