VirusTotal

VirusTotal is a comprehensive malware scanning, threat intelligence, and security analysis platform that aggregates detection engines from multiple antivirus vendors and security tools to analyze suspicious files, URLs, domains, and IP addresses. As a leading cybersecurity intelligence service, VirusTotal enables security professionals, incident responders, threat hunters, and SOC analysts to investigate potential threats, malware samples, malicious websites, phishing campaigns, and security indicators across a collaborative threat database.

Category	Threat intelligence
Direction	Query source
Sign-in	API Key
Query languages	SQLite
Tables	5
Query templates	11
Website	virustotal.com

Before you start

Huntbase signs in to VirusTotal with API Key. Create the credential in VirusTotal first, then keep it to hand for the Connect step.

1. Join the VirusTotal Community using the sign-up link in the top-right corner of VirusTotal, then sign in.
2. Open the API key menu item under your user name, or go to https://www.virustotal.com/gui/my-apikey.
3. Copy your API key.

For the vendor's own instructions, see VirusTotal API key documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect VirusTotal

1. Go to Connections and click New connection, or click New connection on the VirusTotal product page.
2. On Product, pick VirusTotal and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Credentials

The only Method is API Key. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
API Key	Yes	Secret — not shown again after you save it.

Query it

Once connected, VirusTotal can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 5 tables listed below, alongside every other connected source.

Example: SQLite

Get URL information — Discover the details associated with a specific URL.

select
  *
from
  virustotal_url
where
  url = {{url}};

VirusTotal ships with 11 query templates. Find them in Library › Queries — see Query templates.

Tables

VirusTotal adds 5 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 5 tables

Table	Contains
virustotal_domain	Information and analysis for a domain.
virustotal_file	Information and analysis for a File.
virustotal_ip	Information and analysis for an IP address.
virustotal_search	CREATE TABLE IF NOT EXISTS virustotal_search (
virustotal_url	Information and analysis for a URL.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog