VirusTotal (API v3)

Analyzes suspicious hashes, URLs, domains, and IP addresses.

Data Enrichment & Threat Intelligence · VirusTotal

Configuration parameters

  • credentials — API Key (leave empty. Fill in the API key in the password field.) (required)
  • feedReliability — Source Reliability
  • is_premium_api — Premium Subscription
  • fileThreshold — File Malicious Threshold. Minimum number of positive results from VT scanners to consider the file malicious.
  • fileSuspiciousThreshold — File Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the file suspicious.
  • ipThreshold — IP Malicious Threshold. Minimum number of positive results from VT scanners to consider the IP malicious.
  • ipSuspiciousThreshold — IP Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the IP suspicious.
  • disable_private_ip_lookup — Disable reputation lookups for private IP addresses
  • urlThreshold — URL Malicious Threshold. Minimum number of positive results from VT scanners to consider the URL malicious.
  • urlSuspiciousThreshold — URL Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the URL suspicious.
  • domainThreshold — Domain Malicious Threshold. Minimum number of positive results from VT scanners to consider the Domain malicious.
  • domainSuspiciousThreshold — Domain Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the Domain suspicious.
  • preferredVendors — Preferred Vendors List. CSV list of vendors who are considered more trustworthy.
  • preferredVendorsThreshold — Preferred Vendor Threshold. The minimum number of highly trusted vendors required to consider a domain, IP address, URL, or file as malicious.
  • crowdsourced_yara_rules_enabled — Enable score analyzing by Crowdsourced Yara Rules, Sigma, and IDS
  • yaraRulesThreshold — Crowdsourced Yara Rules Threshold
  • SigmaIDSThreshold — Sigma and Intrusion Detection Rules Threshold
  • domain_popularity_ranking — Domain Popularity Ranking Threshold
  • relationship_threshold — Premium Subscription Only: Relationship Malicious Files Threshold
  • relationship_suspicious_threshold — Premium Subscription Only: Relationship Suspicious Files Threshold
  • ip_relationships — IP Relationships
  • domain_relationships — Domain Relationships
  • url_relationships — URL Relationships
  • file_relationships — File Relationships
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (22)

  • domain

    Checks the reputation of a domain.

  • file

    Checks the file reputation of the specified hash.

  • file-rescan

    Rescans an already submitted file. This avoids having to upload the file again. Use the vt-analysis-get command to get the scan results.

  • file-scan

    Submits a file for scanning. Use the vt-analysis-get command to get the scan results.

  • ip

    Checks the reputation of an IP address.

  • url

    Checks the reputation of a URL.

  • url-scan

    Scans a specified URL. Use the vt-analysis-get command to get the scan results.

  • vt-analysis-get

    Get analysis of a file submitted to VirusTotal.

  • vt-comments-add

    Adds comments to files and URLs.

  • vt-comments-delete

    Delete a comment.

  • vt-comments-get

    Retrieves comments for a given resource.

  • vt-comments-get-by-id

    Retrieves a comment by comment ID.

  • vt-file-sandbox-report

    Retrieves a behavioral relationship of the given file hash.

  • vt-file-scan-upload-url

    Premium API. Get a special URL for files larger than 32 MB.

  • vt-file-sigma-analysis

    Result of the last Sigma analysis in markdown format.

  • vt-passive-dns-data

    Returns passive DNS records by indicator.

  • vt-privatescanning-analysis-get

    Get analysis of a private file or URL submitted to VirusTotal.

  • vt-privatescanning-file

    Checks the file reputation of the specified private hash.

  • vt-privatescanning-file-scan

    Submits a file for private scanning. Use the vt-privatescanning-analysis-get command to get the scan results.

  • vt-privatescanning-url

    Checks the reputation of a private URL.

  • vt-privatescanning-url-scan

    Submits an URL for private scanning. Use the vt-privatescanning-analysis-get command to get the scan results.

  • vt-search

    Search for an indicator in Virus Total.