> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# VirusTotal API

> Check file hashes, URLs, domains and IP addresses against VirusTotal, and submit and share new ones, from an agent

The common uses are phishing triage, where an agent checks the links, sender domain and attachments of a reported email, and alert enrichment, where an agent adds VirusTotal's verdict on the hash or IP address in a security alert to the ticket.

<Info>
  Automatically enabled when you configure VirusTotal permissions in your agent workflow.
</Info>

## What it does

* Read the report on a file hash, URL, domain or IP address: how many security vendors flag it as malicious or suspicious, the scan date, the threat name, categories, a domain's age and DNS, an IP address's network and country
* Read what a file did in VirusTotal's sandboxes, the MITRE ATT\&CK techniques, and the domains, IPs and files related to an indicator
* Upload a file (up to 32 MB) or a URL, ask for a new analysis, and read the result; what is submitted is shared with the VirusTotal community
* Read and post comments and votes, and delete the account's own comments
* With the licences for them: Private Scanning, VT Intelligence search, Livehunt and Retrohunt, collections, graphs and saved searches, your VirusTotal group's users, service accounts and quota, and VirusTotal Monitor

The agent reports the counts as VirusTotal gives them, and never calls a file or URL that VirusTotal has not seen clean. Neo adds your API key to each call and removes API keys from every answer.

## Permission groups

| Group | Covers |
| - | - |
| Threat Reports & Search | Reports on files, URLs, domains and IP addresses, sandbox behaviour, relationships, analyses, search and VT Intelligence search, MITRE ATT\&CK, YARA and Sigma rules. Read only |
| Scans & Rescans | Uploading files and URLs, new analyses of files, URLs, domains and IP addresses, and Code Insights. Shared with the VirusTotal community |
| Comments & Votes | Comments and votes, posted under your VirusTotal account where the community reads them |
| Private Scanning | Private file and URL analyses, which are not shared, and their reports |
| Collections, Graphs & Saved Searches | Your collections of indicators, VT Graph investigations and saved searches, and who they are shared with |
| Livehunt, Retrohunt & IoC Stream | Livehunt rulesets and notifications, Retrohunt jobs, the IoC Stream |
| Users, Group & Service Accounts | Your VirusTotal user, group members, administrators, roles, service accounts, quotas, API use and activity log |
| VirusTotal Monitor | Monitored files and folders, their analyses, events and statistics, and comments on detections |

| Profile | What it does |
| - | - |
| Read Only | Reads every group, submits and changes nothing |
| Helpdesk | Reads reports and scans privately. Submissions, comments, votes, collections and hunting ask a technician first; users, group and Monitor are read only |
| IT Admin | Submits, comments, votes, hunts and manages collections on its own. Changes to your VirusTotal group's members, roles and service accounts ask a technician |
| Full Automation | Every operation Neo sends, with no approval |

## Safety Controls

Neo does not send these:

* File downloads, the ZIP files and download links that deliver them, and feed batches: each is a live malware sample or a compressed file an agent cannot read
* Sandbox EVTX logs, PCAPs, memory dumps and HTML pages: binary files or pages for a browser; the same behaviour report reads as data
* The large-file upload addresses, which take files over 32 MB: the agent looks a larger file up by its SHA-256
* Deleting all Livehunt rulesets at once: delete each by its id. The bulk deletes of Livehunt notifications and IoC Stream notifications run only with a filter, because without one VirusTotal deletes every notification
* Deleting a VirusTotal user account
* Screenshots and the VT Augment widget page

## Setup

See [Connecting VirusTotal to Neo](/integrations/virustotal/connecting-to-neo).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.