soar
VirusTotal v3
Splunk SOAR Cloud
Splunk Built
Overview
This app integrates with the VirusTotal cloud to implement investigative and reputation actions using v3 APIs
Supported Actions Version 1.4.0
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- domain reputation: Queries VirusTotal for domain info
- file reputation: Queries VirusTotal for file reputation info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- ip reputation: Queries VirusTotal for IP info
- url reputation: Queries VirusTotal for URL info
- detonate url: Load a URL to Virus Total and retrieve analysis results
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- get report: Get the results using the scan id from a detonate file or detonate url action
Supported Actions Version 1.3.0
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- domain reputation: Queries VirusTotal for domain info
- file reputation: Queries VirusTotal for file reputation info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- ip reputation: Queries VirusTotal for IP info
- url reputation: Queries VirusTotal for URL info
- detonate url: Load a URL to Virus Total and retrieve analysis results
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- get report: Get the results using the scan id from a detonate file or detonate url action
Supported Actions Version 1.2.14
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- domain reputation: Queries VirusTotal for domain info
- file reputation: Queries VirusTotal for file reputation info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- ip reputation: Queries VirusTotal for IP info
- url reputation: Queries VirusTotal for URL info
- detonate url: Load a URL to Virus Total and retrieve analysis results
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- get report: Get the results using the scan id from a detonate file or detonate url action
Supported Actions Version 1.2.10
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- domain reputation: Queries VirusTotal for domain info
- file reputation: Queries VirusTotal for file reputation info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- ip reputation: Queries VirusTotal for IP info
- url reputation: Queries VirusTotal for URL info
- detonate url: Load a URL to Virus Total and retrieve analysis results
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- get report: Get the results using the scan id from a detonate file or detonate url action
Supported Actions Version 1.1.5
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- domain reputation: Queries VirusTotal for domain info
- file reputation: Queries VirusTotal for file reputation info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- ip reputation: Queries VirusTotal for IP info
- url reputation: Queries VirusTotal for URL info
- detonate url: Load a URL to Virus Total and retrieve analysis results
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- get report: Get the results using the scan id from a detonate file or detonate url action
Release Notes
Version 1.4.0
May 17, 2022
- Added handling for utf-16 characters present in API response [PAPP-24606]
Version 1.3.0
March 23, 2022
- Added timeout argument in requests call [PAPP-24290]
- Added support for detonation of large files in the 'detonate file' action [PAPP-24823]
Version 1.2.14
Jan. 26, 2022
VirusTotal v3 Release Notes - Published by Splunk January 25, 2022
Version 1.2.14 - Released January 25, 2022
- Marked the app as FIPS Compliant [PAPP-23672]
Version 1.2.10
Oct. 15, 2021
VirusTotal v3 Release Notes - Published by Splunk October 12, 2021
Version 1.2.10 - Released October 12, 2021
- Removed unnecessary build artifacts
Version 1.1.5
Sept. 21, 2021
VirusTotal v3 Release Notes - Published by Splunk August 27, 2021
Version 1.1.5 - Released May 14, 2021
- Removed unnecessary API calls for 'url reputation', 'detonate url' and 'detonate file' actions [PAPP-16007]
- Added IPV6 support in 'ip reputation' action [PAPP-15506]
- Updated app documentation