Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
Providing human-readable explanations for why an indicator appears within the threat analysis report has always been important to our customers. The explainability gives senior analysts a quick way to prioritize indicators and a clear explanation for non-technical teammates. Since we make indicators human-readable, they simplify the code analysis process by converting complex code patterns into descriptions of their behavior. Version 6.0 has made some significant advancements with indicator transparency which makes it possible to describe the file behavior through descriptions like "Downloads a file" or "Encrypts or encodes data in memory using Windows API” so even the most junior member of the team can understand how malware works.
Keeping with the usability and education theme, we’ve improved our interactive storyteller feature that enables novice A1000 users to pivot through ReversingLabs extensive local and cloud data simply by clicking the description links, softening the advanced search syntax learning curve.
We’ve also added what we’re calling threat intelligence cards to provide an informative, educational overview and analytics on malware types and families in an easily accessible format on the Advanced Search page. Having a simple graphical report has been something customers have been asking to make it easier for non-technical teams to understand what’s happening during an investigation and after-action reports.
We all know the MITRE ATT&CK framework as an industry-wide standard for describing threats and actor behaviors through various tactics, techniques, and procedures (TTP). Presented as a matrix, it translates the attacker's actions into actionable concepts. These are neatly organized into matrices that consist of tactics that are in turn carried out by one or more attack techniques and sub-techniques.
In the A1000, the page header for our MITRE ATT&CK mappings has been completely redesigned, making it easier to read sample classification information at a glance. The header now gives better prominence to the MITRE ATT&CK data, making it easier to access. The top 3 techniques by count are listed on the header, and a full, expandable list with ATT&CK data is now accessible directly on the summary page for faster viewing.
Finally, no security product should stand alone, so we’ve been busy building new integrations and improving existing connectors to make it easier to use the vast amount of intelligence available to customers in both the A1000 and the Titanium Platform overall. Two notable changes in the A1000 include:
1) having options to delete the source files after analysis when using S3 and network file shares, limiting the number of locations you need to track for sensitive data or malware.
2) providing users access to historical information on all dynamic analyses with detected indicators of compromise being available to them through search and sections on the sample summary page.
This is just a taste of the improvements we’ve made in version 6.0, and you can find the full list of features and updates in the release notes. Over the next months, we’ll be releasing more integrations, and adding even more functionality to the Titanium Platform overall, so we’re not done. As I said, we’ve made many of these improvements based on your feedback, so keep it coming. Of course, if you want to learn more about what we’re doing, we’d be happy to set up a meeting.
Related Material:
Explore RL's Spectra suite: Spectra Assure for software supply chain security, Spectra Detect for scalable file analysis, Spectra Analyze for malware analysis and threat hunting, and Spectra Intelligence for reputation data and intelligence.
AI-powered security researchers gained access to sensitive Anthropic business systems through third-party applications, highlighting a growing enterprise security blind spot.
MFT and other trusted systems collect files, access and connections. Patching and inspecting what moves through it are separate defenses.
ReversingLabs identified and classified the malware weeks before the report was published — showing why behavioral intelligence and historical telemetry matter in the AI age.