Skip to main content
The common uses are phishing triage, where an agent checks the links, sender domain and attachments of a reported email, and alert enrichment, where an agent adds VirusTotal’s verdict on the hash or IP address in a security alert to the ticket.
Automatically enabled when you configure VirusTotal permissions in your agent workflow.

​
What it does

  • Read the report on a file hash, URL, domain or IP address: how many security vendors flag it as malicious or suspicious, the scan date, the threat name, categories, a domain’s age and DNS, an IP address’s network and country
  • Read what a file did in VirusTotal’s sandboxes, the MITRE ATT&CK techniques, and the domains, IPs and files related to an indicator
  • Upload a file (up to 32 MB) or a URL, ask for a new analysis, and read the result; what is submitted is shared with the VirusTotal community
  • Read and post comments and votes, and delete the account’s own comments
  • With the licences for them: Private Scanning, VT Intelligence search, Livehunt and Retrohunt, collections, graphs and saved searches, your VirusTotal group’s users, service accounts and quota, and VirusTotal Monitor
The agent reports the counts as VirusTotal gives them, and never calls a file or URL that VirusTotal has not seen clean. Neo adds your API key to each call and removes API keys from every answer.

​
Permission groups

​
Safety Controls

Neo does not send these:
  • File downloads, the ZIP files and download links that deliver them, and feed batches: each is a live malware sample or a compressed file an agent cannot read
  • Sandbox EVTX logs, PCAPs, memory dumps and HTML pages: binary files or pages for a browser; the same behaviour report reads as data
  • The large-file upload addresses, which take files over 32 MB: the agent looks a larger file up by its SHA-256
  • Deleting all Livehunt rulesets at once: delete each by its id. The bulk deletes of Livehunt notifications and IoC Stream notifications run only with a filter, because without one VirusTotal deletes every notification
  • Deleting a VirusTotal user account
  • Screenshots and the VT Augment widget page

​
Setup

See Connecting VirusTotal to Neo.