To analyze (detonate) the indicator, you can use the following playbooks:Įach reputation command will use at least 1 API call. The following commands will no longer analyze the file/url sent to it, but will get the information stored in VirusTotal. Instead, you can use the following output paths that return concrete indicator reputations. Removed output paths: Due to changes in VirusTotal API, the following output paths are no longer supported:

Reputation commands (ip, url, domain, and file) # The following lists the changes in this version according to the commands from the VirusTotal integration. If you want to decrease the use of the API quota, you can disable it. The premium API analysis can call up to 4 API calls per indicator. If the relationship is found to be suspicious, the indicator will be considered suspicious.If the relationship is found to be suspicious and the basic score is suspicious, the indicator will be considered malicious.If the relationship is found to be malicious, the indicator will be considered malicious.The premium API analysis will check 3 file relationships of each indicator (domain, url, and ip). If the organization is using the premium subscription of VirusTotal, you can use the premium API analysis. total_malicious=0 >= 3 Copy Premium analysis - Relationship Files Threshold # You can aquire those calculation on all of the indicators also from the debug log.Įxample of a VirusTotal (API v3) DBot score log:įound safe by relationship files. The DbotScore calculation process can be seen on the 'description' field in any malicious/suspicious DBot score. If the indicator was found to be suspicious only by the rules thresholds, the indicator will be considered suspicious. If both the the basic analysis and the rules analysis is suspicious, the indicator will be considered as malicious.Indicators with positive results, the number of found YARA rules results, Sigma analysis, or IDS equal to or higher than the threshold, will be considered suspicious.If the YARA rules analysis threshold is enabled: The integration will calculate its average and will compare it to the threshold. Domain popularity ranks: VirusTotal is returning a popularity ranks for each vendor.Indicators with positive results equal to or higher than half of the threshold value, and lower than the threshold, will be considered suspicious.Indicators with positive results equal to or higher than the threshold will be considered malicious.Indicators with positive results from preferred vendors equal to or higher than the threshold will be considered malicious.You can also specify the threshold as an argument when running relevant commands. Indicator Thresholds #Ĭonfigure the default threshold for each indicator type in the instance settings. The following information describes DBot Score which is new for this version. Your API key carries all your privileges, so keep it secure and don't share it with anyone. Your API key can be found in your VirusTotal account user menu: See Premium analysis - Relationship Files ThresholdĬlick Test to validate the URLs, token, and connection. Premium Subscription Only: Relationship Files Threshold Sigma and Intrusion Detection Rules Threshold The minimum number of highly trusted vendors required to consider a domain, IP address, URL, or file as malicious.Įnable score analyzing by Crowdsourced Yara Rules, Sigma, and IDS CSV list of vendors who are considered more trustworthy. Minimum number of positive results from VT scanners to consider the domain malicious. Minimum number of positive results from VT scanners to consider the URL malicious.ĭomain Threshold. Minimum number of positive results from VT scanners to consider the IP malicious. Minimum number of positive results from VT scanners to consider the file malicious. See Premium analysis - Relationship Files Threshold)įile Threshold. Reliability of the source providing the intelligence data Navigate to Settings > Integrations > Servers & Services.Ĭlick Add instance to create and configure a new integration instance.

Configure VirusTotal (API v3) on Cortex XSOAR # The integration was integrated and tested with version v3 API of VirusTotal. This integration analyzes suspicious hashes, URLs, domains, and IP addresses. Supported Cortex XSOAR versions: 5.5.0 and later.

Virustotal uploader hash search failed