Look up VirusTotal reputation for IPs, domains, files and URLs, scan URLs, and work with comments, votes, sandbox behaviour, ATT&CK data and saved searches.
Explore 78 workflow actions for VirusTotal, including account permissions and operation limits.
57 read actions21 write actions
WORKFLOW ACTIONS
What you can configure.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Analyze code with Code Insights
Write
Describe a Base64 disassembled or decompiled code block for malware analysis (50 a day).
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Comment on domain
Write
Post a community comment on a domain (#tags in the text become tags).
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Comment on file
Write
Post a community comment on a file (#tags in the text become tags).
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Comment on IP address
Write
Post a community comment on a IP address (#tags in the text become tags).
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Comment on URL
Write
Post a community comment on a URL (#tags in the text become tags).
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Create saved search
Write
Save a search query as a private or public saved search you own.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete comment
Write
Delete one of your comments.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Delete saved search
Write
Delete a saved search you own.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Get analysis
Read
Read a analysis.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get behaviour report HTML
Read
Read a sandbox behaviour report as HTML.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get comment
Read
Read a comment, with relationships if asked.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get DNS resolution
Read
Read a DNS resolution object (an IP address and domain pair).
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get domain report
Read
Read a domain's reputation, last analysis stats and attributes.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get file behaviour summary
Read
Summarize every sandbox behaviour report for a file.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get file MITRE ATT&CK summary
Read
Summarize the MITRE ATT&CK techniques observed for a file, per sandbox.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get file report
Read
Read a file's reputation, last analysis stats and attributes.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get IP address report
Read
Read a IP address's reputation, last analysis stats and attributes.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get MITRE ATT&CK tactic
Read
Read a MITRE ATT&CK tactic.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get MITRE ATT&CK technique
Read
Read a MITRE ATT&CK technique.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get operation
Read
Read the status of a long-running operation.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get port analysis
Read
Read a port analysis.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get port info
Read
Read a port info.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get sandbox behaviour report
Read
Read a sandbox behaviour report.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get saved search
Read
Read a saved search.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get Sigma rule
Read
Read a crowdsourced Sigma rule.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get submission
Read
Read a submission object.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get URL report
Read
Read a URL's reputation, last analysis stats and attributes.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Get YARA ruleset
Read
Read a crowdsourced YARA ruleset.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List analysis relationship descriptors
Read
List the IDs and context of objects related to a analysis.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List comment relationship descriptors
Read
List the IDs of objects related to a comment.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List domain comments
Read
List community comments on a domain.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List domain relationship descriptors
Read
List the IDs and context of objects related to a domain.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List domain votes
Read
List community harmless or malicious votes on a domain.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List file behaviour reports
Read
List every sandbox behaviour report for a file.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List file comments
Read
List community comments on a file.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List file relationship descriptors
Read
List the IDs and context of objects related to a file.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List file votes
Read
List community harmless or malicious votes on a file.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List IP address comments
Read
List community comments on a IP address.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List IP address relationship descriptors
Read
List the IDs and context of objects related to a IP address.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List IP address votes
Read
List community harmless or malicious votes on a IP address.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List IP technologies
Read
List the technologies detected on an IP address's open ports.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List latest comments
Read
List the latest community comments, filtered by tag or text.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List MITRE ATT&CK tactic relationship descriptors
Read
List the IDs and context of objects related to a MITRE ATT&CK tactic.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List MITRE ATT&CK technique relationship descriptors
Read
List the IDs and context of objects related to a MITRE ATT&CK technique.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to analysis
Read
List objects related to a analysis through a relationship.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to comment
Read
List objects related to a comment, like its author or item.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to domain
Read
List objects related to a domain through a relationship, like resolutions or communicating files.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to file
Read
List objects related to a file through a relationship, like resolutions or communicating files.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to IP address
Read
List objects related to a IP address through a relationship, like resolutions or communicating files.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to MITRE ATT&CK tactic
Read
List objects related to a MITRE ATT&CK tactic through a relationship.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to MITRE ATT&CK technique
Read
List objects related to a MITRE ATT&CK technique through a relationship.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to port analysis
Read
List objects related to a port analysis through a relationship.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to port info
Read
List objects related to a port info through a relationship.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to sandbox behaviour report
Read
List objects related to a sandbox behaviour report through a relationship.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to saved search
Read
List objects related to a saved search, like its owner, editors or viewers.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List objects related to URL
Read
List objects related to a URL through a relationship, like resolutions or communicating files.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List popular threat categories
Read
List the popular threat categories used in threat names.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List port analysis relationship descriptors
Read
List the IDs and context of objects related to a port analysis.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List port info relationship descriptors
Read
List the IDs and context of objects related to a port info.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List sandbox behaviour report relationship descriptors
Read
List the IDs and context of objects related to a sandbox behaviour report.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List saved search relationship descriptors
Read
List the IDs of objects related to a saved search.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List saved searches
Read
List saved searches you can see, filtered, ordered and paged.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List URL comments
Read
List community comments on a URL.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List URL relationship descriptors
Read
List the IDs and context of objects related to a URL.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
List URL votes
Read
List community harmless or malicious votes on a URL.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
Rescan domain
Write
Ask VirusTotal to analyze the domain again; returns an analysis ID.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Rescan file
Write
Ask VirusTotal to analyze the file again; returns an analysis ID.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Rescan IP address
Write
Ask VirusTotal to analyze the IP address again; returns an analysis ID.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Rescan URL
Write
Ask VirusTotal to analyze the URL again; returns an analysis ID.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Revoke saved search access
Write
Remove users' or your group's viewer or editor access to a saved search.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Scan URL
Write
Submit a URL for analysis; returns an analysis ID. The URL joins VirusTotal's public dataset.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Share saved search
Write
Give users or your group viewer or editor access to a saved search.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Update saved search
Write
Change a saved search's name, description, query, privacy or tags (tags replace the list).
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Vote on comment
Write
Rate a comment positive or negative, or report abuse.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Vote on domain
Write
Vote a domain harmless or malicious.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Vote on file
Write
Vote a file harmless or malicious.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Vote on IP address
Write
Vote a IP address harmless or malicious.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
Vote on URL
Write
Vote a URL harmless or malicious.
Permissions and limits
Account permissions
A VirusTotal API key (some calls need a premium key)
A repeated request may repeat the external action. Review the previous result before retrying a write.
SETUP
Start with a controlled test.
01Connect the intended account
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
02Review inputs and access
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
03Confirm the result
Inspect step outputs and confirm the result in VirusTotal. A saved workflow is not a completed provider action.
Security & Identity ยท CONNECTION
