# VirusTotal MCP connector The VirusTotal connector lets Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent look up files, domains, and IP addresses in VirusTotal, request rescans, and leave comments and votes, all under each analyst's own access with every call logged. Source: https://elaichi.ai/connectors/virustotal/ ## Facts | | | | --- | --- | | Application | VirusTotal | | Category | Security | | AI tools | 150 | | Authentication | Connects with an API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | No. 150 tools is past the 30-tool threshold, so clients use `search_tools` and `execute_tool` | ## What you can ask once VirusTotal is connected - Check the reputation of this ip address before we allowlist it. - Summarize recent comments on this domain's VirusTotal record. - List relationships for this file hash reported this week. ## Connect VirusTotal in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick VirusTotal. 2. Optionally set Share with, then press Connect. 3. Paste a VirusTotal API key. One person generates a token in VirusTotal and pastes it once. Everyone else works through Share with, and never sees it. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which VirusTotal tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect VirusTotal to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect VirusTotal to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect VirusTotal to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect VirusTotal to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a VirusTotal tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with VirusTotal through Elaichi ### Check a suspicious sender domain fast Security operations. Paste the domain from a phishing report and ask what VirusTotal knows about it, including detection results, related IP addresses, and what other analysts have said in comments. ### Pull the report for a file hash Incident response. During an incident, give the agent a file hash and get the VirusTotal report back in plain language, then ask for a fresh rescan if the last analysis is stale. ### Trace where a domain has resolved Threat intelligence. Ask which IP addresses a domain has pointed to and what else sits on those addresses, so an analyst can map infrastructure without clicking through each resolution by hand. ### Vet an attachment before opening it IT help desk. A staff member forwards an unfamiliar attachment, and the desk uploads it to VirusTotal through the agent and gets back a verdict before anyone opens the file. ### Record findings on an indicator Security operations. After an investigation, leave a comment and cast a vote on the IP address, domain, or file in VirusTotal so the next analyst who lands on it sees the conclusion. ### Screen a vendor's public footprint Risk and compliance. Before onboarding a vendor, ask for the VirusTotal standing of their domains and hosting IP addresses and get a short summary suitable for the risk file. ## Frequently asked questions ### How do I connect VirusTotal to Claude? Connecting VirusTotal to Claude takes two steps. In Elaichi, pick VirusTotal from the catalog and paste in your VirusTotal API key, which you copy from your VirusTotal account settings; there is no client ID or secret to generate. Then in Claude open Customize, then Connectors, then Add, and paste the endpoint https://api.elaichi.ai/mcp. Sign in with your Elaichi account and VirusTotal is available to Claude. ### Does VirusTotal work with ChatGPT and Cursor as well as Claude? Yes. Once VirusTotal is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client, and the Elaichi Agent. You connect VirusTotal once and every client you use picks it up. ### What can an AI agent actually do with my VirusTotal data? With VirusTotal connected, an agent can look up an IP address, domain, or file hash and explain the detection results, list what a domain resolves to and what else lives on an address, read and add analyst comments, cast votes, request a rescan, and upload a file for analysis. Because VirusTotal offers a large set of actions, short concrete asks work best, such as the domain or hash followed by what you want to know. ### Does connecting VirusTotal give the AI everything in my VirusTotal account? No. Every call to VirusTotal runs with the API key of the person who connected it, so the agent can only reach what that VirusTotal account already can, at that account's quota and privilege level. Elaichi can narrow that further with restrictions on specific actions, and it never widens access beyond what VirusTotal itself allows. ### Can my team share one VirusTotal connection? Yes. One person connects VirusTotal in Elaichi and shares the connection with a team, and nobody else on the team ever sees or handles the VirusTotal API key. Each teammate still signs in to Elaichi as themselves, so the audit log names who ran each VirusTotal lookup, upload, comment, or rescan. ### Can I stop an agent from changing things in VirusTotal? Yes. Restrictions in Elaichi work per action, so you can allow lookups on files, domains, and IP addresses in VirusTotal while blocking uploads, comments, votes, or rescans. A blocked action is never shown to Claude, ChatGPT, Cursor, or any other client at all, so no prompt, however worded, can reach it. ### What happens to a VirusTotal connection when someone leaves? When you offboard a person in Elaichi, their access to VirusTotal through Elaichi ends at once, in every client they had set up. A shared VirusTotal connection keeps working for everyone else on the team. If you want VirusTotal gone entirely, disconnecting it once in Elaichi removes it from Claude, ChatGPT, Cursor, and every other client in one step. ## All 150 VirusTotal tools Every tool below is callable through https://api.elaichi.ai/mcp once VirusTotal is connected, subject to the toolbox it is in and the restrictions on the caller. - **List all VirusTotal IP addresses** (List). Get a VirusTotal IP address report by IP. Returns: data. Required: ip. - **VirusTotal IP addresses rescan** (Action). Rescan an IP address in VirusTotal to refresh its verdicts, whois information, and SSL certificates. Returns: type, id, links. The returned analysis id can be used with the Analyses endpoint to retrieve vendor verdicts. Required: ip_addresse_id. - **VirusTotal IP addresses list comments** (List). List comments posted on a VirusTotal IP address. Returns: type, id, attributes (text, html, tags, votes, date), links for each comment. Required: ip_addresse_id. - **VirusTotal IP addresses create comment** (Create). Post a comment for a given IP address in VirusTotal. Any word starting with # in the comment text is treated as a tag and added to the comment's tag attribute. Returns the created comment object including its id, type, text, tags, html, date, and votes. Required: ip_addresse_id, data. - **VirusTotal IP addresses list relationships** (List). List objects related to a given IP address by relationship name in VirusTotal. Returns an array of related objects, each with type, id, links, and attributes. Required: ip_addresse_id, relationship. - **VirusTotal IP addresses list relationship descriptors** (List). List relationship descriptors for a VirusTotal IP address, returning only the related objects' IDs and any context attributes instead of full object attributes. Returns: type, id, attributes. Required: ip_addresse_id, relationship. - **VirusTotal IP addresses list votes** (List). List votes cast on a VirusTotal IP address. Returns: type, id, attributes, links. Required: ip_addresse_id. - **VirusTotal IP addresses create vote** (Create). Cast a vote for a VirusTotal IP address. The verdict must be either harmless or malicious. Returns the created vote object including type, id, and attributes with the verdict. Required: ip_addresse_id, data. - **Get single VirusTotal IP address by ID** (Get). Get a VirusTotal IP address report by id, including threat reputation and context from antivirus products and security tools. Returns: type, id, links, attributes. Required: id. - **List all VirusTotal domains** (List). Get information about a specific domain in VirusTotal. Returns: type, id, links, attributes, relationships, data. Required: domain. - **VirusTotal domains rescan** (Action). Trigger a rescan of a domain in VirusTotal to refresh its verdicts, WHOIS information, and SSL certificates. Returns: type, id, links. Required: domain_id. - **VirusTotal domains list comments** (List). List comments for a specific domain in VirusTotal. Returns: type, id, attributes, links. Required: domain_id. - **VirusTotal domains create comment** (Create). Post a comment for a specific domain in VirusTotal. Any word starting with # in the comment text is treated as a tag. Returns: type, id, attributes, links. Required: domain_id, data. - **VirusTotal domains list relationships** (List). List objects related to a domain in VirusTotal by relationship type (e.g., resolutions, siblings, subdomains). Returns: type, id, links, attributes, relationships. Required: domain_id, relationship. - **VirusTotal domains list relationship descriptors** (List). List related object descriptors for a VirusTotal domain by relationship name, returning only the related objects' IDs instead of full attributes. Returns: type, id, attributes. Required: domain_id, relationship. - **VirusTotal domains list votes** (List). List votes cast on a VirusTotal domain. Returns: type, id, attributes. Required: domain_id. - **VirusTotal domains create vote** (Create). Cast a vote on a VirusTotal domain. Returns: type, id, attributes. Required: domain_id, data. Verdict must be either harmless or malicious. - **Get single VirusTotal domain by ID** (Get). Get a VirusTotal domain report by id, including threat reputation and analysis context. Returns: type, id, links, attributes. Required: id. - **Get single VirusTotal resolution by ID** (Get). Get a VirusTotal DNS resolution by id. The resolution object ID is formed by appending the IP address and the domain it resolves to together. Returns: type, id, links, attributes. Required: id. - **Create a VirusTotal file** (Create). Upload a file to VirusTotal for scanning with 70+ antivirus products and analysis tools. Returns an analysis descriptor with type and id — use the id with the GET /analyses/{id} endpoint to check the analysis status. Required: file. For files larger than 32MB, obtain a special upload URL via the get_upload_url method first; the actual size limit is 650MB. - **VirusTotal files get upload URL** (Get). Get a special one-time-use upload URL from VirusTotal for uploading files larger than 32MB. Returns a URL string to use as the POST target with the same multipart format expected by POST /files. Each upload URL can be used only once. No required parameters. - **Get single VirusTotal file by ID** (Get). Get a VirusTotal file report by its SHA-256, SHA-1, or MD5 hash, retrieving the analysis report including threat reputation and context from 70+ antivirus products and 10+ dynamic analysis sandboxes. Returns the File object including its type, id, attributes, and links. Required: id. - **VirusTotal files rescan** (Action). Re-analyse a previously uploaded file in VirusTotal without re-uploading it. Returns an analysis descriptor with type and id — use the id with the analyses endpoint to poll results. Required: file_id. Do not rescan more than 50K files per day to avoid denial of service on the scanning infrastructure. - **VirusTotal files get download URL** (Get). Get a signed download URL for a file stored in VirusTotal. Returns the signed URL string which expires after 1 hour. Required: file_id. Getting the URL counts as a file download in your quota, but subsequent downloads via the URL do not consume additional quota. - **VirusTotal files download** (Download). Download a file from VirusTotal by hash. Returns the file binary via redirect to a signed download URL valid for 1 hour. Required: file_id. Premium privileges required. - **VirusTotal files list comments** (List). List comments on a VirusTotal file by hash. Returns: type, id, links, attributes. Required: file_id. - **VirusTotal files create comment** (Create). Post a comment on a VirusTotal file by hash. Words starting with # in the text are automatically added as tags. Returns: type, id, links, attributes. Required: file_id, data. - **VirusTotal files list relationships** (List). List objects related to a VirusTotal file by relationship type, returning full object attributes. Returns: type, id, links, attributes. Required: file_id, relationship. - **VirusTotal files list relationship descriptors** (List). List descriptors of objects related to a VirusTotal file by relationship type, returning only IDs instead of full object attributes. Returns: type, id, attributes. Required: file_id, relationship. - **VirusTotal files list votes** (List). List votes cast on a file in VirusTotal. Returns: type, attributes. Required: file_id. - **VirusTotal files create vote** (Create). Create a vote on a file in VirusTotal. Returns: type, attributes. The verdict must be either harmless or malicious. Required: file_id. - **VirusTotal files get behaviour summary** (Get). Get a merged behavioural summary for a file in VirusTotal, combining sandbox reports from all integrated sandboxes. Returns: attributes. Required: file_id (SHA-256, SHA-1, or MD5). - **VirusTotal files get mitre attack summary** (Get). Get a summary of MITRE ATT&CK tactics and techniques observed in each sandbox report for a VirusTotal file. Returns a map keyed by sandbox name; each entry contains a tactics array with id, name, description, link, and nested techniques (id, name, description, link, signatures with severity and description). Required: file_id. - **VirusTotal files list behaviours** (List). List all sandbox behaviour reports for a VirusTotal file. Returns each report's id, type, and attributes including sandbox_name, analysis_date, has_html_report, has_pcap, processes_tree, signature_matches, mitre_attack_techniques, and others. Required: file_id. - **Get single VirusTotal sigma rule by ID** (Get). Get a single VirusTotal Sigma Rule by id. Returns the Sigma Rule object including its type, id, and attributes. Required: id. - **Get single VirusTotal yara ruleset by ID** (Get). Get a YARA Ruleset from VirusTotal by id. Returns the ruleset object including its type, id, links, and attributes. Required: id. - **Get single VirusTotal file behaviour by ID** (Get). Get a VirusTotal file behaviour sandbox report by id. The id combines the analysed file's SHA256 and the sandbox name joined by an underscore. Returns: type, id, links, attributes. Required: id. - **VirusTotal file behaviours list relationships** (List). List objects related to a VirusTotal file behaviour sandbox report by relationship name. Returns: type, id, links, attributes. Required: sandbox_id, relationship. - **VirusTotal file behaviours list relationship descriptors** (List). List only the IDs (and context attributes, if any) of objects related to a VirusTotal file behaviour sandbox report, without returning full attributes. Returns: type, id, attributes. Required: sandbox_id, relationship. - **VirusTotal file behaviours get HTML report** (Get). Get the HTML report for a VirusTotal file behaviour sandbox analysis. Returns the rendered HTML report content for the sandbox execution. Required: sandbox_id. - **VirusTotal file behaviours get evtx** (Get). Fetch the EVTX (Windows Event Log) file associated with a VirusTotal sandbox execution. This endpoint is only available for users with special privileges. Returns the EVTX file content. Required: sandbox_id. - **VirusTotal file behaviours get pcap** (Get). Download the PCAP (packet capture) file associated with a VirusTotal sandbox execution. Returns the raw binary PCAP file content. Required: sandbox_id. This endpoint requires special privileges. - **VirusTotal file behaviours get memdump** (Get). Download the memory dump file associated with a VirusTotal sandbox execution. Returns the raw binary memory dump file content. Required: sandbox_id. This endpoint requires special privileges. - **Create a VirusTotal URL** (Create). Scan a URL with VirusTotal to analyse it with 70+ antivirus products. Returns an analysis descriptor with id, type, and links that can be used to retrieve the analysis via the Analyses endpoint. Required: url. - **Get single VirusTotal URL by ID** (Get). Get a URL report from VirusTotal by id. Returns the URL object with type, id, links, and attributes. Required: id. - **VirusTotal URLS rescan** (Action). Trigger a rescan of a previously scanned URL in VirusTotal. Returns an analysis descriptor with id, type, and links for tracking the new analysis via the Analyses endpoint. Required: url_id. - **VirusTotal URLS list comments** (List). List community comments for a specific URL in VirusTotal. Returns comment objects with type, id, attributes, and links. Required: url_id. - **VirusTotal URLS create comment** (Create). Post a comment on a specific URL in VirusTotal. Returns the created comment object with type, id, attributes, and links. Any word starting with # in the comment text is treated as a tag. Required: url_id, data. - **VirusTotal URLS list relationships** (List). List objects related to a VirusTotal URL by relationship name, returning full related objects with all attributes. Returns: type, id, links, attributes, relationships. Required: url_id, relationship. Some relationships are accessible only to VirusTotal Enterprise users. - **VirusTotal URLS list relationship descriptors** (List). List descriptors (IDs and context attributes only) of objects related to a VirusTotal URL by relationship name, without returning full object attributes. Returns: type, id, attributes. Required: url_id, relationship. - **VirusTotal URLS list votes** (List). List VirusTotal Vote objects for a given URL. Returns: type, attributes. Required: url_id. - **VirusTotal URLS create vote** (Create). Post a vote for a given VirusTotal URL. The verdict attribute must be either harmless or malicious. Returns: type, attributes. Required: url_id, data. - **List all VirusTotal comments** (List). List the latest comments added to VirusTotal. Returns each comment with id, type, links, and attributes including date, tags, html, text, and votes. The filter parameter allows narrowing results by tag (e.g. filter=tag:malware). - **Get single VirusTotal comment by ID** (Get). Get a single VirusTotal comment by id. Returns the comment object including id, type, links, and attributes with date, tags, html, text, and votes. Required: id. - **Delete a VirusTotal comment by ID** (Delete). Delete a VirusTotal comment by id. Returns an empty 204 response on success. Required: id. - **VirusTotal comments list relationships** (List). List objects related to a VirusTotal comment by relationship name. Returns each related object with id, type, links, and type-specific attributes. Required: comment_id, relationship. - **VirusTotal comments list relationship descriptors** (List). List descriptors (IDs only) for objects related to a VirusTotal comment. Returns each related object descriptor with id, type, links, and attributes. Required: comment_id, relationship. - **VirusTotal comments create vote** (Create). Cast a vote on a VirusTotal comment by specifying a vote type. Returns the updated vote counts: abuse, negative, positive. Required: comment_id, data (positive, negative, or abuse). - **Get single VirusTotal analysis by ID** (Get). Get a specific VirusTotal analysis by id. Returns the analysis object including its type, id, attributes (status, progress), links, and relationships. Required: id. - **VirusTotal analyses list relationships** (List). List related objects for a VirusTotal analysis by relationship name. Returns related objects with their type, id, attributes, links, and relationships. Required: analyse_id, relationship. - **VirusTotal analyses list relationship descriptors** (List). List relationship descriptors (ID and context attributes only) for a VirusTotal analysis. Returns related object descriptors with their type, id, attributes, links, and relationships. Required: analyse_id, relationship. - **Get single VirusTotal submission by ID** (Get). Get a VirusTotal submission by id. Returns the submission object including its type, id, attributes, and links. Required: id. - **Get single VirusTotal operation by ID** (Get). Get a specific VirusTotal operation by id. Returns the operation object including its type, id, and attributes with status, progress, files_ok, and files_error. Required: id. - **Get single VirusTotal attack tactic by ID** (Get). Get a specific MITRE ATT&CK attack tactic in VirusTotal by id. Returns the attack tactic object including type, id, links, attributes, and relationships. Required: id. - **VirusTotal attack tactics list relationships** (List). List objects related to a VirusTotal attack tactic for a specified relationship. Returns each related object's type, id, links, and attributes. Required: attack_tactic_id, relationship. - **VirusTotal attack tactics list relationship descriptors** (List). List descriptors of objects related to a VirusTotal attack tactic for a specified relationship. Returns each related object descriptor's type and id only, without full attributes. Required: attack_tactic_id, relationship. - **Get single VirusTotal attack technique by ID** (Get). Get a specific VirusTotal attack technique by id. Returns the attack technique object including its type, id, links, and attributes. Required: id. - **VirusTotal attack techniques list relationships** (List). List objects related to a VirusTotal attack technique for a given relationship name. Returns related objects including their type, id, links, and attributes. Required: attack_technique_id, relationship. - **VirusTotal attack techniques list relationship descriptors** (List). List descriptors of objects related to a VirusTotal attack technique for a given relationship name. Returns just the related object's type and id without full attributes. Required: attack_technique_id, relationship. - **List all VirusTotal popular threat categories** (List). List popular threat categories in VirusTotal. Returns normalized malware category name strings (e.g., trojan, dropper, ransomware) commonly used in AV verdicts and set as part of a file's popular_threat_classification. No required parameters beyond API key authentication. - **VirusTotal codeinsights analyse binary** (Action). Analyze disassembled or decompiled code in VirusTotal Code Insights for malware-relevant functionality. Returns a Base64-encoded string containing the AI-generated description of the code's behavior. Required: data.code, data.code_type. Limited to 50 requests per day. - **List all VirusTotal saved searches** (List). List VirusTotal saved searches you have access to as owner, editor, or viewer. Returns each saved search with type, id, and attributes including name, description, search_query, private, tags, creation_date, last_modification_date, origin, and owner. Max 40 per page. - **Get single VirusTotal saved search by ID** (Get). Get a single VirusTotal saved search by id. Returns: type, id, attributes. Required: id. - **Create a VirusTotal saved search** (Create). Create a new VirusTotal saved search; the caller automatically becomes its owner. Returns: type, id, attributes. Required: data. - **VirusTotal saved searches share** (Share). Grant viewer or editor access on a VirusTotal saved search to specific users or the owner's group. Editor privileges can only be granted to members of the same group as the owner. Returns: type, id, attributes. Required: saved_searche_id, access, data. - **Update a VirusTotal saved search by ID** (Update). Update attributes of an existing VirusTotal saved search. To modify tags, retrieve the current list first and submit the full resulting list. Returns: type, id, attributes. Required: id, data. - **Delete a VirusTotal saved search by ID** (Delete). Delete a VirusTotal saved search by id. Upon deletion, the search is permanently removed and will no longer be accessible to any users with whom it was previously shared. Returns an empty 204 response on success. Required: id. - **VirusTotal saved searches revoke access** (Revoke). Revoke viewer or editor access to a VirusTotal saved search for specific users or the owner's entire group. Requires a request body even when using the DELETE method. Returns an empty 204 response on success. Required: saved_searche_id, access, and a data payload listing the users/groups to revoke. - **VirusTotal saved searches list relationship descriptors** (List). List related object descriptors for a specific relationship of a VirusTotal saved search, returning just the related object's type and id instead of all attributes. Returns: type, id, attributes. Required: saved_searche_id, relationship. Max 40 related objects per page. - **VirusTotal saved searches list relationships** (List). List full related objects for a specific relationship of a VirusTotal saved search, returning all attributes of the related objects. Returns: type, id, links, attributes. Required: saved_searche_id, relationship. Max 40 related objects per page. - **VirusTotal search search** (Search). Search VirusTotal for files, URLs, domains, IP addresses, or comments by query string. Returns a list of matching objects each with id, type, attributes, and links; the attributes shape varies by result type (e.g. comment attributes include date, html, tags, text, and votes). Required: query. - **VirusTotal intelligence search search** (Search). Search files in VirusTotal's dataset using Intelligence query syntax (same as the VT Intelligence UI). Returns matching objects with id, type, and context_attributes including confidence, match_in_subfile, snippet, and similarity_score. Required: query. Content searches cannot be sorted; fuzzy hash searches are throttled to 15 per minute. - **VirusTotal intelligence search get snippets** (Search). Get file content snippets that matched a VirusTotal Intelligence search query. Returns a list of strings containing content hexdump and plain text, with matched content between * characters. Required: snippet. - **List all VirusTotal metadata** (List). Get VirusTotal metadata including the full list of detection engines, available privileges, and object relationship descriptors. Returns: engines, privileges, relationships. - **Create a VirusTotal collection** (Create). Create a new VirusTotal collection with IOCs provided as relationship descriptors or raw text. Returns: id, type, links, attributes, relationships, raw_items. Required: data (with type and attributes.name). - **Get single VirusTotal collection by ID** (Get). Get a single VirusTotal collection by id. Returns: id, type, links, attributes, relationships, raw_items. Required: id. - **Update a VirusTotal collection by ID** (Update). Update a VirusTotal collection's name or description and add IOCs via raw text by id. Returns: id, type, links, attributes, relationships, raw_items. Required: id, data (with type). - **Delete a VirusTotal collection by ID** (Delete). Delete a VirusTotal collection by id. Returns an empty 204 response on success. Required: id. - **VirusTotal collections list comments** (List). List comments on a VirusTotal collection. Returns: type, id, links, attributes. Required: collection_id. - **VirusTotal collections create comment** (Create). Post a comment on a VirusTotal collection. Any word starting with # in the comment text is treated as a tag and added to the comment's tags attribute. Returns: type, id, links, attributes. Required: collection_id, data. Comment IDs are auto-generated; do not include an id in the request body. - **VirusTotal collections list relationships** (List). List related objects for a VirusTotal collection by relationship name. Returns an array of related objects with id, type, links, and attributes. Required: collection_id, relationship. - **VirusTotal collections list relationship descriptors** (List). List related object descriptors for a VirusTotal collection's relationship. This is the same as the full relationship endpoint but returns only the descriptor (type and id) instead of all attributes. Returns: type, id, links, attributes. Required: collection_id, relationship. - **VirusTotal collections add elements** (Add). Add new elements to a VirusTotal collection's relationship by sending object descriptors. Returns: id, type, attributes, raw_items, links. Required: collection_id, data. - **VirusTotal collections delete elements** (Delete). Remove elements from a VirusTotal collection's relationship by sending object descriptors. Returns: data. Required: collection_id, data. - **List all VirusTotal collections** (List). List VirusTotal IoC collections with optional filtering and sorting. Returns each collection with type, id, links, attributes (name, description, creation_date, last_modification_date, owner, source_region, targeted_region, targeted_industry, threat_category, tag), and relationships (domains, urls, ip_addresses, files). Max 40 per page. - **VirusTotal collections export iocs** (Export). Export all IoCs from a VirusTotal collection in json, csv, or stix format. Returns: type, id, links, attributes, relationships. Required: collection_id, format. - **VirusTotal collections export iocs relationship** (Export). Export IoCs from a specific relationship of a VirusTotal collection in json, csv, or stix format. Returns: type, id, links, attributes, relationships. Required: collection_id, relationship, format. - **VirusTotal collections export aggregations** (Export). Export aggregation data from a VirusTotal collection in json or csv format. Returns: type, id, links, attributes. Required: collection_id, format. - **VirusTotal collections search iocs** (Search). Search IoCs inside a VirusTotal collection using VT Intelligence queries. By default searches files; use entity:domain/ip/url for other entity types. Returns: type, id, links, attributes, relationships. Required: collection_id, query. Max 40 per page. - **Create a VirusTotal zip file** (Create). Create a VirusTotal ZIP file containing files specified by their hashes. Returns: type, id, attributes. Required: data.hashes. The ZIP is built asynchronously — poll the get endpoint until status is 'finished'. - **Get single VirusTotal zip file by ID** (Get). Get a VirusTotal ZIP file by id. Returns: type, id, attributes. The status field tracks creation progress through starting, creating, finished, timeout, error-starting, and error-creating. Required: id. - **VirusTotal zip files get download URL** (Get). Get a signed download URL for a VirusTotal ZIP file. Returns the signed URL string, valid for 1 hour. Required: zip_file_id. - **VirusTotal zip files download** (Download). Download a VirusTotal ZIP file by redirecting to a signed download URL. The redirect URL remains valid for 1 hour. Required: zip_file_id. - **List all VirusTotal yara rules** (List). List VirusTotal Crowdsourced YARA rules. Returns each rule with id, type, attributes (including name, author, rule, tags, matches, enabled, creation_date, last_modification_date, and meta), and links. Supports filter and order query parameters for narrowing and sorting results. - **Get single VirusTotal yara rule by ID** (Get). Get a single VirusTotal Crowdsourced YARA rule by id. Returns the rule object with id, type, attributes (including name, author, rule, tags, matches, enabled, creation_date, last_modification_date, and meta), and links. Required: id. - **VirusTotal yara rules list relationships** (List). List objects related to a VirusTotal YARA rule for a given relationship name. Returns related objects with id, type, attributes, links, and an error field for related items not present in VirusTotal's database. Required: yara_rule_id, relationship. - **VirusTotal yara rules list relationship descriptors** (List). List descriptors of objects related to a VirusTotal YARA rule for a given relationship name. Returns related object descriptors with id, type, and context_attributes when available, without full object attributes. Required: yara_rule_id, relationship. - **List all VirusTotal ioc stream** (List). List objects from the VirusTotal IoC Stream including files, URLs, domains, and IP addresses, each carrying notification context attributes. Returns: type, id, links, context_attributes, attributes, relationships. Max 40 objects per page. - **VirusTotal ioc stream delete notifications** (Delete). Delete notifications from the VirusTotal IoC Stream matching a filter string. Uses the same filters as the list endpoint. Returns an empty 204 response on success. - **Get single VirusTotal ioc stream notification by ID** (Get). Get a single VirusTotal IoC Stream notification by id. Returns the notification object including its type, id, links, and attributes with notification_date, origin, sources, and tags. Required: id. - **Delete a VirusTotal ioc stream notification by ID** (Delete). Delete a VirusTotal IoC Stream notification by id. Returns an empty 200 response on success. Required: id. - **List all VirusTotal hunting rulesets** (List). List VT Hunting Livehunt rulesets viewable by the current user. Returns each ruleset with type, id, and attributes including name, rules, enabled, limit, creation_date, modification_date, notification_emails, and match_object_type. Use the filter parameter to narrow by enabled status, name, rules content, or tags; order results by name, creation_date, or modification_date. - **Create a VirusTotal hunting ruleset** (Create). Create a new VT Hunting Livehunt ruleset. Returns the created ruleset including its type, id, and attributes (name, rules, enabled, limit, notification_emails, match_object_type, creation_date, modification_date, number_of_rules). Required: name, rules. - **VirusTotal hunting rulesets delete all** (Delete). Delete all VirusTotal Hunting Livehunt rulesets owned by the user and remove the user from shared rulesets' editor lists. This asynchronous operation launches a background job and returns an Operation object immediately. Returns: data, id, links. Required: data. The x-confirm-delete header must be set to your username for this destructive operation. - **Get single VirusTotal hunting ruleset by ID** (Get). Get a VirusTotal Hunting Livehunt ruleset by id. Returns the ruleset object including type, id, links, and attributes (enabled, limit, name, notification_emails, rules, creation_date, modification_date). Required: id. - **Update a VirusTotal hunting ruleset by ID** (Update). Update a VirusTotal Hunting Livehunt ruleset by id, modifying attributes such as enabled, limit, name, notification_emails, and rules. Returns the updated ruleset object including type, id, and attributes. Required: id, data. - **VirusTotal hunting rulesets check editor** (Action). Check whether a specific user or group has editing access to a VirusTotal hunting ruleset. Returns a boolean — true if the user or group is an editor, false otherwise. Required: hunting_ruleset_id, user_or_group_id. - **VirusTotal hunting rulesets revoke editor** (Revoke). Revoke editing access for a user or group from a VirusTotal hunting ruleset. Returns an empty response on success. Required: hunting_ruleset_id, user_or_group_id. - **Delete a VirusTotal hunting ruleset by ID** (Delete). Delete a VirusTotal hunting ruleset by id. Returns an empty response on success. Required: id. - **VirusTotal hunting rulesets list relationships** (List). Retrieve all fully-expanded relationships for a VirusTotal hunting ruleset. Returns the hunting ruleset object including type, id, links, and attributes (name, enabled, limit, rules, notification_emails, match_object_type, creation_date, modification_date, number_of_rules). Required: hunting_ruleset_id. - **VirusTotal hunting rulesets list relationship descriptors** (List). Retrieve descriptors for a specific relationship of a VirusTotal hunting ruleset, returning only the related object's descriptor and context attributes instead of full attributes. Returns: type, id, links, attributes. Required: hunting_ruleset_id, relationship. - **VirusTotal hunting rulesets grant editor** (Action). Grant editor privileges on a VirusTotal Livehunt hunting ruleset to one or more users or groups. Returns the hunting ruleset object including type, id, and attributes (name, enabled, limit, rules, notification_emails). Required: hunting_ruleset_id, data. - **VirusTotal hunting rulesets transfer ownership** (Action). Transfer ownership of a VirusTotal Livehunt hunting ruleset to another user. The new owner must belong to the same group the ruleset was created with. Returns the hunting ruleset object including type, id, and attributes (name, enabled, limit, rules, notification_emails). Required: hunting_ruleset_id, data. - **List all VirusTotal hunting notifications** (List). List VirusTotal hunting notifications triggered by your Livehunt rulesets or rules shared with you. Returns: id, type, attributes, relationships, links. Filter by tag, owner, or date; order by date ascending or descending. - **VirusTotal hunting notifications delete all** (Delete). Delete VirusTotal hunting notifications in bulk, optionally filtered by tag. If no tag is specified, all notifications are deleted. Returns an empty 200 response on success. - **Get single VirusTotal hunting notification by ID** (Get). Get a single VirusTotal hunting notification by id. Returns: id, type, attributes, links. Required: id. - **Delete a VirusTotal hunting notification by ID** (Delete). Delete a single VirusTotal hunting notification by id. Returns an empty 200 response on success. Required: id. - **VirusTotal hunting notifications list files** (List). List files matching your VirusTotal hunting notifications, with context attributes describing each notification match. Returns: id, type, attributes, context_attributes, relationships, links. - **List all VirusTotal retrohunt jobs** (List). List VirusTotal Retrohunt jobs, optionally filtered by status. Returns each job with type, id, and attributes (rules, corpus, notification_email, time_range, status). Optional filter uses syntax status:(starting|running|aborting|aborted|finished). - **Create a VirusTotal retrohunt job** (Create). Create a new VirusTotal Retrohunt job with YARA rules to scan past files. Returns the created job including type, id, and attributes (rules, corpus, notification_email, time_range, status). Required: data.type and data.attributes.rules. Up to 10 concurrent jobs and 300 YARA rules per job. - **Get single VirusTotal retrohunt job by ID** (Get). Get a single VirusTotal Retrohunt job by id. Returns: type, id, attributes. Required: id. - **Delete a VirusTotal retrohunt job by ID** (Delete). Delete a VirusTotal Retrohunt job by id. Returns: type, id, attributes, data. Required: id. - **VirusTotal retrohunt jobs abort** (Action). Abort a running VirusTotal Retrohunt job. Returns the job object including type, id, and attributes (rules, corpus, notification_email, time_range, status). Required: retrohunt_job_id. - **VirusTotal retrohunt jobs list matching files** (List). List files matching a VirusTotal retrohunt job's YARA rules. Returns: type, id, links, attributes. Required: retrohunt_job_id. - **VirusTotal graphs search** (Search). Search VirusTotal graphs by filter criteria and free-text query. Returns each graph record with id, type, attributes (nodes, links, graph_data, position, private, creation_date), and links. The filter parameter supports modifiers such as id:, name:, owner:, private:, creation_date:, and node-related modifiers combinable with AND, OR, and NOT; order supports name, owner, creation_date,… - **Get single VirusTotal graph by ID** (Get). Get a single VirusTotal graph by id. Returns: id, type, attributes, links. Required: id. - **Update a VirusTotal graph by ID** (Update). Update a VirusTotal graph's nodes, links, graph_data, position, or private status. Returns the updated graph object with id, type, attributes, and links. Required: id. - **Delete a VirusTotal graph by ID** (Delete). Delete a VirusTotal graph by id. Returns an empty 200 response on success. Required: id. - **VirusTotal graphs list comments** (List). List comments posted on a VirusTotal graph. Returns each comment with id, type, attributes (text, html, tags, votes, date), and links. Required: graph_id. - **VirusTotal graphs create comment** (Create). Post a comment to a VirusTotal graph. Returns: type, id, attributes, links. Required: graph_id. - **VirusTotal graphs list relationships** (List). List objects related to a VirusTotal graph by relationship name. Returns: type, id, attributes, links. Required: graph_id, relationship. - **VirusTotal graphs list relationship descriptors** (List). List just the IDs (and context attributes, if any) of objects related to a VirusTotal graph, instead of returning full attributes. Returns: type, id, attributes, links. Required: graph_id, relationship. - **VirusTotal graphs list viewers** (List). List users who can view a VirusTotal graph. The graph must be shared with them as Viewer for them to appear. Returns each viewer's id, type, attributes (first_name, last_name, profile_phrase, reputation, status, user_since), and links. Required: graph_id. - **VirusTotal graphs add viewer** (Add). Add a user or group as a viewer of a VirusTotal graph. Returns the updated list of viewers with id, type, attributes (first_name, last_name, profile_phrase, reputation, status, user_since), and links. Required: graph_id. - **VirusTotal graphs check viewer** (Action). Check if a user or group has Viewer access to a VirusTotal graph. Returns true if the user or group has Viewer access, false otherwise. Required: graph_id, user_or_group_id. - **VirusTotal graphs delete viewer** (Delete). Revoke viewer access from a user or group for a VirusTotal graph. Returns an empty 204 response on success. Required: graph_id, user_or_group_id. - **VirusTotal graphs list editors** (List). List the users and groups that have Editor access to a VirusTotal graph. The graph must be shared with them as Editor for them to appear. Returns: id, type, attributes, links. Required: graph_id. - **VirusTotal graphs add editor** (Add). Add a user or group as an editor of a VirusTotal graph. Returns: id, type, attributes, links. Required: graph_id, data. - **VirusTotal graphs check editor** (Action). Check if a user or group has Editor access to a VirusTotal graph. Returns true if the user or group has Editor access, false otherwise. Required: graph_id, user_or_group_id. - **VirusTotal graphs delete editor** (Delete). Revoke edit graph permissions from a user or group in VirusTotal. Returns an empty 204 response on success. Required: graph_id, user_or_group_id.