VirusTotal

VirusTotal checks files, URLs, domains and IP addresses against about 70 security vendors and its own sandboxes, and shares what its users submit with the security community. Connect it, and Neo agents check the indicators in a ticket or a security alert while they work it.

​

What Neo can do with VirusTotal

• Check the attachments, links, sender domain and IP addresses of a reported phishing email, and write each verdict into the ticket: how many security vendors flag it, when VirusTotal last scanned it, and the threat name
• Add VirusTotal’s verdict on the file hash, domain or IP address in an EDR or SIEM alert to the alert’s ticket
• Read what a file did in VirusTotal’s sandboxes: processes, files written, registry changes, the domains and IPs it contacted, and the MITRE ATT&CK techniques
• Upload a file or a URL VirusTotal has not seen, or ask for a new analysis, so it is shared with the community, and post your verdict as a vote or comment
• With a licence for them: Private Scanning, VT Intelligence search, Livehunt and Retrohunt, collections and graphs, and your VirusTotal group’s users and quota

See VirusTotal API for the permission groups and profiles. Indicators are about threats, so there is no company mapping to set up.

​

What VirusTotal shares

VirusTotal adds every file, URL, domain and IP address that is looked up or submitted to its dataset, where its community can see it. Uploaded files can be downloaded by VirusTotal’s premium customers. Neo’s agents follow these rules:

• They never upload a file that may hold a client’s own data (a document, a spreadsheet, a PDF, an email, or an archive of those) unless your instructions allow it, or to Private Scanning. They look up its hash instead.
• They never look up or submit a URL that carries a person’s data or a secret, such as an email address, a sign-in or password reset link, or a share link. They check its domain instead.
• They never post a client’s name, a person’s name, an internal host or a ticket number in a comment.

To analyse files and links that may hold your clients’ data without sharing them, use VirusTotal’s Private Scanning licence and the Private Scanning permission group.

​

Which VirusTotal key you need

VirusTotal’s terms allow the free Public API only for non-commercial use, and limit it to 4 requests a minute and 500 a day. For an MSP’s agents, use a key with a Premium API licence (VirusTotal Enterprise or Google Threat Intelligence), whose quota your licence sets. Private Scanning, VT Intelligence search and VT Hunting each need their own licence; without one, VirusTotal refuses those calls and the agent says so.

​

Next steps