VirusTotal (API v3)

Analyzes suspicious hashes, URLs, domains, and IP addresses.

Category

Data Enrichment & Threat Intelligence

Pack

VirusTotal

Configuration parameters

• credentials — API Key (leave empty. Fill in the API key in the password field.) (required)
• feedReliability — Source Reliability
• is_premium_api — Premium Subscription
• fileThreshold — File Malicious Threshold. Minimum number of positive results from VT scanners to consider the file malicious.
• fileSuspiciousThreshold — File Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the file suspicious.
• ipThreshold — IP Malicious Threshold. Minimum number of positive results from VT scanners to consider the IP malicious.
• ipSuspiciousThreshold — IP Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the IP suspicious.
• disable_private_ip_lookup — Disable reputation lookups for private IP addresses
• urlThreshold — URL Malicious Threshold. Minimum number of positive results from VT scanners to consider the URL malicious.
• urlSuspiciousThreshold — URL Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the URL suspicious.
• domainThreshold — Domain Malicious Threshold. Minimum number of positive results from VT scanners to consider the Domain malicious.
• domainSuspiciousThreshold — Domain Suspicious Threshold. Minimum number of positive and suspicious results from VT scanners to consider the Domain suspicious.
• preferredVendors — Preferred Vendors List. CSV list of vendors who are considered more trustworthy.
• preferredVendorsThreshold — Preferred Vendor Threshold. The minimum number of highly trusted vendors required to consider a domain, IP address, URL, or file as malicious.
• crowdsourced_yara_rules_enabled — Enable score analyzing by Crowdsourced Yara Rules, Sigma, and IDS
• yaraRulesThreshold — Crowdsourced Yara Rules Threshold
• SigmaIDSThreshold — Sigma and Intrusion Detection Rules Threshold
• domain_popularity_ranking — Domain Popularity Ranking Threshold
• relationship_threshold — Premium Subscription Only: Relationship Malicious Files Threshold
• relationship_suspicious_threshold — Premium Subscription Only: Relationship Suspicious Files Threshold
• ip_relationships — IP Relationships
• domain_relationships — Domain Relationships
• url_relationships — URL Relationships
• file_relationships — File Relationships
• proxy — Use system proxy settings
• insecure — Trust any certificate (not secure)

Commands (22)

• domain — Checks the reputation of a domain.
• file — Checks the file reputation of the specified hash.
• file-rescan — Rescans an already submitted file. This avoids having to upload the file again. Use the vt-analysis-get command to get the scan results.
• file-scan — Submits a file for scanning. Use the vt-analysis-get command to get the scan results.
• ip — Checks the reputation of an IP address.
• url — Checks the reputation of a URL.
• url-scan — Scans a specified URL. Use the vt-analysis-get command to get the scan results.
• vt-analysis-get — Get analysis of a file submitted to VirusTotal.
• vt-comments-add — Adds comments to files and URLs.
• vt-comments-delete — Delete a comment.
• vt-comments-get — Retrieves comments for a given resource.
• vt-comments-get-by-id — Retrieves a comment by comment ID.
• vt-file-sandbox-report — Retrieves a behavioral relationship of the given file hash.
• vt-file-scan-upload-url — Premium API. Get a special URL for files larger than 32 MB.
• vt-file-sigma-analysis — Result of the last Sigma analysis in markdown format.
• vt-passive-dns-data — Returns passive DNS records by indicator.
• vt-privatescanning-analysis-get — Get analysis of a private file or URL submitted to VirusTotal.
• vt-privatescanning-file — Checks the file reputation of the specified private hash.
• vt-privatescanning-file-scan — Submits a file for private scanning. Use the vt-privatescanning-analysis-get command to get the scan results.
• vt-privatescanning-url — Checks the reputation of a private URL.
• vt-privatescanning-url-scan — Submits an URL for private scanning. Use the vt-privatescanning-analysis-get command to get the scan results.
• vt-search — Search for an indicator in Virus Total.