category: Data Enrichment & Threat Intelligence
provider: Google
commonfields:
  id: VirusTotal - Premium (API v3)
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: API Key (leave empty. Fill in the API key in the password field.)
  displaypassword: API Key
  name: credentials
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  defaultvalue: VirusTotal Intelligence LiveHunt Notification
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: '40'
  name: max_fetch
  display: Maximum number of incidents per fetch
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: 3 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days) or a date or epoch timestamp.
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: ''
  display: "Tag: The ruleset's name or the identifier for the YARA rule matching the file to fetch its notifications. Leave blank to fetch all."
  name: tag
  type: 0
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Analyse retro hunts, read live hunt notifications and download files from VirusTotal.
display: VirusTotal - Premium (API v3)
name: VirusTotal - Premium (API v3)
script:
  commands:
  - arguments:
    - default: true
      description: SHA-256, SHA-1 or MD5 identifying the file.
      name: hash
      required: true
    outputs:
    - contextPath: File
      description: The file details command results.
      type: Unknown
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: File.EntryID
      description: The ID for locating the file in the War Room.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Extension
      description: 'The file extension. For example: "xls".'
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
    description: Downloads file from VirusTotal.
    name: vt-private-download-file
  - arguments:
    - default: true
      description: A commma separated list of hashes (SHA-256, SHA-1, or MD5) for the files included in the ZIP.
      isArray: true
      name: file
      required: true
    - description: A password to protect the zip.
      isArray: true
      name: password
      secret: true
    outputs:
    - contextPath: VirusTotal.Zip.id
      description: ID of the zip.
      type: String
    - contextPath: VirusTotal.Zip.type
      description: Type of the ID (zip_file).
      type: String
    - contextPath: VirusTotal.Zip.links.self
      description: Self link to file.
      type: String
    - contextPath: VirusTotal.Zip.attributes.files_error
      description: The number of files resulted in error.
      type: Number
    - contextPath: VirusTotal.Zip.attributes.files_ok
      description: The number of files resulted in success zipped.
      type: Number
    - contextPath: VirusTotal.Zip.attributes.progress
      description: Progress of the zipping command in percentage.
      type: Number
    - contextPath: VirusTotal.Zip.attributes.status
      description: The status of the zip process. "finished" is the state when finished.
      type: String
    description: Creates a password-protected ZIP file containing files from VirusTotal.
    name: vt-private-zip-create
  - arguments:
    - default: true
      description: A zip ID. Can be retrieved from the output of vt-private-zip-create.
      name: zip_id
      required: true
    outputs:
    - contextPath: VirusTotal.Zip.id
      description: ID of the zip.
      type: String
    - contextPath: VirusTotal.Zip.type
      description: Type of the ID (zip_file).
      type: String
    - contextPath: VirusTotal.Zip.links.self
      description: Self link to file.
      type: String
    - contextPath: VirusTotal.Zip.attributes.files_error
      description: The number of files resulted in error.
      type: Number
    - contextPath: VirusTotal.Zip.attributes.files_ok
      description: The number of files resulted in success zipped.
      type: Number
    - contextPath: VirusTotal.Zip.attributes.progress
      description: Progress of the zipping command in percentage.
      type: Number
    - contextPath: VirusTotal.Zip.attributes.status
      description: The status of the zip process. "finished" is the state when finished.
      type: String
    description: Retrieve information about a ZIP file.
    name: vt-private-zip-get
  - arguments:
    - default: true
      description: A zip ID. Can be retrieved from the output of vt-private-zip-create.
      name: zip_id
      required: true
    outputs:
    - contextPath: File
      description: The file details command results.
      type: Unknown
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: File.EntryID
      description: The ID for locating the file in the War Room.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Extension
      description: 'The file extension. For example: "xls".'
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
    description: Download a ZIP file.
    name: vt-private-zip-download
  - arguments:
    - default: true
      description: Sandbox report ID. Can be aquired from vt-file-sandbox-report in VirusTotal (API v3) integration.
      name: report_id
      required: true
    outputs:
    - contextPath: File
      description: The file details command results.
      type: Unknown
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: File.EntryID
      description: The ID for locating the file in the War Room.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Extension
      description: 'The file extension. For example: "xls".'
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
    description: Extracted PCAP from a sandbox analysis.
    name: vt-private-file-sandbox-pcap
  - arguments:
    - description: Search query.
      name: query
      required: true
    - description: Maximum number of results.
      defaultValue: '10'
      name: limit
    - description: The order value can be sorted depends on the query type. See documentation. https://docs.virustotal.com/reference/intelligence-search
      name: order
    - description: Continuation cursor.
      name: cursor
    - description: Whether to return full object information or just object descriptors.
      name: descriptors_only
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - description: Whether to return full data information.
      name: extended_data
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: VirusTotal.IntelligenceSearch.attributes.last_analysis_stats.harmless
      description: number of reports saying that is harmless.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.last_analysis_stats.malicious
      description: number of reports saying that is malicious.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.last_analysis_stats.suspicious
      description: number of reports saying that is suspicious.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.last_analysis_stats.undetected
      description: number of reports saying that is undetected.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.last_analysis_stats.timeout
      description: number of timeouts when analysing this URL/file.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.reputation
      description: file's score calculated from all votes posted by the VirusTotal community.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.last_modification_date
      description: date when the object itself was last modified. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.total_votes.harmless
      description: number of positive votes.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.attributes.total_votes.malicious
      description: number of negative votes.
      type: Number
    - contextPath: VirusTotal.IntelligenceSearch.type
      description: The type of the indicator (ip_address, domain, url, file).
      type: String
    - contextPath: VirusTotal.IntelligenceSearch.id
      description: ID of the indicator.
      type: String
    - contextPath: VirusTotal.IntelligenceSearch.links.self
      description: Link to the response.
      type: String
    description: Search for files.
    name: vt-private-intelligence-search
  - arguments:
    - description: File search query. For example, query="type:peexe size:90kb+ positives:5+ behaviour:'taskkill'".
      name: query
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Return all of the results, note that it can be thousands of results. Prefer not to use in playbooks. The default value is "false".
      name: fullResponse
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: VirusTotal.SearchFile.SearchResult
      description: The hashes of files that fit the query.
      type: string
    - contextPath: VirusTotal.SearchFile.Query
      description: Original search query.
      type: string
    description: Search for files.
    name: vt-private-search-file
  - arguments:
    - default: true
      description: Ruleset identifier. Can be retreived from the vt-private-livehunt-rules-list command.
      name: id
      required: true
    outputs:
    - contextPath: VirusTotal.LiveHuntRule.attributes.name
      description: The rule's name.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.modification_date
      description: last modification date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rules
      description: rule file contents.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.enabled
      description: whether it's enabled or not.
      type: Boolean
    - contextPath: VirusTotal.LiveHuntRule.attributes.creation_date
      description: Creation date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rule_names
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.limit
      description: max number of notifications that will be generated by the ruleset in a 24h period. If a match is found, number of generated hunting notifications in the last 24h is looked up and if it's greater than this limit, that match is ignored.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.number_of_rules
      description: Number of rules presented in the set.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.type
      description: The type of the entry (hunting_ruleset).
      type: String
    - contextPath: VirusTotal.LiveHuntRule.id
      description: ID of the ruleset.
      type: Date
    - contextPath: VirusTotal.LiveHuntRule.links.self
      description: Link to the ruleset.
      type: String
    description: Retrieve VT Hunting livehunt rulesets.
    name: vt-private-livehunt-rules-get-by-id
  - arguments:
    - description: Return the rulesets matching the given criteria only.
      name: filter
    - description: Maximum number of results.
      defaultValue: '10'
      name: limit
    - description: Sort order.
      auto: PREDEFINED
      predefined:
      - "name-"
      - "creation_date-"
      - "modification_date-"
      - "name+"
      - "creation_date+"
      - "modification_date+"
      name: order
    - description: Continuation cursor.
      name: cursor
    - description: Should list only enabled or disabled rules.
      name: enabled
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: VirusTotal.LiveHuntRule.attributes.name
      description: The rule's name.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.modification_date
      description: last modification date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rules
      description: rule file contents.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.enabled
      description: whether it's enabled or not.
      type: Boolean
    - contextPath: VirusTotal.LiveHuntRule.attributes.creation_date
      description: creation date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rule_names
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.limit
      description: max number of notifications that will be generated by the ruleset in a 24h period. If a match is found, number of generated hunting notifications in the last 24h is looked up and if it's greater than this limit, that match is ignored.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.number_of_rules
      description: Number of rules presented in the set.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.type
      description: The type of the entry (hunting_ruleset).
      type: String
    - contextPath: VirusTotal.LiveHuntRule.id
      description: ID of the ruleset.
      type: Date
    - contextPath: VirusTotal.LiveHuntRule.links.self
      description: Link to the ruleset.
      type: String
    description: Retrieve VT Hunting livehunt rulesets.
    name: vt-private-livehunt-rules-list
  - arguments:
    - description: Name of the rule.
      name: name
      required: true
    - description: The rule itself.
      name: yara_rule
      required: true
    - description: Whatever to enable the rule.
      name: enabled
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - description: A comma-separated list of emails to notify.
      name: notification_emails
    - description: max number of notifications that will be generated by the ruleset in a 24h period. If a match is found, number of generated hunting notifications in the last 24h is looked up and if it's greater than this limit, that match is ignored.
      name: limit
    outputs:
    - contextPath: VirusTotal.LiveHuntRule.attributes.name
      description: The rule's name.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.modification_date
      description: last modification date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rules
      description: rule file contents.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.enabled
      description: whether it's enabled or not.
      type: Boolean
    - contextPath: VirusTotal.LiveHuntRule.attributes.creation_date
      description: creation date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rule_names
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.limit
      description: max number of notifications that will be generated by the ruleset in a 24h period. If a match is found, number of generated hunting notifications in the last 24h is looked up and if it's greater than this limit, that match is ignored.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.number_of_rules
      description: Number of rules presented in the set.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.type
      description: The type of the entry (hunting_ruleset).
      type: String
    - contextPath: VirusTotal.LiveHuntRule.id
      description: ID of the ruleset.
      type: Date
    - contextPath: VirusTotal.LiveHuntRule.links.self
      description: Link to the ruleset.
      type: String
    description: Create a new VT Hunting Livehunt ruleset.
    name: vt-private-livehunt-rules-create
  - arguments:
    - default: true
      description: Rule identifier. Can be retrieved from the vt-private-livehunt-rules-list command.
      name: id
      required: true
    - description: The rule itself.
      name: yara_rule
    - description: Whatever to enable the rule.
      name: enabled
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - description: A comma-separated list of emails to notify.
      name: notification_emails
    - description: max number of notifications that will be generated by the ruleset in a 24h period. If a match is found, number of generated hunting notifications in the last 24h is looked up and if it's greater than this limit, that match is ignored.
      name: limit
    outputs:
    - contextPath: VirusTotal.LiveHuntRule.attributes.name
      description: The rule's name.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.modification_date
      description: last modification date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rules
      description: rule file contents.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.enabled
      description: whether it's enabled or not.
      type: Boolean
    - contextPath: VirusTotal.LiveHuntRule.attributes.creation_date
      description: creation date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.rule_names
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.LiveHuntRule.attributes.limit
      description: max number of notifications that will be generated by the ruleset in a 24h period. If a match is found, number of generated hunting notifications in the last 24h is looked up and if it's greater than this limit, that match is ignored.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.attributes.number_of_rules
      description: Number of rules presented in the set.
      type: Number
    - contextPath: VirusTotal.LiveHuntRule.type
      description: The type of the entry (hunting_ruleset).
      type: String
    - contextPath: VirusTotal.LiveHuntRule.id
      description: ID of the ruleset.
      type: Date
    - contextPath: VirusTotal.LiveHuntRule.links.self
      description: Link to the ruleset.
      type: String
    description: Update a VT Hunting Livehunt ruleset.
    name: vt-private-livehunt-rules-update
  - arguments:
    - default: true
      description: Ruleset identifier. Can be retreived from the vt-private-livehunt-rules-list.
      name: id
      required: true
    description: Delete a VT Hunting Livehunt ruleset.
    name: vt-private-livehunt-rules-delete
  - arguments:
    - description: Maximum number of notifications to retrieve. Maximum can be up to 40.
      defaultValue: "10"
      name: limit
    - description: Fetch notification from given time. Can be epoch time, a date or time range (3 days, 1 year).
      name: from_time
    - description: Fetch notification from given time. Can be epoch time or a date.
      name: to_time
    - description: Continuation cursor.
      name: cursor
    - description: Filter notifications by tag.
      name: tag
    outputs:
    - contextPath: VirusTotal.LiveHuntNotification.meta.count
      description: Notification count.
      type: Number
    - contextPath: VirusTotal.LiveHuntNotification.meta.cursor
      description: The cursor of the list.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.attributes.tags
      description: notification tags.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.attributes.source_country
      description: Source country of the notification.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.attributes.source_key
      description: Source key of the notificaton.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.attributes.snippet
      description: The snippet ID (if exists).
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.attributes.rule_name
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.attributes.date
      description: The date of the notification in epoch.
      type: Number
    - contextPath: VirusTotal.LiveHuntNotification.data.attributes.match_in_subfile
      description: whether the match was in a subfile or not.
      type: Boolean
    - contextPath: VirusTotal.LiveHuntNotification.data.type
      description: Type of the notification (hunting_notification).
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.id
      description: The ID of the notification.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.data.links.self
      description: The link to the notificaton.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.links.self
      description: The link to the current page.
      type: String
    - contextPath: VirusTotal.LiveHuntNotification.links.next
      description: The link to the next page.
      type: String
    description: Retrieve VT Hunting Livehunt notifications.
    name: vt-private-livehunt-notifications-list
  - arguments:
    - description: String to search within the hunting notification tags.
      name: filter
    - description: Continuation cursor.
      name: cursor
    - description: Maximum number of notifications to retrieve.
      defaultValue: "10"
      name: limit
    outputs:
    - contextPath: VirusTotal.LiveHuntFiles.meta.count
      description: Total file's count.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.meta.cursor
      description: Cursor of the call.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.type_description
      description: describes the file type.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.tlsh
      description: Trend Micro's TLSH hash.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.vhash
      description: in-house similarity clustering algorithm value, based on a simple structural feature hash allows you to find similar files.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.exiftool
      description: exiftool is a program for extracting Exif metadata from different file formats. Metadata shown may vary depending on the file type, and given the nature of Exif metadata, some fields may appear or not.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.trid.file_type
      description: TrID is a utility designed to identify file types from their binary signatures.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.trid.probability
      description: probability of file format identification (given as percentage).
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.creation_date
      description: extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.reputation
      description: file's score calculated from all votes posted by the VirusTotal community.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.names
      description: all file names associated with the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_modification_date
      description: date when the object itself was last modified. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.type_tag
      description: tag representing the file type. Can be used in vt-private-intelligence-search.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.times_submitted
      description: number of times the file has been posted to VirusTotal.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.total_votes.harmless
      description: number of positive votes.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.total_votes.malicious
      description: number of negative votes.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.size
      description: file size in bytes.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.type_extension
      description: specifies file extension.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_submission_date
      description: most recent date the file was posted to VirusTotal. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.downloadable
      description: true if the file can be downloaded, false otherwise. (use vt-private-download-file) to download the file).
      type: Boolean
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.sha256
      description: SHA-256 of the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.tags
      description: The file's tags.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_date
      description: most recent scan date. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.unique_sources
      description: indicates from how many different sources the file has been posted from.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.first_submission_date
      description: date when the file was first seen in VirusTotal. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.ssdeep
      description: SSDeep of the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.md5
      description: MD5 of the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.sha1
      description: SHA-1 if the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.magic
      description: magic identifier of this app in hex format.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.main_icon.raw_md5
      description: MD5 of the file's icon.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.main_icon.dhash
      description: The dhash of the file's icon.
      type: Date
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.harmless
      description: number of reports saying that is harmless.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.type-unsupported
      description: number of AV engines that don't support that type of file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.suspicious
      description: number of reports saying that is suspicious.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.confirmed-timeout
      description: number of AV engines that reach a timeout when analysing that file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.timeout
      description: number of timeouts when analysing this URL/file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.failure
      description: number of AV engines that fail when analysing that file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.malicious
      description: number of reports saying that is malicious.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.undetected
      description: number of reports saying that is undetected.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.meaningful_name
      description: the most interesting name out of all file's names.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.type
      description: Type of the entry (file).
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.id
      description: file ID.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.links.self
      description: link to the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_id
      description: The notification ID the file is connected to.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_source_key
      description: The notification's source key.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_tags
      description: notification tags.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.ruleset_name
      description: matched rule's ruleset name.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_source_country
      description: The notification's source country of the notification.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.rule_name
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_snippet
      description: The notification snippet ID.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.ruleset_id
      description: VirusTotal's ruleset ID.
      type: Date
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_date
      description: The notification date in epch.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.match_in_subfile
      description: whether the match was in a subfile or not.
      type: Boolean
    - contextPath: VirusTotal.LiveHuntFiles.links.self
      description: Link to the current apge.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.links.next
      description: Link to the next page.
      type: String
    description: Retrieve file objects for VT Hunting Livehunt notifications.
    name: vt-private-livehunt-notifications-files-list
  - arguments:
    - description: Hashes to search within VirusTotal. Will search only hashes and will ignore any other value.
      isArray: true
      name: hash
      required: true
    - description: Continuation cursor.
      name: cursor
    outputs:
    - contextPath: VirusTotal.LiveHuntFiles.meta.count
      description: Total file's count.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.meta.cursor
      description: Cursor of the call.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.type_description
      description: describes the file type.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.tlsh
      description: Trend Micro's TLSH hash.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.vhash
      description: in-house similarity clustering algorithm value, based on a simple structural feature hash allows you to find similar files.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.exiftool
      description: exiftool is a program for extracting Exif metadata from different file formats. Metadata shown may vary depending on the file type, and given the nature of Exif metadata, some fields may appear or not.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.trid.file_type
      description: TrID is a utility designed to identify file types from their binary signatures.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.trid.probability
      description: probability of file format identification (given as percentage).
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.creation_date
      description: extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.reputation
      description: file's score calculated from all votes posted by the VirusTotal community.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.names
      description: all file names associated with the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_modification_date
      description: date when the object itself was last modified. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.type_tag
      description: tag representing the file type. Can be used in vt-private-intelligence-search.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.times_submitted
      description: number of times the file has been posted to VirusTotal.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.total_votes.harmless
      description: number of positive votes.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.total_votes.malicious
      description: number of negative votes.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.size
      description: file size in bytes.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.type_extension
      description: specifies file extension.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_submission_date
      description: most recent date the file was posted to VirusTotal. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.downloadable
      description: true if the file can be downloaded, false otherwise. (use vt-private-download-file) to download the file).
      type: Boolean
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.sha256
      description: SHA-256 of the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.tags
      description: The file's tags.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_date
      description: most recent scan date. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.unique_sources
      description: indicates from how many different sources the file has been posted from.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.first_submission_date
      description: date when the file was first seen in VirusTotal. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.ssdeep
      description: SSDeep of the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.md5
      description: MD5 of the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.sha1
      description: SHA-1 if the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.magic
      description: magic identifier of this app in hex format.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.main_icon.raw_md5
      description: MD5 of the file's icon.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.main_icon.dhash
      description: The dhash of the file's icon.
      type: Date
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.harmless
      description: number of reports saying that is harmless.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.type-unsupported
      description: number of AV engines that don't support that type of file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.suspicious
      description: number of reports saying that is suspicious.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.confirmed-timeout
      description: number of AV engines that reach a timeout when analysing that file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.timeout
      description: number of timeouts when analysing this URL/file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.failure
      description: number of AV engines that fail when analysing that file.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.malicious
      description: number of reports saying that is malicious.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.last_analysis_stats.undetected
      description: number of reports saying that is undetected.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.attributes.meaningful_name
      description: the most interesting name out of all file's names.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.type
      description: Type of the entry (file).
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.id
      description: file ID.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.links.self
      description: link to the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_id
      description: The notification ID the file is connected to.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_source_key
      description: The notification's source key.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_tags
      description: notification tags.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.ruleset_name
      description: matched rule's ruleset name.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_source_country
      description: The notification's source country of the notification.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.rule_name
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_snippet
      description: The notification snippet ID.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.ruleset_id
      description: VirusTotal's ruleset ID.
      type: Date
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.notification_date
      description: The notification date in epch.
      type: Number
    - contextPath: VirusTotal.LiveHuntFiles.data.context_attributes.match_in_subfile
      description: whether the match was in a subfile or not.
      type: Boolean
    - contextPath: VirusTotal.LiveHuntFiles.links.self
      description: Link to the current apge.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.links.next
      description: Link to the next page.
      type: String
    description: Retrieve file objects for VT Hunting Livehunt notifications.
    name: vt-private-livehunt-notifications-files-get-by-hash
  - arguments:
    - default: true
      description: Rule identifier. Can be retrieved from the vt-private-livehunt-rules-list command.
      name: id
      required: true
    - description: Continuation cursor.
      name: cursor
    - description: Maximum number of notifications to retrieve.
      defaultValue: "10"
      name: limit
    outputs:
    - contextPath: VirusTotal.LiveHuntFiles.id
      description: ID of the file.
      type: String
    - contextPath: VirusTotal.LiveHuntFiles.type
      description: Type of the entry (file).
      type: String
    description: Get a VT Hunting Livehunt ruleset by hunting notification files relationship.
    name: vt-private-livehunt-rule-list-files
  - arguments:
    - description: Return the jobs matching the given criteria only.
      name: filter
    - description: Continuation cursor.
      name: cursor
    - description: Maximum number jobs to retrieve.
      defaultValue: "10"
      name: limit
    outputs:
    - contextPath: VirusTotal.RetroHuntJob.attributes.status
      description: can be either "starting", "running", "aborting", "aborted" or "finished".
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.finish_date
      description: date when the Retrohunt job finished.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.rules
      description: The ruleset in the job.
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.num_matches_outside_time_range
      description: Matches outside time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.scanned_bytes
      description: Total scanned bytes.
      type: Date
    - contextPath: VirusTotal.RetroHuntJob.attributes.time_range.start
      description: Start of job's time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.time_range.end
      description: End of job's time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.num_matches
      description: Number of matches.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.progress
      description: The progress in percentage.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.corpus
      description: Corpus of the job (main/goodware).
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.creation_date
      description: Job's creation date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.start_date
      description: The start date of the job in epch.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.type
      description: Type of the entry (retrohunt_job).
      type: String
    - contextPath: VirusTotal.RetroHuntJob.id
      description: ID of the retro job.
      type: String
    - contextPath: VirusTotal.RetroHuntJob.links.self
      description: Link to the entry.
      type: String
    description: Get a VT Hunting Livehunt ruleset by hunting notification files relationship.
    name: vt-private-retrohunt-jobs-list
  - arguments:
    - default: true
      description: Job identifier. Can be acquired from vt-private-retrohunt-jobs-list.
      name: id
      required: true
    outputs:
    - contextPath: VirusTotal.RetroHuntJob.attributes.status
      description: can be either "starting", "running", "aborting", "aborted" or "finished".
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.finish_date
      description: date when the Retrohunt job finished.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.rules
      description: The ruleset in the job.
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.num_matches_outside_time_range
      description: Matches outside time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.scanned_bytes
      description: Total scanned bytes.
      type: Date
    - contextPath: VirusTotal.RetroHuntJob.attributes.time_range.start
      description: Start of job's time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.time_range.end
      description: End of job's time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.num_matches
      description: Number of matches.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.progress
      description: The progress in percentage.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.corpus
      description: Corpus of the job (main/goodware).
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.creation_date
      description: Job's creation date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.start_date
      description: The start date of the job in epch.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.type
      description: Type of the entry (retrohunt_job).
      type: String
    - contextPath: VirusTotal.RetroHuntJob.id
      description: ID of the retro job.
      type: String
    - contextPath: VirusTotal.RetroHuntJob.links.self
      description: Link to the entry.
      type: String
    description: Retrieve a retrohunt job.
    name: vt-private-retrohunt-jobs-get-by-id
  - arguments:
    - default: true
      description: Job identifier. Can be acquired from vt-private-retrohunt-jobs-list.
      name: id
      required: true
    - description: Whether to return full data information.
      name: extended_data
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.type_description
      description: describes the file type.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.tlsh
      description: Trend Micro's TLSH hash.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.vhash
      description: in-house similarity clustering algorithm value, based on a simple structural feature hash allows you to find similar files.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.exiftool
      description: exiftool is a program for extracting Exif metadata from different file formats. Metadata shown may vary depending on the file type, and given the nature of Exif metadata, some fields may appear or not.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.trid.file_type
      description: TrID is a utility designed to identify file types from their binary signatures.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.trid.probability
      description: probability of file format identification (given as percentage).
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.crowdsourced_yara_results.rule_name
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.crowdsourced_yara_results.description
      description: matched rule description.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.crowdsourced_yara_results.author
      description: rule author.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.crowdsourced_yara_results.ruleset_id
      description: VirusTotal's ruleset ID.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.crowdsourced_yara_results.ruleset_name
      description: matched rule's ruleset name.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.crowdsourced_yara_results.match_in_subfile
      description: whether the match was in a subfile or not.
      type: Boolean
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.crowdsourced_yara_results.source
      description: ruleset source.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.creation_date
      description: extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.names
      description: all file names associated with the file.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_modification_date
      description: date when the object itself was last modified. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.type_tag
      description: tag representing the file type. Can be used in vt-private-intelligence-search.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.capabilities_tags
      description: list of representative tags related to the file's capabilities.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.total_votes.harmless
      description: number of positive votes.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.total_votes.malicious
      description: number of negative votes.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.size
      description: file size in bytes.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.authentihash
      description: sha256 hash used by Microsoft to verify that the relevant sections of a PE image file have not been altered. This specific type of hash is used by Microsoft AppLocker.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.times_submitted
      description: number of times the file has been posted to VirusTotal.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_submission_date
      description: most recent date the file was posted to VirusTotal. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.meaningful_name
      description: the most interesting name out of all file's names.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.downloadable
      description: true if the file can be downloaded, false otherwise.
      type: Boolean
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.sha256
      description: SHA-256 of the file.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.type_extension
      description: specifies file extension.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.tags
      description: list of representative tags related to the file's capabilities.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_date
      description: Most recent scan date. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.unique_sources
      description: indicates from how many different sources the file has been posted from.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.first_submission_date
      description: date when the file was first seen in VirusTotal. UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.sha1
      description: SHA-1 of the file.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.magic
      description: magic identifier of this app in hex format.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.ssdeep
      description: SSDeep of the file.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.md5
      description: MD5 of the file.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.harmless
      description: number of reports saying that is harmless.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.type-unsupported
      description: number of AV engines that don't support that type of file.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.suspicious
      description: number of reports saying that is suspicious.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.confirmed-timeout
      description: number of AV engines that reach a timeout when analysing that file.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.timeout
      description: number of timeouts when analysing this URL/file.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.failure
      description: number of AV engines that fail when analysing that file.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.malicious
      description: number of reports saying that is malicious.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.last_analysis_stats.undetected
      description: number of reports saying that is undetected.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.reputation
      description: file's score calculated from all votes posted by the VirusTotal community.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.sigma_analysis_stats.high
      description: number of matched high severity rules.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.sigma_analysis_stats.medium
      description: number of matched medium severity rules.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.sigma_analysis_stats.critical
      description: number of matched critical severity rules.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.attributes.sigma_analysis_stats.low
      description: number of matched low severity rules.
      type: Number
    - contextPath: VirusTotal.RetroHuntJobFiles.type
      description: The type of the entry (file).
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.id
      description: ID of file.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.links.self
      description: A link to the entry.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.context_attributes.rule_name
      description: contains the names of all rules in the ruleset.
      type: String
    - contextPath: VirusTotal.RetroHuntJobFiles.context_attributes.match_in_subfile
      description: whether the match was in a subfile or not.
      type: Boolean
    description: Retrieve matches for a retrohunt job matching file relationship.
    name: vt-private-retrohunt-jobs-get-matching-files
  - arguments:
    - description: The rules to create. https://yara.readthedocs.io/en/stable/
      name: rules
      required: true
    - description: The "main" corpus is a composition of files sent to VirusTotal during the last few months. The "goodware" corpus is a random selection of ~1.000.000 files from the NSRL that are not detected by any antivirus engine.
      name: corpus
      defaultValue: "main"
      auto: PREDEFINED
      predefined:
      - "main"
      - "goodware"
    - description: A comma-separated list of emails to notify.
      name: notification_email
    - description: Fetch retrohunt jobs from given time. Can be epoch time, a date or time range (3 days, 1 year).
      name: start_time
    - description: Fetch retrohunt jobs to given time. Can be epoch time, a date or time range. If start_time supplied and not end_time, end_time will be the current time.
      name: end_time
    outputs:
    - contextPath: VirusTotal.RetroHuntJob.attributes.status
      description: can be either "starting", "running", "aborting", "aborted" or "finished".
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.finish_date
      description: date when the Retrohunt job finished.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.rules
      description: The ruleset in the job.
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.num_matches_outside_time_range
      description: Matches outside time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.scanned_bytes
      description: Total scanned bytes.
      type: Date
    - contextPath: VirusTotal.RetroHuntJob.attributes.time_range.start
      description: Start of job's time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.time_range.end
      description: End of job's time range.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.num_matches
      description: Number of matches.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.progress
      description: The progress in percentage.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.corpus
      description: Corpus of the job (main/goodware).
      type: String
    - contextPath: VirusTotal.RetroHuntJob.attributes.creation_date
      description: Job's creation date as UTC timestamp.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.attributes.start_date
      description: The start date of the job in epch.
      type: Number
    - contextPath: VirusTotal.RetroHuntJob.type
      description: Type of the entry (retrohunt_job).
      type: String
    - contextPath: VirusTotal.RetroHuntJob.id
      description: ID of the retro job.
      type: String
    - contextPath: VirusTotal.RetroHuntJob.links.self
      description: Link to the entry.
      type: String
    description: Create a new retrohunt job.
    name: vt-private-retrohunt-jobs-create
  - arguments:
    - default: true
      description: User ID or API key. If not supplied, will use the API Key configured in the integration.
      name: id
      secret: true
    outputs:
    - contextPath: VirusTotal.QuotaLimits.cases_creation_monthly.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.cases_creation_monthly.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_vtdiff_creation_monthly.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.intelligence_vtdiff_creation_monthly.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_vtdiff_creation_monthly.group.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_vtdiff_creation_monthly.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_vtdiff_creation_monthly.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_uploaded_files.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_uploaded_files.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_uploaded_bytes.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_uploaded_bytes.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_storage_files.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_storage_files.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_monthly.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.api_requests_monthly.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_monthly.group.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_monthly.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_monthly.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_downloads_monthly.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.intelligence_downloads_monthly.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_downloads_monthly.group.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_downloads_monthly.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_downloads_monthly.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_hourly.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.api_requests_hourly.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_hourly.group.allowed
      description: hourly api requests group's quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_hourly.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_hourly.user.allowed
      description: hourly api requests user's quota limit.
      type: Date
    - contextPath: VirusTotal.QuotaLimits.intelligence_hunting_rules.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.intelligence_hunting_rules.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_hunting_rules.group.allowed
      description: intelligence_hunting_rules group's quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_hunting_rules.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_hunting_rules.user.allowed
      description: intelligence_hunting_rules user's quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_graphs_private.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.intelligence_graphs_private.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_graphs_private.group.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_graphs_private.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_graphs_private.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_daily.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.api_requests_daily.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_daily.group.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_daily.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.api_requests_daily.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_storage_bytes.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.monitor_storage_bytes.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_retrohunt_jobs_monthly.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.intelligence_retrohunt_jobs_monthly.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_retrohunt_jobs_monthly.group.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_retrohunt_jobs_monthly.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_retrohunt_jobs_monthly.user.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_searches_monthly.group.inherited_from
      description: group from which the quota is inherited.
      type: String
    - contextPath: VirusTotal.QuotaLimits.intelligence_searches_monthly.group.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_searches_monthly.group.allowed
      description: quota limit.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_searches_monthly.user.group.used
      description: quota has been used.
      type: Number
    - contextPath: VirusTotal.QuotaLimits.intelligence_searches_monthly.user.allowed
      description: quota limit.
      type: Number
    description: Retrieve user's API usage.
    name: vt-private-quota-limits-list
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.14.12277297
defaultmapperin: VirusTotal Intelligence LiveHunt Notification
fromversion: 5.5.0
tests:
- VirusTotal Premium v3 TestPlaybook