virustotalv3
Use the virustotalv3 operator to enrich observables with comprehensive threat intelligence using the ThreatStream VirusTotal v3 enrichment, including detailed statistics and community insights.\
Note: For more information on Google Threat Intelligence, the gti operator provides enhanced threat intelligence capabilities.
Syntax
query | virustotalv3 <ioc_field_or_literal>
<ioc_field_or_literal>
|
The field name containing the observable. |
Usage
You can use the virustotalv3 operator to enrich your observables based on the latest VirusTotal intelligence and, therefore, inform your security orchestration, automation and response actions. For example, you can use the virustotalv3 operator to determine whether there is community consensus about an IP address in security reporting, and then filter or tag observables based on the VirusTotal verdicts and the community consensus. This is especially useful for security analysts who need consolidated verdicts, enrichment data, and community feedback for threat detection, investigation, and automation workflows.
Specifically, the operator returns results that contain information about the primary IOC, its associated IOCs, the number of engines that flagged the observable as either being malicious, suspicious, or harmless, along with community statistics or reports assigning it one of these statuses, and the timestamp of the most recent analysis performed on the IOC.
Note: The virustotalv3 operator uses the VirusTotal API key associated with the VirusTotal enrichment configured for your ThreatStream organization. If your organization uses a public API key, VirusTotal limits the number of API requests per minute and per day. Be sure to refine your query and use the limit operator to reduce the number of requests to VirusTotal.
Examples
Example 1: Query VirusTotal v3 API for IP address threat intelligence.
example_api_proxy | calc srcip= '123.122.221.231' | virustotalv3 srcip