--- title: VirusTotal API Integration on Truto slug: virustotal category: Security canonical: "https://truto.one/integrations/detail/virustotal/" --- # VirusTotal API Integration on Truto **Category:** Security **Status:** Beta ## MCP-ready AI tools Truto exposes 150 tools for VirusTotal that AI agents can call directly. - **list_all_virus_total_ip_addresses** — Get a VirusTotal IP address report by IP. Returns: data. Required: ip. - **virus_total_ip_addresses_rescan** — Rescan an IP address in VirusTotal to refresh its verdicts, whois information, and SSL certificates. Returns: type, id, links. The returned analysis id can be used with the Analyses endpoint to retrieve vendor verdicts. Required: ip_addresse_id. - **virus_total_ip_addresses_list_comments** — List comments posted on a VirusTotal IP address. Returns: type, id, attributes (text, html, tags, votes, date), links for each comment. Required: ip_addresse_id. - **virus_total_ip_addresses_create_comment** — Post a comment for a given IP address in VirusTotal. Any word starting with # in the comment text is treated as a tag and added to the comment's tag attribute. Returns the created comment object including its id, type, text, tags, html, date, and votes. Required: ip_addresse_id, data. - **virus_total_ip_addresses_list_relationships** — List objects related to a given IP address by relationship name in VirusTotal. Returns an array of related objects, each with type, id, links, and attributes. Required: ip_addresse_id, relationship. - **virus_total_ip_addresses_list_relationship_descriptors** — List relationship descriptors for a VirusTotal IP address, returning only the related objects' IDs and any context attributes instead of full object attributes. Returns: type, id, attributes. Required: ip_addresse_id, relationship. - **virus_total_ip_addresses_list_votes** — List votes cast on a VirusTotal IP address. Returns: type, id, attributes, links. Required: ip_addresse_id. - **virus_total_ip_addresses_create_vote** — Cast a vote for a VirusTotal IP address. The verdict must be either harmless or malicious. Returns the created vote object including type, id, and attributes with the verdict. Required: ip_addresse_id, data. - **get_single_virus_total_ip_address_by_id** — Get a VirusTotal IP address report by id, including threat reputation and context from antivirus products and security tools. Returns: type, id, links, attributes. Required: id. - **list_all_virus_total_domains** — Get information about a specific domain in VirusTotal. Returns: type, id, links, attributes, relationships, data. Required: domain. - **virus_total_domains_rescan** — Trigger a rescan of a domain in VirusTotal to refresh its verdicts, WHOIS information, and SSL certificates. Returns: type, id, links. Required: domain_id. - **virus_total_domains_list_comments** — List comments for a specific domain in VirusTotal. Returns: type, id, attributes, links. Required: domain_id. - **virus_total_domains_create_comment** — Post a comment for a specific domain in VirusTotal. Any word starting with # in the comment text is treated as a tag. Returns: type, id, attributes, links. Required: domain_id, data. - **virus_total_domains_list_relationships** — List objects related to a domain in VirusTotal by relationship type (e.g., resolutions, siblings, subdomains). Returns: type, id, links, attributes, relationships. Required: domain_id, relationship. - **virus_total_domains_list_relationship_descriptors** — List related object descriptors for a VirusTotal domain by relationship name, returning only the related objects' IDs instead of full attributes. Returns: type, id, attributes. Required: domain_id, relationship. - **virus_total_domains_list_votes** — List votes cast on a VirusTotal domain. Returns: type, id, attributes. Required: domain_id. - **virus_total_domains_create_vote** — Cast a vote on a VirusTotal domain. Returns: type, id, attributes. Required: domain_id, data. Verdict must be either harmless or malicious. - **get_single_virus_total_domain_by_id** — Get a VirusTotal domain report by id, including threat reputation and analysis context. Returns: type, id, links, attributes. Required: id. - **get_single_virus_total_resolution_by_id** — Get a VirusTotal DNS resolution by id. The resolution object ID is formed by appending the IP address and the domain it resolves to together. Returns: type, id, links, attributes. Required: id. - **create_a_virus_total_file** — Upload a file to VirusTotal for scanning with 70+ antivirus products and analysis tools. Returns an analysis descriptor with type and id — use the id with the GET /analyses/{id} endpoint to check the analysis status. Required: file. For files larger than 32MB, obtain a special upload URL via the get_upload_url method first; the actual size limit is 650MB. - **virus_total_files_get_upload_url** — Get a special one-time-use upload URL from VirusTotal for uploading files larger than 32MB. Returns a URL string to use as the POST target with the same multipart format expected by POST /files. Each upload URL can be used only once. No required parameters. - **get_single_virus_total_file_by_id** — Get a VirusTotal file report by its SHA-256, SHA-1, or MD5 hash, retrieving the analysis report including threat reputation and context from 70+ antivirus products and 10+ dynamic analysis sandboxes. Returns the File object including its type, id, attributes, and links. Required: id. - **virus_total_files_rescan** — Re-analyse a previously uploaded file in VirusTotal without re-uploading it. Returns an analysis descriptor with type and id — use the id with the analyses endpoint to poll results. Required: file_id. Do not rescan more than 50K files per day to avoid denial of service on the scanning infrastructure. - **virus_total_files_get_download_url** — Get a signed download URL for a file stored in VirusTotal. Returns the signed URL string which expires after 1 hour. Required: file_id. Getting the URL counts as a file download in your quota, but subsequent downloads via the URL do not consume additional quota. - **virus_total_files_download** — Download a file from VirusTotal by hash. Returns the file binary via redirect to a signed download URL valid for 1 hour. Required: file_id. Premium privileges required. - **virus_total_files_list_comments** — List comments on a VirusTotal file by hash. Returns: type, id, links, attributes. Required: file_id. - **virus_total_files_create_comment** — Post a comment on a VirusTotal file by hash. Words starting with # in the text are automatically added as tags. Returns: type, id, links, attributes. Required: file_id, data. - **virus_total_files_list_relationships** — List objects related to a VirusTotal file by relationship type, returning full object attributes. Returns: type, id, links, attributes. Required: file_id, relationship. - **virus_total_files_list_relationship_descriptors** — List descriptors of objects related to a VirusTotal file by relationship type, returning only IDs instead of full object attributes. Returns: type, id, attributes. Required: file_id, relationship. - **virus_total_files_list_votes** — List votes cast on a file in VirusTotal. Returns: type, attributes. Required: file_id. - **virus_total_files_create_vote** — Create a vote on a file in VirusTotal. Returns: type, attributes. The verdict must be either harmless or malicious. Required: file_id. - **virus_total_files_get_behaviour_summary** — Get a merged behavioural summary for a file in VirusTotal, combining sandbox reports from all integrated sandboxes. Returns: attributes. Required: file_id (SHA-256, SHA-1, or MD5). - **virus_total_files_get_mitre_attack_summary** — Get a summary of MITRE ATT&CK tactics and techniques observed in each sandbox report for a VirusTotal file. Returns a map keyed by sandbox name; each entry contains a tactics array with id, name, description, link, and nested techniques (id, name, description, link, signatures with severity and description). Required: file_id. - **virus_total_files_list_behaviours** — List all sandbox behaviour reports for a VirusTotal file. Returns each report's id, type, and attributes including sandbox_name, analysis_date, has_html_report, has_pcap, processes_tree, signature_matches, mitre_attack_techniques, and others. Required: file_id. - **get_single_virus_total_sigma_rule_by_id** — Get a single VirusTotal Sigma Rule by id. Returns the Sigma Rule object including its type, id, and attributes. Required: id. - **get_single_virus_total_yara_ruleset_by_id** — Get a YARA Ruleset from VirusTotal by id. Returns the ruleset object including its type, id, links, and attributes. Required: id. - **get_single_virus_total_file_behaviour_by_id** — Get a VirusTotal file behaviour sandbox report by id. The id combines the analysed file's SHA256 and the sandbox name joined by an underscore. Returns: type, id, links, attributes. Required: id. - **virus_total_file_behaviours_list_relationships** — List objects related to a VirusTotal file behaviour sandbox report by relationship name. Returns: type, id, links, attributes. Required: sandbox_id, relationship. - **virus_total_file_behaviours_list_relationship_descriptors** — List only the IDs (and context attributes, if any) of objects related to a VirusTotal file behaviour sandbox report, without returning full attributes. Returns: type, id, attributes. Required: sandbox_id, relationship. - **virus_total_file_behaviours_get_html_report** — Get the HTML report for a VirusTotal file behaviour sandbox analysis. Returns the rendered HTML report content for the sandbox execution. Required: sandbox_id. - **virus_total_file_behaviours_get_evtx** — Fetch the EVTX (Windows Event Log) file associated with a VirusTotal sandbox execution. This endpoint is only available for users with special privileges. Returns the EVTX file content. Required: sandbox_id. - **virus_total_file_behaviours_get_pcap** — Download the PCAP (packet capture) file associated with a VirusTotal sandbox execution. Returns the raw binary PCAP file content. Required: sandbox_id. This endpoint requires special privileges. - **virus_total_file_behaviours_get_memdump** — Download the memory dump file associated with a VirusTotal sandbox execution. Returns the raw binary memory dump file content. Required: sandbox_id. This endpoint requires special privileges. - **create_a_virus_total_url** — Scan a URL with VirusTotal to analyse it with 70+ antivirus products. Returns an analysis descriptor with id, type, and links that can be used to retrieve the analysis via the Analyses endpoint. Required: url. - **get_single_virus_total_url_by_id** — Get a URL report from VirusTotal by id. Returns the URL object with type, id, links, and attributes. Required: id. - **virus_total_urls_rescan** — Trigger a rescan of a previously scanned URL in VirusTotal. Returns an analysis descriptor with id, type, and links for tracking the new analysis via the Analyses endpoint. Required: url_id. - **virus_total_urls_list_comments** — List community comments for a specific URL in VirusTotal. Returns comment objects with type, id, attributes, and links. Required: url_id. - **virus_total_urls_create_comment** — Post a comment on a specific URL in VirusTotal. Returns the created comment object with type, id, attributes, and links. Any word starting with # in the comment text is treated as a tag. Required: url_id, data. - **virus_total_urls_list_relationships** — List objects related to a VirusTotal URL by relationship name, returning full related objects with all attributes. Returns: type, id, links, attributes, relationships. Required: url_id, relationship. Some relationships are accessible only to VirusTotal Enterprise users. - **virus_total_urls_list_relationship_descriptors** — List descriptors (IDs and context attributes only) of objects related to a VirusTotal URL by relationship name, without returning full object attributes. Returns: type, id, attributes. Required: url_id, relationship. - **virus_total_urls_list_votes** — List VirusTotal Vote objects for a given URL. Returns: type, attributes. Required: url_id. - **virus_total_urls_create_vote** — Post a vote for a given VirusTotal URL. The verdict attribute must be either harmless or malicious. Returns: type, attributes. Required: url_id, data. - **list_all_virus_total_comments** — List the latest comments added to VirusTotal. Returns each comment with id, type, links, and attributes including date, tags, html, text, and votes. The filter parameter allows narrowing results by tag (e.g. filter=tag:malware). - **get_single_virus_total_comment_by_id** — Get a single VirusTotal comment by id. Returns the comment object including id, type, links, and attributes with date, tags, html, text, and votes. Required: id. - **delete_a_virus_total_comment_by_id** — Delete a VirusTotal comment by id. Returns an empty 204 response on success. Required: id. - **virus_total_comments_list_relationships** — List objects related to a VirusTotal comment by relationship name. Returns each related object with id, type, links, and type-specific attributes. Required: comment_id, relationship. - **virus_total_comments_list_relationship_descriptors** — List descriptors (IDs only) for objects related to a VirusTotal comment. Returns each related object descriptor with id, type, links, and attributes. Required: comment_id, relationship. - **virus_total_comments_create_vote** — Cast a vote on a VirusTotal comment by specifying a vote type. Returns the updated vote counts: abuse, negative, positive. Required: comment_id, data (positive, negative, or abuse). - **get_single_virus_total_analysis_by_id** — Get a specific VirusTotal analysis by id. Returns the analysis object including its type, id, attributes (status, progress), links, and relationships. Required: id. - **virus_total_analyses_list_relationships** — List related objects for a VirusTotal analysis by relationship name. Returns related objects with their type, id, attributes, links, and relationships. Required: analyse_id, relationship. - **virus_total_analyses_list_relationship_descriptors** — List relationship descriptors (ID and context attributes only) for a VirusTotal analysis. Returns related object descriptors with their type, id, attributes, links, and relationships. Required: analyse_id, relationship. - **get_single_virus_total_submission_by_id** — Get a VirusTotal submission by id. Returns the submission object including its type, id, attributes, and links. Required: id. - **get_single_virus_total_operation_by_id** — Get a specific VirusTotal operation by id. Returns the operation object including its type, id, and attributes with status, progress, files_ok, and files_error. Required: id. - **get_single_virus_total_attack_tactic_by_id** — Get a specific MITRE ATT&CK attack tactic in VirusTotal by id. Returns the attack tactic object including type, id, links, attributes, and relationships. Required: id. - **virus_total_attack_tactics_list_relationships** — List objects related to a VirusTotal attack tactic for a specified relationship. Returns each related object's type, id, links, and attributes. Required: attack_tactic_id, relationship. - **virus_total_attack_tactics_list_relationship_descriptors** — List descriptors of objects related to a VirusTotal attack tactic for a specified relationship. Returns each related object descriptor's type and id only, without full attributes. Required: attack_tactic_id, relationship. - **get_single_virus_total_attack_technique_by_id** — Get a specific VirusTotal attack technique by id. Returns the attack technique object including its type, id, links, and attributes. Required: id. - **virus_total_attack_techniques_list_relationships** — List objects related to a VirusTotal attack technique for a given relationship name. Returns related objects including their type, id, links, and attributes. Required: attack_technique_id, relationship. - **virus_total_attack_techniques_list_relationship_descriptors** — List descriptors of objects related to a VirusTotal attack technique for a given relationship name. Returns just the related object's type and id without full attributes. Required: attack_technique_id, relationship. - **list_all_virus_total_popular_threat_categories** — List popular threat categories in VirusTotal. Returns normalized malware category name strings (e.g., trojan, dropper, ransomware) commonly used in AV verdicts and set as part of a file's popular_threat_classification. No required parameters beyond API key authentication. - **virus_total_codeinsights_analyse_binary** — Analyze disassembled or decompiled code in VirusTotal Code Insights for malware-relevant functionality. Returns a Base64-encoded string containing the AI-generated description of the code's behavior. Required: data.code, data.code_type. Limited to 50 requests per day. - **list_all_virus_total_saved_searches** — List VirusTotal saved searches you have access to as owner, editor, or viewer. Returns each saved search with type, id, and attributes including name, description, search_query, private, tags, creation_date, last_modification_date, origin, and owner. Max 40 per page. - **get_single_virus_total_saved_search_by_id** — Get a single VirusTotal saved search by id. Returns: type, id, attributes. Required: id. - **create_a_virus_total_saved_search** — Create a new VirusTotal saved search; the caller automatically becomes its owner. Returns: type, id, attributes. Required: data. - **virus_total_saved_searches_share** — Grant viewer or editor access on a VirusTotal saved search to specific users or the owner's group. Editor privileges can only be granted to members of the same group as the owner. Returns: type, id, attributes. Required: saved_searche_id, access, data. - **update_a_virus_total_saved_search_by_id** — Update attributes of an existing VirusTotal saved search. To modify tags, retrieve the current list first and submit the full resulting list. Returns: type, id, attributes. Required: id, data. - **delete_a_virus_total_saved_search_by_id** — Delete a VirusTotal saved search by id. Upon deletion, the search is permanently removed and will no longer be accessible to any users with whom it was previously shared. Returns an empty 204 response on success. Required: id. - **virus_total_saved_searches_revoke_access** — Revoke viewer or editor access to a VirusTotal saved search for specific users or the owner's entire group. Requires a request body even when using the DELETE method. Returns an empty 204 response on success. Required: saved_searche_id, access, and a data payload listing the users/groups to revoke. - **virus_total_saved_searches_list_relationship_descriptors** — List related object descriptors for a specific relationship of a VirusTotal saved search, returning just the related object's type and id instead of all attributes. Returns: type, id, attributes. Required: saved_searche_id, relationship. Max 40 related objects per page. - **virus_total_saved_searches_list_relationships** — List full related objects for a specific relationship of a VirusTotal saved search, returning all attributes of the related objects. Returns: type, id, links, attributes. Required: saved_searche_id, relationship. Max 40 related objects per page. - **virus_total_search_search** — Search VirusTotal for files, URLs, domains, IP addresses, or comments by query string. Returns a list of matching objects each with id, type, attributes, and links; the attributes shape varies by result type (e.g. comment attributes include date, html, tags, text, and votes). Required: query. - **virus_total_intelligence_search_search** — Search files in VirusTotal's dataset using Intelligence query syntax (same as the VT Intelligence UI). Returns matching objects with id, type, and context_attributes including confidence, match_in_subfile, snippet, and similarity_score. Required: query. Content searches cannot be sorted; fuzzy hash searches are throttled to 15 per minute. - **virus_total_intelligence_search_get_snippets** — Get file content snippets that matched a VirusTotal Intelligence search query. Returns a list of strings containing content hexdump and plain text, with matched content between * characters. Required: snippet. - **list_all_virus_total_metadata** — Get VirusTotal metadata including the full list of detection engines, available privileges, and object relationship descriptors. Returns: engines, privileges, relationships. - **create_a_virus_total_collection** — Create a new VirusTotal collection with IOCs provided as relationship descriptors or raw text. Returns: id, type, links, attributes, relationships, raw_items. Required: data (with type and attributes.name). - **get_single_virus_total_collection_by_id** — Get a single VirusTotal collection by id. Returns: id, type, links, attributes, relationships, raw_items. Required: id. - **update_a_virus_total_collection_by_id** — Update a VirusTotal collection's name or description and add IOCs via raw text by id. Returns: id, type, links, attributes, relationships, raw_items. Required: id, data (with type). - **delete_a_virus_total_collection_by_id** — Delete a VirusTotal collection by id. Returns an empty 204 response on success. Required: id. - **virus_total_collections_list_comments** — List comments on a VirusTotal collection. Returns: type, id, links, attributes. Required: collection_id. - **virus_total_collections_create_comment** — Post a comment on a VirusTotal collection. Any word starting with # in the comment text is treated as a tag and added to the comment's tags attribute. Returns: type, id, links, attributes. Required: collection_id, data. Comment IDs are auto-generated; do not include an id in the request body. - **virus_total_collections_list_relationships** — List related objects for a VirusTotal collection by relationship name. Returns an array of related objects with id, type, links, and attributes. Required: collection_id, relationship. - **virus_total_collections_list_relationship_descriptors** — List related object descriptors for a VirusTotal collection's relationship. This is the same as the full relationship endpoint but returns only the descriptor (type and id) instead of all attributes. Returns: type, id, links, attributes. Required: collection_id, relationship. - **virus_total_collections_add_elements** — Add new elements to a VirusTotal collection's relationship by sending object descriptors. Returns: id, type, attributes, raw_items, links. Required: collection_id, data. - **virus_total_collections_delete_elements** — Remove elements from a VirusTotal collection's relationship by sending object descriptors. Returns: data. Required: collection_id, data. - **list_all_virus_total_collections** — List VirusTotal IoC collections with optional filtering and sorting. Returns each collection with type, id, links, attributes (name, description, creation_date, last_modification_date, owner, source_region, targeted_region, targeted_industry, threat_category, tag), and relationships (domains, urls, ip_addresses, files). Max 40 per page. - **virus_total_collections_export_iocs** — Export all IoCs from a VirusTotal collection in json, csv, or stix format. Returns: type, id, links, attributes, relationships. Required: collection_id, format. - **virus_total_collections_export_iocs_relationship** — Export IoCs from a specific relationship of a VirusTotal collection in json, csv, or stix format. Returns: type, id, links, attributes, relationships. Required: collection_id, relationship, format. - **virus_total_collections_export_aggregations** — Export aggregation data from a VirusTotal collection in json or csv format. Returns: type, id, links, attributes. Required: collection_id, format. - **virus_total_collections_search_iocs** — Search IoCs inside a VirusTotal collection using VT Intelligence queries. By default searches files; use entity:domain/ip/url for other entity types. Returns: type, id, links, attributes, relationships. Required: collection_id, query. Max 40 per page. - **create_a_virus_total_zip_file** — Create a VirusTotal ZIP file containing files specified by their hashes. Returns: type, id, attributes. Required: data.hashes. The ZIP is built asynchronously — poll the get endpoint until status is 'finished'. - **get_single_virus_total_zip_file_by_id** — Get a VirusTotal ZIP file by id. Returns: type, id, attributes. The status field tracks creation progress through starting, creating, finished, timeout, error-starting, and error-creating. Required: id. - **virus_total_zip_files_get_download_url** — Get a signed download URL for a VirusTotal ZIP file. Returns the signed URL string, valid for 1 hour. Required: zip_file_id. - **virus_total_zip_files_download** — Download a VirusTotal ZIP file by redirecting to a signed download URL. The redirect URL remains valid for 1 hour. Required: zip_file_id. - **list_all_virus_total_yara_rules** — List VirusTotal Crowdsourced YARA rules. Returns each rule with id, type, attributes (including name, author, rule, tags, matches, enabled, creation_date, last_modification_date, and meta), and links. Supports filter and order query parameters for narrowing and sorting results. - **get_single_virus_total_yara_rule_by_id** — Get a single VirusTotal Crowdsourced YARA rule by id. Returns the rule object with id, type, attributes (including name, author, rule, tags, matches, enabled, creation_date, last_modification_date, and meta), and links. Required: id. - **virus_total_yara_rules_list_relationships** — List objects related to a VirusTotal YARA rule for a given relationship name. Returns related objects with id, type, attributes, links, and an error field for related items not present in VirusTotal's database. Required: yara_rule_id, relationship. - **virus_total_yara_rules_list_relationship_descriptors** — List descriptors of objects related to a VirusTotal YARA rule for a given relationship name. Returns related object descriptors with id, type, and context_attributes when available, without full object attributes. Required: yara_rule_id, relationship. - **list_all_virus_total_ioc_stream** — List objects from the VirusTotal IoC Stream including files, URLs, domains, and IP addresses, each carrying notification context attributes. Returns: type, id, links, context_attributes, attributes, relationships. Max 40 objects per page. - **virus_total_ioc_stream_delete_notifications** — Delete notifications from the VirusTotal IoC Stream matching a filter string. Uses the same filters as the list endpoint. Returns an empty 204 response on success. - **get_single_virus_total_ioc_stream_notification_by_id** — Get a single VirusTotal IoC Stream notification by id. Returns the notification object including its type, id, links, and attributes with notification_date, origin, sources, and tags. Required: id. - **delete_a_virus_total_ioc_stream_notification_by_id** — Delete a VirusTotal IoC Stream notification by id. Returns an empty 200 response on success. Required: id. - **list_all_virus_total_hunting_rulesets** — List VT Hunting Livehunt rulesets viewable by the current user. Returns each ruleset with type, id, and attributes including name, rules, enabled, limit, creation_date, modification_date, notification_emails, and match_object_type. Use the filter parameter to narrow by enabled status, name, rules content, or tags; order results by name, creation_date, or modification_date. - **create_a_virus_total_hunting_ruleset** — Create a new VT Hunting Livehunt ruleset. Returns the created ruleset including its type, id, and attributes (name, rules, enabled, limit, notification_emails, match_object_type, creation_date, modification_date, number_of_rules). Required: name, rules. - **virus_total_hunting_rulesets_delete_all** — Delete all VirusTotal Hunting Livehunt rulesets owned by the user and remove the user from shared rulesets' editor lists. This asynchronous operation launches a background job and returns an Operation object immediately. Returns: data, id, links. Required: data. The x-confirm-delete header must be set to your username for this destructive operation. - **get_single_virus_total_hunting_ruleset_by_id** — Get a VirusTotal Hunting Livehunt ruleset by id. Returns the ruleset object including type, id, links, and attributes (enabled, limit, name, notification_emails, rules, creation_date, modification_date). Required: id. - **update_a_virus_total_hunting_ruleset_by_id** — Update a VirusTotal Hunting Livehunt ruleset by id, modifying attributes such as enabled, limit, name, notification_emails, and rules. Returns the updated ruleset object including type, id, and attributes. Required: id, data. - **virus_total_hunting_rulesets_check_editor** — Check whether a specific user or group has editing access to a VirusTotal hunting ruleset. Returns a boolean — true if the user or group is an editor, false otherwise. Required: hunting_ruleset_id, user_or_group_id. - **virus_total_hunting_rulesets_revoke_editor** — Revoke editing access for a user or group from a VirusTotal hunting ruleset. Returns an empty response on success. Required: hunting_ruleset_id, user_or_group_id. - **delete_a_virus_total_hunting_ruleset_by_id** — Delete a VirusTotal hunting ruleset by id. Returns an empty response on success. Required: id. - **virus_total_hunting_rulesets_list_relationships** — Retrieve all fully-expanded relationships for a VirusTotal hunting ruleset. Returns the hunting ruleset object including type, id, links, and attributes (name, enabled, limit, rules, notification_emails, match_object_type, creation_date, modification_date, number_of_rules). Required: hunting_ruleset_id. - **virus_total_hunting_rulesets_list_relationship_descriptors** — Retrieve descriptors for a specific relationship of a VirusTotal hunting ruleset, returning only the related object's descriptor and context attributes instead of full attributes. Returns: type, id, links, attributes. Required: hunting_ruleset_id, relationship. - **virus_total_hunting_rulesets_grant_editor** — Grant editor privileges on a VirusTotal Livehunt hunting ruleset to one or more users or groups. Returns the hunting ruleset object including type, id, and attributes (name, enabled, limit, rules, notification_emails). Required: hunting_ruleset_id, data. - **virus_total_hunting_rulesets_transfer_ownership** — Transfer ownership of a VirusTotal Livehunt hunting ruleset to another user. The new owner must belong to the same group the ruleset was created with. Returns the hunting ruleset object including type, id, and attributes (name, enabled, limit, rules, notification_emails). Required: hunting_ruleset_id, data. - **list_all_virus_total_hunting_notifications** — List VirusTotal hunting notifications triggered by your Livehunt rulesets or rules shared with you. Returns: id, type, attributes, relationships, links. Filter by tag, owner, or date; order by date ascending or descending. - **virus_total_hunting_notifications_delete_all** — Delete VirusTotal hunting notifications in bulk, optionally filtered by tag. If no tag is specified, all notifications are deleted. Returns an empty 200 response on success. - **get_single_virus_total_hunting_notification_by_id** — Get a single VirusTotal hunting notification by id. Returns: id, type, attributes, links. Required: id. - **delete_a_virus_total_hunting_notification_by_id** — Delete a single VirusTotal hunting notification by id. Returns an empty 200 response on success. Required: id. - **virus_total_hunting_notifications_list_files** — List files matching your VirusTotal hunting notifications, with context attributes describing each notification match. Returns: id, type, attributes, context_attributes, relationships, links. - **list_all_virus_total_retrohunt_jobs** — List VirusTotal Retrohunt jobs, optionally filtered by status. Returns each job with type, id, and attributes (rules, corpus, notification_email, time_range, status). Optional filter uses syntax status:(starting|running|aborting|aborted|finished). - **create_a_virus_total_retrohunt_job** — Create a new VirusTotal Retrohunt job with YARA rules to scan past files. Returns the created job including type, id, and attributes (rules, corpus, notification_email, time_range, status). Required: data.type and data.attributes.rules. Up to 10 concurrent jobs and 300 YARA rules per job. - **get_single_virus_total_retrohunt_job_by_id** — Get a single VirusTotal Retrohunt job by id. Returns: type, id, attributes. Required: id. - **delete_a_virus_total_retrohunt_job_by_id** — Delete a VirusTotal Retrohunt job by id. Returns: type, id, attributes, data. Required: id. - **virus_total_retrohunt_jobs_abort** — Abort a running VirusTotal Retrohunt job. Returns the job object including type, id, and attributes (rules, corpus, notification_email, time_range, status). Required: retrohunt_job_id. - **virus_total_retrohunt_jobs_list_matching_files** — List files matching a VirusTotal retrohunt job's YARA rules. Returns: type, id, links, attributes. Required: retrohunt_job_id. - **virus_total_graphs_search** — Search VirusTotal graphs by filter criteria and free-text query. Returns each graph record with id, type, attributes (nodes, links, graph_data, position, private, creation_date), and links. The filter parameter supports modifiers such as id:, name:, owner:, private:, creation_date:, and node-related modifiers combinable with AND, OR, and NOT; order supports name, owner, creation_date,… - **get_single_virus_total_graph_by_id** — Get a single VirusTotal graph by id. Returns: id, type, attributes, links. Required: id. - **update_a_virus_total_graph_by_id** — Update a VirusTotal graph's nodes, links, graph_data, position, or private status. Returns the updated graph object with id, type, attributes, and links. Required: id. - **delete_a_virus_total_graph_by_id** — Delete a VirusTotal graph by id. Returns an empty 200 response on success. Required: id. - **virus_total_graphs_list_comments** — List comments posted on a VirusTotal graph. Returns each comment with id, type, attributes (text, html, tags, votes, date), and links. Required: graph_id. - **virus_total_graphs_create_comment** — Post a comment to a VirusTotal graph. Returns: type, id, attributes, links. Required: graph_id. - **virus_total_graphs_list_relationships** — List objects related to a VirusTotal graph by relationship name. Returns: type, id, attributes, links. Required: graph_id, relationship. - **virus_total_graphs_list_relationship_descriptors** — List just the IDs (and context attributes, if any) of objects related to a VirusTotal graph, instead of returning full attributes. Returns: type, id, attributes, links. Required: graph_id, relationship. - **virus_total_graphs_list_viewers** — List users who can view a VirusTotal graph. The graph must be shared with them as Viewer for them to appear. Returns each viewer's id, type, attributes (first_name, last_name, profile_phrase, reputation, status, user_since), and links. Required: graph_id. - **virus_total_graphs_add_viewer** — Add a user or group as a viewer of a VirusTotal graph. Returns the updated list of viewers with id, type, attributes (first_name, last_name, profile_phrase, reputation, status, user_since), and links. Required: graph_id. - **virus_total_graphs_check_viewer** — Check if a user or group has Viewer access to a VirusTotal graph. Returns true if the user or group has Viewer access, false otherwise. Required: graph_id, user_or_group_id. - **virus_total_graphs_delete_viewer** — Revoke viewer access from a user or group for a VirusTotal graph. Returns an empty 204 response on success. Required: graph_id, user_or_group_id. - **virus_total_graphs_list_editors** — List the users and groups that have Editor access to a VirusTotal graph. The graph must be shared with them as Editor for them to appear. Returns: id, type, attributes, links. Required: graph_id. - **virus_total_graphs_add_editor** — Add a user or group as an editor of a VirusTotal graph. Returns: id, type, attributes, links. Required: graph_id, data. - **virus_total_graphs_check_editor** — Check if a user or group has Editor access to a VirusTotal graph. Returns true if the user or group has Editor access, false otherwise. Required: graph_id, user_or_group_id. - **virus_total_graphs_delete_editor** — Revoke edit graph permissions from a user or group in VirusTotal. Returns an empty 204 response on success. Required: graph_id, user_or_group_id. ## How it works 1. **Link your customer's VirusTotal account.** Use Truto's frontend SDK; we handle every OAuth and API key flow so you don't need to create the OAuth app. 2. **Authentication is automatic.** Truto refreshes tokens, stores credentials securely, and injects them into every API request. 3. **Call Truto's API to reach VirusTotal.** The Proxy API is a 1-to-1 mapping of the VirusTotal API. 4. **Get a unified response format.** Every response uses a single shape, with cursor-based pagination and data in the `result` field. ## Use cases - **Enrich security alerts with crowdsourced verdicts** — SIEM, XDR, and detection platforms can automatically append VirusTotal's aggregated AV verdicts, reputation scores, and threat categories to IoCs surfaced in their product, turning raw alerts into triaged incidents without analysts pivoting between tools. - **Detonate suspicious files and URLs inline** — Email security, collaboration, and helpdesk SaaS can submit attachments and links to VirusTotal for dynamic analysis, then act on behavioral verdicts before content reaches end users — all without hosting their own sandbox infrastructure. - **Power threat hunting with Livehunt and Retrohunt** — Threat intelligence platforms can let analysts author YARA rules in their own UI and push them to VirusTotal as hunting rulesets or retrohunt jobs, streaming matches back into the product as adversary campaign signals. - **Automate SOAR playbooks with MITRE ATT&CK context** — SOAR vendors can trigger conditional playbooks based on VirusTotal's MITRE ATT&CK mappings and behavioral summaries — isolating hosts, blocking IPs, or escalating tickets when specific tactics or techniques are observed. - **Track adversary infrastructure through relationship pivots** — TIPs and investigation tools can walk VirusTotal's relationship graph — from a malicious IP to resolving domains, sibling hashes, and downloaded payloads — giving analysts a native pivoting experience inside the SaaS product. ## What you can build - **One-click IoC enrichment panel** — Fetch reputation reports for files, URLs, IPs, and domains by ID and render vendor verdicts, tags, and reputation scores alongside your product's own alerts. - **Inline file and URL sandboxing** — Submit artifacts via the file upload and URL submission endpoints, poll the analysis object, and surface behavioral verdicts back to users as soon as scanning completes. - **Managed Livehunt rulesets** — Let analysts create, update, and delete VirusTotal hunting rulesets from your UI, then stream matches into your product via the hunting notifications endpoints. - **Retrohunt job orchestration** — Launch retrohunt jobs against historical VirusTotal corpora, track progress, list matching files, and abort runs — all from your threat intel workflow. - **Adversary campaign collections** — Create and maintain IoC collections tied to threat actors or campaigns, add or remove elements as intel evolves, and export IoCs for downstream detection engineering. - **Forensic artifact retrieval** — Give incident responders one-click access to PCAPs, EVTX logs, memory dumps, and HTML behavior reports pulled directly from VirusTotal sandbox executions. ## FAQs ### How do end users authenticate their VirusTotal account? VirusTotal uses an API key issued per account. Through Truto's connected account flow, your end users provide their VirusTotal API key once and Truto handles secure storage and request signing on every call. ### Which VirusTotal tier is required for these operations? Basic lookups on files, URLs, IPs, and domains work with public API keys, but advanced capabilities — Livehunt rulesets, Retrohunt jobs, Intelligence search, relationship pivots, and forensic artifact downloads (PCAP, EVTX, memdump) — require a VirusTotal Enterprise/Premium key. Your end users bring their own entitlements. ### How do we handle VirusTotal's rate limits? VirusTotal enforces per-minute, per-day, and per-month quotas that vary by tier. Truto proxies calls and surfaces rate limit responses so you can back off gracefully; for high-volume enrichment, design around asynchronous submission and polling of the analysis object rather than blocking calls. ### Can we submit files and poll for results asynchronously? Yes. Use the file upload URL endpoint to submit artifacts, receive an analysis ID back, then poll the analysis endpoint until the scan completes. The same pattern applies to URL submissions. ### Can we pivot from one IoC to related artifacts? Yes. Every core object (file, URL, IP, domain) exposes relationship and relationship descriptor endpoints, letting you traverse from a hash to contacted domains, from an IP to resolving domains, or from a domain to downloaded files — the same graph VirusTotal analysts use. ### How fresh is the data returned from VirusTotal? Reports reflect the most recent analysis VirusTotal has on file. If you need up-to-date verdicts on a known artifact, trigger the rescan endpoint for files, URLs, IPs, or domains and poll the resulting analysis object for the refreshed verdict. ## Related reading - [Connect VirusTotal to Claude: Investigate IOCs and threat graphs](https://truto.one/blog/connect-virustotal-to-claude-investigate-iocs-and-threat-graphs/) — Learn how to connect VirusTotal to Claude using a managed MCP server. Automate IOC investigations, threat mapping, and malware analysis with AI agents. - [Connect VirusTotal to ChatGPT: Analyze Malware and Threat Verdicts](https://truto.one/blog/connect-virustotal-to-chatgpt-analyze-malware-and-threat-verdicts/) — Learn how to connect VirusTotal to ChatGPT using Truto's managed MCP server. Automate threat intelligence, malware analysis, and IoC lookups with AI agents. - [Connect VirusTotal to AI Agents: Automate Hunting and Threat Scans](https://truto.one/blog/connect-virustotal-to-ai-agents-automate-hunting-and-threat-scans/) — Learn how to connect VirusTotal to AI agents using Truto's /tools endpoint. Build autonomous threat hunting workflows with LangChain and CrewAI.