VirusTotal
by Google
VirusTotal returns verdicts from many antivirus engines and URL scanners for any file hash, URL, domain or IP address, along with first seen dates, reputation, relationships and, on premium plans, threat feeds. Enriching the hashes and indicators your own tools collect, and storing those reports in the Lake, shows how much of last month's alert volume involved artifacts already known to be malicious.
- Category
- IT, Security & Monitoring
- Type
- Threat intelligence
- Interface
- REST API
- Built with
- Connect Any API
- Credentials
- API key
02Data
What you can sync.
- File reports
- Url reports
- Domain reports
- Ip reports
- Threat feeds
Join VirusTotal file reports with assets and people data to see risk by team, system and owner.
Need more? Name any other VirusTotal data the API returns, and the AI adds it to the connector.
03Credentials
Credentials you will need.
- An API key
VirusTotal uses an API key. You add the credentials once, when the AI asks for them, and it tells you where to create them in Google if you need help.
04Questions
Questions you can answer.
Once VirusTotal data is in your Lake, ask an AI Mind in plain words or build the answer in DataPrism BI.
- Which file hashes from endpoint alerts last month had more than five engine detections?
- Which domains in phishing emails had a malicious verdict, and when were they first seen?
- How many IP addresses in firewall deny logs have a negative reputation score?
- Which indicators in our own threat list have no VirusTotal detections and need review?
- Which URLs from blocked email campaigns are still reported as malicious today?
05How it works
How it works in DataMind.
-
Pick VirusTotal.
Open Lake, pick VirusTotal in the source picker and name the connection. Connect Any API opens with a ready prompt that points the AI at the VirusTotal API docs.
-
Answer a few questions.
The AI reads the VirusTotal documentation, then asks which credentials you will use, which data to sync (for example file reports and url reports), whether you want a one-time load or a recurring sync, and which accounts or filters apply.
-
Your data lands in Lake.
It builds the connector, tests it and shows you sample rows. Then VirusTotal data loads into your Lake on your schedule, ready for the Warehouse, DataPrism BI and AI Minds.
06Pairs
Works well with VirusTotal.
Sources teams join with VirusTotal in the Warehouse, each one connected the same way.
