---
title: Anomali ThreatStream
description: >-
  Enriches your security logs with threat intelligence data from Anomali
  ThreatStream.
breadcrumbs: Docs > Integrations > Anomali ThreatStream
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Anomali ThreatStream
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}
  Anomali ThreatStream Threat IntelligenceAnomali ThreatStream Threat Intelligence
## Overview{% #overview %}

[Anomali ThreatStream](https://www.anomali.com/products/threatstream) is a threat intelligence platform (TIP) that automates the collection, curation, and analysis of threat data from global, open-source, and premium feeds.

This integration collects the following indicator types:

- IPv4
- Domain
- SHA256

Integrate Anomali ThreatStream with Datadog to enhance your security logs with threat intelligence, enabling analysis of matched Indicators of Compromise (IOCs) through pre-built dashboards. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.

## Setup{% #setup %}

### Obtain Anomali ThreatStream API credentials and API domain{% #obtain-anomali-threatstream-api-credentials-and-api-domain %}

1. Log in to the Anomali ThreatStream instance.
1. Navigate to **Settings** > **My profile**.
1. Under **Account Information**, click **Reveal** next to the **API Key** and copy it. Also, copy your **Email**.
1. Identify the API domain assigned to your Anomali ThreatStream instance. The domain must end in `threatstream.com`. For example, use `api.threatstream.com` for US Cloud or `api-eu.threatstream.com` for EU Cloud. For more information, see the [Anomali ThreatStream access documentation](https://docs.anomali.com/Content/Getting%20Started%20with%20ThreatStream/access_optic.htm).
   - Enter only the API domain, without `https://` or an `/api/...` path. Don't enter the platform domain (`ui.threatstream.com` or `ui-eu.threatstream.com`).

### Connect your Anomali ThreatStream account to Datadog{% #connect-your-anomali-threatstream-account-to-datadog %}

1. Provide the following details:
| Parameter                                          | Description                                                                                                                               |
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| API Domain                                         | The API domain assigned to your Anomali ThreatStream instance, such as `api.threatstream.com`. The domain must end in `threatstream.com`. |
| Email                                              | Email address associated with your ThreatStream account.                                                                                  |
| API Key                                            | API key of your Anomali ThreatStream account.                                                                                             |
| Collect IP Address Indicators (Threat Intel Feed)  | Enable to collect IPv4 IOCs. The default value is `true`.                                                                                 |
| Collect Domain Indicators (Threat Intel Feed)      | Enable to collect Domain IOCs. The default value is `true`.                                                                               |
| Collect hash SHA256 Indicators (Threat Intel Feed) | Enable to collect SHA256 IOCs. The default value is `true`.                                                                               |
1. Click **Save**.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).