VirusTotal Connection

Connects your agent to VirusTotal for threat intelligence lookups. Check file hashes, URLs, IP addresses, and domains against VirusTotal's database. Read-only — no file submission.

Authentication

API key. Generate from your VirusTotal account > API key.

• api_key — VirusTotal API key (v3)

Premium API key recommended for production use (higher rate limits, additional data).

Endpoints

Files

• GET /api/v3/files/{hash} — Get file report by SHA-256, SHA-1, or MD5 hash
• GET /api/v3/files/{hash}/behaviours — Get sandbox behavioral analysis

URLs

• GET /api/v3/urls/{id} — Get URL analysis report
• POST /api/v3/urls — Submit URL for analysis (does not scan, queues for lookup)

IP Addresses

• GET /api/v3/ip_addresses/{ip} — Get IP reputation, associated files, WHOIS

Domains

• GET /api/v3/domains/{domain} — Get domain reputation, DNS records, associated files

Search

• GET /api/v3/intelligence/search — Search across all entity types (premium)

Rules

• Rate limit: 4 requests/minute (free), 500/minute (premium)
• The agent caches results for 1 hour to stay within rate limits
• Bulk IOC lookups are batched and dispatched to task agents
• File submission is disabled — agent only queries existing reports
• All lookups are logged to audit trail for investigator review