VirusTotal - Private API

Deprecated. Use "VirusTotal (API v3)" or "VirusTotal - Premium (API v3)" integrations instead.

Category

Data Enrichment & Threat Intelligence

Pack

VirusTotal-Private_API

Configuration parameters

• APIKey — Virus Total private API key (required)
• useProxy — Use system proxy settings
• insecure — Trust any certificate (not secure)
• fileThreshold — File Threshold. Minimum number of positive results from VT scanners to consider the file malicious.
• ipThreshold — IP Threshold. Minimum number of positive results from VT scanners to consider the IP malicious.
• urlThreshold — URL Threshold. Minimum number of positive results from VT scanners to consider the URL malicious.
• domainThreshold — Domain Threshold. Minimum number of positive results from VT scanners to consider the domain malicious.
• preferredVendors — Preferred Vendors List. List of vendors which are considered more trustworthy, comma separated.
• preferredVendorsThreshold — Preferred Vendor Threshold. The minimal number of highly trusted vendors needed to consider a domain, IP, URL or file as malicious.
• fullResponseGlobal — Determines whether to return all results, which can number in the thousands. If "true", returns all results and overrides the _fullResponse_ argument (if set to "false") in a command. If "false", the fullResponse argument in the command determines how results are returned.

Commands (8)

• vt-private-check-file-behaviour — VirusTotal runs a distributed setup of Cuckoo sandbox machines that execute the files we receive. This API allows you to retrieve the full JSON report of the file's execution as returned by the Cuckoo JSON report encoder.
• vt-private-download-file — Downloads a file from VirusTotal's store given one of its hashes. This call can be used in conjuction with the file searching call in order to download samples that match a given set of criteria.
• vt-private-get-domain-report — Retrieves a report on a given domain (including the information recorded by VirusTotal's passive DNS infrastructure). If the domain doesn't exist in VT's dataset you would need to use Virus Total's (Public API integration) url-scan command
• vt-private-get-file-report — Retrieves a concluded file scan report for a given file.
• vt-private-get-ip-report — Retrieves a report on a given IP address (including the information recorded by VirusTotal's Passive DNS infrastructure).
• vt-private-get-url-report — Retrieves a concluded url scan report for a given url.
• vt-private-hash-communication — Return all Domains, IPs, URLs that a given hash of malware communicates with
• vt-private-search-file — This command is equivalent to VirusTotal Intelligence advanced searches. A very wide variety of search modifiers are available, including: file size, file type, first submission date to VirusTotal, last submission date to VirusTotal, number of positives, dynamic behavioural properties, binary content, submission file name, and a very long etcetera. The full list of search modifiers allowed for file search queries is documented at: https://www.virustotal.com/intelligence/help/file-search/#search-modifiers