> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Anomali ThreatStream

> Reference for the Tracecat Anomali ThreatStream integration: registered actions, required secrets, expected inputs, and example workflow usage.

## Lookup domain

Action ID: `tools.threatstream.lookup_domain`

Search Anomali ThreatStream for reputation of a domain.

### Secrets

Required secrets:

* `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to lookup.
</ParamField>

## Lookup email

Action ID: `tools.threatstream.lookup_email`

Search Anomali ThreatStream for reputation of an email address.

### Secrets

Required secrets:

* `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="email" type="string" required>
  Email address to lookup.
</ParamField>

## Lookup File Hash

Action ID: `tools.threatstream.lookup_file_hash`

Search Anomali ThreatStream for reputation of a file hash.

### Secrets

Required secrets:

* `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="file_hash" type="string" required>
  File hash to lookup.
</ParamField>

## Lookup IP address

Action ID: `tools.threatstream.lookup_ip_address`

Search Anomali ThreatStream for reputation of an IP address.

### Secrets

Required secrets:

* `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="ip_address" type="string" required>
  IP address to lookup.
</ParamField>

## Lookup URL

Action ID: `tools.threatstream.lookup_url`

Search Anomali ThreatStream for reputation of an URL.

### Secrets

Required secrets:

* `threatstream`: required values `ANOMALI_USERNAME`, `ANOMALI_API_KEY`.

### Input fields

<ParamField path="url" type="string" required>
  URL to lookup.
</ParamField>