Reversing Labs

What do you like best about the product?

The depth of their file reputation intelligence. We integrate ReversingLabs' file reputation service into our CDR pipeline, and the quality of the verdicts, particularly for complex or obfusive file types, is a clear differentiator. The coverage across file formats is excellent and aligns well with the threat landscape.

What do you dislike about the product?

Honestly, it's hard to find significant dislikes - the core product does what we need it to do well. If anything, we'd love to see more proactive sharing of threat intelligence insights and research from the ReversingLabs team. Their expertise in file-based threats is clearly deep, and more of that knowledge surfaced to partners would add real value.

What problems is the product solving and how is that benefiting you?

File-based threats are our entire focus, and ReversingLabs gives us the reputation intelligence to back our CDR capability with an additional layer of validated threat data. The benefit is simple - better outcomes for our customers and a stronger, more defensible product.

What do you like best about the product?

I primarily use Spectra Analyze to check files that come up during the discovery phase, such as open directories, that trigger honeypot alarms, etc.

Disclaimer: I received access as part of my role as a Security Researcher.

I have been using Spectra Analyze for about 1 year now for ~6 hours a week.

Let's start with the interface. There are exactly 2 things that personally bother me.
1. There is no dark mode or I haven't found it.
2. The main dashboard is sometimes overloaded - this also applies to other areas - more on that later.

Otherwise, I must say I find the interface successful. It looks clean, in most cases you immediately see what the status is, and it is thematically well sorted. There are other providers where you feel like you have 10 popups before you find the information. That is not the case here. For some things, like contacted URLs, I would wish for a copy button. That would simplify things a bit more. Otherwise, you have to click 2x more and still get the information - please understand this more as "complaining at a high level."

File Upload
You can upload the data via the GUI or via API. Personally, I have used the GUI now and then, but relatively quickly built an upload script based on the available SDK and now upload 99.9% via API to ReversingLabs.

File Report
On the overview page of the individual file, you immediately see what exactly is going on. Classification, which part (static analysis, dynamic analysis, etc.) rated the file, a graph, network information if available, and much more can be seen at first glance. If you want, you can also get lost in the respective sub-items. Personally, the overview page is usually enough for me.

YARA
What I find pretty good is that I can store my own YARA rules. A "matching" also takes place for files that were uploaded in the past. It is immediately apparent which ones match, you can adjust your rule, etc. - in short, pretty solid.

Support & Feedback
This is the point that surprised me the most. Whether general inquiries or hints about what I didn't like - it was always answered promptly. I was particularly surprised that some requests for possible interface improvements were added within a very short time. I know it differently from other large companies. If I had to give stars, it would be 4.5.

What do you dislike about the product?

-no dark mode
-Interface partially (due to the amount of data) confusing

What problems is the product solving and how is that benefiting you?

Since I use the toolset as a security researcher and not in a corporate environment, I cannot identify any business-related issues.

What do you like best about the product?

Comprehensive, clear, great customer support!

What do you dislike about the product?

Nothing in particular. Probably the UI could be nicer, but it's not blocking anything.

What problems is the product solving and how is that benefiting you?

Getting more information about possible malware

What do you like best about the product?

I find the onboarding process with ReversingLabs to be magnificent, as everyone was super involved in addressing our specific needs. They demonstrated high availability and provided very useful tips on how to best utilize our plan. The initial setup of ReversingLabs was extremely easy, making the transition seamless and efficient. Moreover, the process of prioritizing risk management and enriching information with ReversingLabs is highly effective. Overall, I am extremely satisfied with the functionality and support provided, which is why I rate ReversingLabs a perfect 10 and would highly recommend it.

What do you dislike about the product?

Endpoints for checking usage are a bit confusing.

What problems is the product solving and how is that benefiting you?

I use ReversingLabs for analyzing IOCs and malware, which helps prioritize risk management and enrich information.

What do you like best about the product?

RL has an industry leading, humongous repository of both known bad (malware) and known good files (it's critical to have both). At the time of this review they have approximately 40 billion files and support more file types and larger files (including containers and archives like ISO and ZIP) than anyone else.

What do you dislike about the product?

I do hope that, one day, RL will have a community facing website similar to VT to allow independent and not-yet-customers to see the value in their repository and analysis directly.

What problems is the product solving and how is that benefiting you?

RL allows me to receive a very accurate, third-party opinion of executable and other types of files involved in detections on my customers' endpoint devices, and they do this analysis for me (for files already in their massive repository) in a few milliseconds, which aligns with my company's mission of making verdicts on detected threats in milliseconds.