About the VirusTotal Integration
VirusTotal, owned by Google, aggregates results from more than 70 antivirus engines and URL and domain blocklisting services to analyze suspicious files, URLs, domains, and IP addresses. Security teams use VirusTotal to check whether a given indicator has already been flagged as malicious across the broader threat intelligence community. As Synqly’s Threat Intelligence provider, the VirusTotal integration enables security platforms to enrich file hashes, URLs, domains, and IP addresses with normalized reputation data through a standardized connector, without custom API development.
Integration Use Cases
Lookup Domain
Looks up a domain name against the token-linked threat intelligence source and returns normalized reputation and context. Note that the looked-up domain is disclosed to the third-party intelligence provider, which can reveal internal hostnames. A lookup that finds no intel records is a successful response with an empty `osint` array.
Lookup Hash
Looks up a file hash against the token-linked threat intelligence source and returns normalized reputation and context. MD5, SHA-1, and SHA-256 hashes are supported; the hash type is detected from the value. A lookup that finds no intel records is a successful response with an empty `osint` array.
Lookup IP
Looks up an IPv4 or IPv6 address against the token-linked threat intelligence source and returns normalized reputation and context. A lookup that finds no intel records is a successful response with an empty `osint` array.
Lookup URL
Looks up a URL against the token-linked threat intelligence source and returns normalized reputation and context. Note that the looked-up URL is disclosed to the third-party intelligence provider; avoid looking up URLs that embed secrets (for example, signed URLs) unless that disclosure is acceptable. A lookup that finds no intel records is a successful response with an empty `osint` array.
