VirusTotal (Threat Intel)

Retrieve an attack tactic object by its ID

Retrieve information about a specific attack technique object representing a MITRE ATT&CK adversary technique by its ID (e.g. T1110, T1110.001)

This endpoint retrieves information about the latest comments added to Google Threat Intelligence. You can do some filtering over those comments, and get only those that contains a certain tag inside (e.g. filter=tag: malware).

Returns a Domain object for the given domain

Reanalyse a domain already in VirusTotal. This endpoint can be used to analyse domains or reanalyse them to refresh their verdicts, whois information, SSL certs, etc. This endpoint sends the domain to be (re)scanned and returns an analysis ID that can be used to retrieve the verdicts from the available vendors using the Analyses endpoint.

This endpoint can be used to analyse domains or reanalyse them to refresh their verdicts, whois information, SSL certs, etc. This endpoint sends the domain to be (re)scanned and returns an analysis ID that can be used to retrieve the verdicts from the available vendors using the Analyses endpoint.

Returns a list of Comment objects for a given domain

Returns a list of Comment objects for a given domain

Files containing the domain on its strings. Returns a list of files containing the given domain in their strings.

This endpoint returns just the related object's IDs (and context attributes, if any) for a domain's relationships, unlike the full relationships endpoint.

Get objects related to a domain by sending GET requests to the relationship URL

This endpoint returns just the related object's IDs (and context attributes, if any) for a domain's relationships instead of returning all attributes.

This endpoint returns just the related object's IDs (and context attributes, if any) for a domain's relationships, unlike the full relationships endpoint which returns all attributes.

Returns a Domain object for the given domain name

Get domain analysis report

Trigger analysis of a file and get private analysis ID

This endpoint returns behavioural information from each sandbox about the file. This API call returns all fields contained in the File behaviour object. Note some of the entries have has_html_report if true you may fetch the HTML File behaviour. has_pcap if true you may fetch the PCAP File behaviour.

For uploading files smaller than 32MB you can simply use the POST /files endpoint, but for larger files you need to obtain a special upload URL first, and then send the POST request to the upload URL instead of sending it to /files

Get a URL for uploading files larger than 32MB. For uploading files smaller than 32MB you can simply use the POST /files endpoint, but for larger files you need to obtain a special upload URL first, and then send the POST request to the upload URL instead of sending it to /files. Each upload URL can be used only once.

Endpoint used to search graphs. There are a set of multiple modifiers that you can use to refine your search results. You can combine all of them together and use them in conjunction with AND, OR and NOT operators.