Synqly Adds VirusTotal Integration for Reputation Lookups

A file hash by itself tells a security product almost nothing. The same hash checked against seventy or more antivirus engines at once tells a much more useful story, and that consensus view is exactly what the new VirusTotal integration brings into the Synqly ecosystem.

VirusTotal aggregates results from more than seventy antivirus engines along with URL and domain blocklisting services to analyze suspicious files, URLs, domains, and IP addresses submitted to it. Its value has never come from any single engine’s verdict. It comes from breadth, from being able to say that thirty two out of seventy engines flag a file as malicious rather than relying on one vendor’s opinion, which is a meaningfully different confidence level than a security product gets from a single antivirus API.

With the VirusTotal integration live, an OEM product built on Synqly can run four kinds of lookups through one consistent API: lookup hash, which accepts MD5, SHA-1, or SHA-256 and automatically detects which format was submitted, lookup URL, lookup domain, and lookup IP, covering both IPv4 and IPv6 addresses. Each lookup returns normalized reputation and context data rather than VirusTotal’s own raw response format, so a product’s existing enrichment pipeline can treat a VirusTotal result the same way it treats a result from any other threat intelligence provider Synqly supports. One detail worth building around directly: because these are live lookups against a third party service, the domain, URL, hash, or IP address being checked is disclosed to VirusTotal in the process, which matters for any product enriching data that could itself be sensitive, such as an internal hostname or a customer specific URL pattern. Full configuration and lookup behavior are documented in the technical guides on the Synqly documentation site, and we are not restating that detail here.

In practice, a single alert often needs more than one of these four lookups at once. An email security product flags a suspicious message, and rather than checking only the attachment, it can run lookup hash against the attachment itself, lookup domain and lookup URL against the sender’s domain and any embedded links, and lookup IP against the originating mail server, all through the same VirusTotal integration. A message that comes back clean on every one of those checks gets treated differently than one where even a single lookup returns a high detection count, and a product can make that severity decision automatically instead of asking an analyst to run four separate manual checks before deciding whether an alert deserves attention.

VirusTotal is a Google owned service, but it operates as its own distinct product and this is its first integration within the Synqly ecosystem specifically, joining Synqly’s Threat Intelligence category alongside AbuseIPDB and ThreatFox. Full details on every supported lookup live on the VirusTotal integration partner page.

The practical use case for most OEM products is enrichment at the moment of alerting, not standalone research. A SIEM or detection product surfaces a suspicious URL from an email or a proxy log, and rather than asking an analyst to manually paste that URL into a browser tab to check its reputation, the product calls the VirusTotal integration inline and attaches the reputation data directly to the alert before a human ever sees it. That shortens the time between detection and a confident decision, which is the entire point of threat intelligence enrichment as a category. It also means a product’s own detection logic can factor VirusTotal’s verdict into its severity scoring automatically, rather than treating enrichment as something an analyst does after the fact.

For a product team evaluating what the build versus integrate decision looks like here, the honest answer is that a single VirusTotal API integration is not the hardest connector to build in isolation. What Synqly removes is the need to build a matching connector for every other threat intelligence source a customer might also want, on a separate authentication model and response format each time, which is where the real maintenance cost accumulates over time.