soar
VirusTotal
Splunk SOAR Cloud
Splunk Built
Overview
This app integrates with the VirusTotal cloud to implement investigative and reputation actions using v2 APIs
Supported Actions Version 2.2.7
- test connectivity: Validate the asset configuration for connectivity
- file reputation: Queries VirusTotal for file reputation info
- url reputation: Queries VirusTotal for URL info
- domain reputation: Queries VirusTotal for domain info
- ip reputation: Queries VirusTotal for IP info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- get report: Get the results using the scan id from a detonate file or detonate url action
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- detonate url: Load a URL to Virus Total and retrieve analysis results
Supported Actions Version 2.2.6
- test connectivity: Validate the asset configuration for connectivity
- file reputation: Queries VirusTotal for file reputation info
- url reputation: Queries VirusTotal for URL info
- domain reputation: Queries VirusTotal for domain info
- ip reputation: Queries VirusTotal for IP info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- get report: Get the results using the scan id from a detonate file or detonate url action
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- detonate url: Load a URL to Virus Total and retrieve analysis results
Supported Actions Version 2.2.5
- test connectivity: Validate the asset configuration for connectivity
- file reputation: Queries VirusTotal for file reputation info
- url reputation: Queries VirusTotal for URL info
- domain reputation: Queries VirusTotal for domain info
- ip reputation: Queries VirusTotal for IP info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- get report: Get the results using the scan id from a detonate file or detonate url action
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- detonate url: Load a URL to Virus Total and retrieve analysis results
Supported Actions Version 2.2.2
- test connectivity: Validate the asset configuration for connectivity
- file reputation: Queries VirusTotal for file reputation info
- url reputation: Queries VirusTotal for URL info
- domain reputation: Queries VirusTotal for domain info
- ip reputation: Queries VirusTotal for IP info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- get report: Get the results using the scan id from a detonate file or detonate url action
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- detonate url: Load a URL to Virus Total and retrieve analysis results
Supported Actions Version 2.1.2
- test connectivity: Validate the asset configuration for connectivity
- file reputation: Queries VirusTotal for file reputation info
- url reputation: Queries VirusTotal for URL info
- domain reputation: Queries VirusTotal for domain info
- ip reputation: Queries VirusTotal for IP info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- get report: Get the results using the scan id from a detonate file or detonate url action
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- detonate url: Load a URL to Virus Total and retrieve analysis results
Supported Actions Version 2.0.33
- test connectivity: Validate the asset configuration for connectivity
- file reputation: Queries VirusTotal for file reputation info
- url reputation: Queries VirusTotal for URL info
- domain reputation: Queries VirusTotal for domain info
- ip reputation: Queries VirusTotal for IP info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- get report: Get the results using the scan id from a detonate file or detonate url action
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- detonate url: Load a URL to Virus Total and retrieve analysis results
Supported Actions Version 2.0.31
- test connectivity: Validate the asset configuration for connectivity
- file reputation: Queries VirusTotal for file reputation info
- url reputation: Queries VirusTotal for URL info
- domain reputation: Queries VirusTotal for domain info
- ip reputation: Queries VirusTotal for IP info
- get file: Downloads a file from VirusTotal, and adds it to the vault
- get report: Get the results using the scan id from a detonate file or detonate url action
- detonate file: Upload a file to Virus Total and retrieve the analysis results
- detonate url: Load a URL to Virus Total and retrieve analysis results
Release Notes
Version 2.2.7
April 16, 2025
- Update Python dependencies for vulnerabilities, package updates, and platform built-in removals
- Update Python dependencies for Python 3.13 support
- Update NOTICE file with updated dependencies
- Apply pre-commit fixes
Version 2.2.6
Jan. 30, 2024
- Removed certifi and requests dependencies in order to use platform packages [PAPP-31096, PAPP-30822]
Version 2.2.5
Jan. 19, 2022
VirusTotal Release Notes - Published by Splunk January 19, 2022
Version 2.2.5 - Released January 19, 2022
- Changed the hashing algorithm to SHA256 when running in FIPS mode [PAPP-20235]
Version 2.2.2
Dec. 22, 2021
VirusTotal Release Notes - Published by Splunk December 20, 2021
Version 2.2.2 - Released December 20, 2021
- Added "request per minute" parameter in the asset configuration for dynamic rate limit [PAPP-21532]
- Fixed issue in the output view of "ip reputation" action
Version 2.1.2
Sept. 21, 2021
VirusTotal Release Notes - Published by Splunk June 22, 2021
Version 2.1.2 - Released June 22, 2021
- Fixed the app widget [PAPP-12935]
Version 2.0.33
Sept. 21, 2021
VirusTotal Release Notes - Published by Splunk June 22, 2021
Version 2.0.33 - Released May 03, 2021
- Fixed issue to hide sensitive information in the error message [PAPP-16635]
Version 2.0.31
Sept. 21, 2021
VirusTotal Release Notes - Published by Splunk June 22, 2021
Version 2.0.31 - Released April 15, 2021
- Bug fixes in the 'detonate url' action