---
title: "Anomali ThreatStream"
description: "Reference for the Tracecat Anomali ThreatStream integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## Lookup domain

Action ID: `tools.threatstream.lookup_domain`

Search Anomali ThreatStream for reputation of a domain.

### Secrets

Required secrets:

- `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>

Domain to lookup.

</ParamField>

## Lookup email

Action ID: `tools.threatstream.lookup_email`

Search Anomali ThreatStream for reputation of an email address.

### Secrets

Required secrets:

- `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="email" type="string" required>

Email address to lookup.

</ParamField>

## Lookup File Hash

Action ID: `tools.threatstream.lookup_file_hash`

Search Anomali ThreatStream for reputation of a file hash.

### Secrets

Required secrets:

- `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="file_hash" type="string" required>

File hash to lookup.

</ParamField>

## Lookup IP address

Action ID: `tools.threatstream.lookup_ip_address`

Search Anomali ThreatStream for reputation of an IP address.

### Secrets

Required secrets:

- `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="ip_address" type="string" required>

IP address to lookup.

</ParamField>

## Lookup URL

Action ID: `tools.threatstream.lookup_url`

Search Anomali ThreatStream for reputation of an URL.

### Secrets

Required secrets:

- `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="url" type="string" required>

URL to lookup.

</ParamField>
