---
updatedAt: 2026-01-23T11:30:21.000Z
agentTools:
  projectIndex: https://virustotal.readme.io/llms.txt
---

# List of VT Integrations

VirusTotal is the richest and most actionable *crowdsourced* threat intelligence suite. More than 3.6M users a month and tens of thousands of organizations world-wide rely on its threat reputation and context to be safer. Its popularity is such that most 3rd-party security technologies have built off-the-shelf turnkey integrations with our API, powering use cases such as automatic alert triage, event enrichment, false positive discarding, 2nd opinion detection and other threat detections and response flows. Some (not all) of these ubiquitous integrations are listed below, if you would like to ask about some other product or add an entry to this listing please do not hesitate to [contact us](https://www.virustotal.com/gui/contact-us/technical-support).

# SOAR Platforms

## Palo Alto Cortex XSOAR (Demisto)

🚀 See [content packs](https://cortex.marketplace.pan.dev/marketplace/?q=virustotal)

📖 [Integrating Cortex XSOAR and VirusTotal](https://live.paloaltonetworks.com/t5/blogs/integrating-cortex-xsoar-and-virustotal-for-maximum-incident/ba-p/520038) for maximum incident response and investigation

📺 Cortex XSOAR [VirusTotal Livehunt threat feeds](https://youtu.be/Qv89-iS9HVY)

ℹ️ Build a champion SOC with [VirusTotal and Palo Alto Cortex XSOAR](https://blog.virustotal.com/2022/02/build-champion-soc-with-virustotal-and.html)

## Splunk SOAR (Phantom)

🚀 [Download](https://splunkbase.splunk.com/app/5865) the integration in Splunkbase

📖 Learn about the integration in the [official Splunk documentation site](https://github.com/splunk-soar-connectors/virustotalv3)

📺 [Create playbooks](https://www.youtube.com/watch?v=GceweYMzuOQ) using VirusTotal enrichment

ℹ️ Import a [playbook example](https://splunk.github.io/soar-playbook-viewer/?playbook=https://raw.githubusercontent.com/phantomcyber/playbooks/latest/VirusTotal_v3_Identifier_Reputation_Analysis.json) to enrich your indicators

## SecOps SOAR (Siemplify)

🚀 Add VirusTotal from your SecOps SOAR Integration Marketplace

📖 Learn about the integration in the [official SecOps SOAR documentation site](https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/virustotal-v3)

📺 [Create playbooks](https://www.youtube.com/watch?v=EpPlwwTwIoI) using VirusTotal enrichment

## Swimlane

🚀 Download the VirusTotal plugin from [Swimlane's Apphub](https://apphub.swimlane.com/swimbundles/swimlane/sw_virus_total?_ga=2.81837654.1133739077.1669243135-167208904.1666774535)

📖 Understand the plugin from the [official documentation](https://apphub.swimlane.com/swimbundles/swimlane/sw_virus_total?_ga=2.81837654.1133739077.1669243135-167208904.1666774535)

📺 Watch how [VirusTotal leverages your Swimlane experience](https://swimlane.com/resources/videos/swimlane-virustotal-integration/)!

## ServiceNow

🚀 [Download the VirusTotal integration](https://store.servicenow.com/sn_appstore_store.do#!/store/application/6e7873e90b231200263a089b37673ab1/10.3.4?referer=%2Fstore%2Fsearch%3Flistingtype%3Dallintegrations%25253Bancillary_app%25253Bcertified_apps%25253Bcontent%25253Bindustry_solution%25253Boem%25253Butility%25253Btemplate%26q%3Dvirustotal\&sl=sh) from the ServiceNow store

📖 [Set up the VirusTotal integration and start enriching](https://docs.servicenow.com/bundle/utah-security-management/page/product/secops-integration-threat/secops-integration-virustotal/reference/virustotal-landing-page.html) with Threat Intelligence

📺 In [this recording](https://www.youtube.com/watch?v=QHsDRWtJ890) you can find the steps to set VirusTotal up in ServiceNow

## IBM Qradar SOAR (Resilient)

🚀 Download from [IBM's App Exchange](https://exchange.xforce.ibmcloud.com/hub/extension/9b9e32c2159332df425006e6d38effb0)

📖 Improve your playbooks following [the official documentation](https://exchange.xforce.ibmcloud.com/api/hub/extensionsNew/92db954438c783f1a38830316822b94c/README.pdf)

## Exabeam

🚀 [Improve your Incident Response](https://docs.exabeam.com/en/cloud-delivered-incident-responder/all/docs/configure-incident-responder-settings/configure-services/configure-the-virustotal-service.html) with the VirusTotal integration

## Logpoint SOAR

🚀 [Configure the VirusTotal integration](https://docs.logpoint.com/docs/virustotal-soar-integration/en/latest/virustotalapi.html) in your Logpoint instance

📖 Check some playbook examples using VT such as [email investigation](https://docs.logpoint.com/docs/suspicious-email-attachment-investigate-and-delete-playbook/en/latest/index.html#suspicious-email-attachment-investigate-and-delete) or [phishing response](https://docs.logpoint.com/docs/phishing-investigation-and-response-playbook/en/latest/index.html)

## Securonix SOAR

🚀 [Automate secops](https://documentation.securonix.com/onlinedoc/Content/6.4%20Cloud/Content/Apps%20and%20Add%20ons/Securonix%20SOAR%202.0/Integration%20Guide/VirusTotal.htm?Highlight=virustotal) connecting the VirusTotal integration

## Rapid7 InsightConnect

🚀 Install the [VirusTotal](https://extensions.rapid7.com/extension/virustotal) and [VirusTotal YARA](https://extensions.rapid7.com/extension/virustotal-yara) extensions to improve and automate your detection

📖 [Empower your playbooks](https://extensions.rapid7.com/extension?query=virustotal\&sort=relevance) using VirusTotal intelligence

## TheHive

🚀 Cortex analyzer allowing you to[ enrich and scan any IoC kind](https://thehive-project.github.io/Cortex-Analyzers/analyzers/VirusTotal/)

## Fortinet FortiSOAR

🚀 See [VirusTotal standard](https://fortisoar.contenthub.fortinet.com/detail.html?entity=virustotal\&version=3.1.0\&type=connector) connector

🚀 See [VirusTotal Premium](https://fortisoar.contenthub.fortinet.com/detail.html?entity=virustotal-premium\&version=1.1.1\&type=connector) connector

📖 Read the pertinent [connector documentation](https://docs.fortinet.com/document/fortisoar/3.1.0/virustotal/search?q=virustotal).

📺 See how [VirusTotal can supercharge phishing response](https://www.youtube.com/watch?v=Ch6yTGiES7I\&ab_channel=FortiSOARBytes) in conjunction with FortiSOAR.

## D3 Security

🚀 [Download](https://d3security.com/integrations/virustotal-soar-integration/) the D3Security integration.

📖 Learn about the integration in the [official D3 documentation site](https://docs.d3security.com/integration-docs/integration-docs/virustotal-v3)

***

# SIEM/XDR/TDR/Security Analytics Platforms

## Chronicle

🚀 [Contact us](https://www.virustotal.com/gui/contact-us) to empower Chronicle with VirusTotal Intelligence

📖 Learn about the [advantages of combining Chronicle and VirusTotal](https://assets.virustotal.com/chronicle-plus-vt.pdf)

## VT4SPlunk, the official VirusTotal  Splunk Integration

🚀 [Start unearthing](https://splunkbase.splunk.com/app/6654) threats, vulnerabilities and Threat Actors from your Splunk events

📖 Learn about the [insights VT4Splunk is going to bring to your Splunk](https://blog.virustotal.com/2023/03/introducing-vt4splunk-official.html)

📺 Watch [how to set it up and how it looks](https://www.youtube.com/watch?v=-M_MNS197y8)

## Microsoft Sentinel

🚀 Activate the VirusTotal connector from the Sentinel marketplace

📖 Check [what the VirusTotal connector is capable of](https://learn.microsoft.com/en-us/connectors/virustotal/)

📺 [Create playbooks](https://www.youtube.com/watch?v=myF6Jh3WS3g) using VirusTotal reports

ℹ️ Automate your Sentinel [incident triage](https://koosg.medium.com/automate-your-sentinel-incident-triage-a316d229f2fc)

## Palo Alto Cortex XDR

🚀 Configure the VirusTotal Threat Intel integration [following the official guide](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Integrate-External-Threat-Intelligence-Services)

📖 [Investigate](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Manage-Incidents) Incident key assets and artifacts

## Cisco SecureX

🚀 Follow [these steps](https://www.cisco.com/c/en/us/support/docs/security/securex/215987-integrate-cisco-securex-with-virustotal.html) to integrate VT with SecureX

📺 [Start enriching your indicators](https://www.youtube.com/watch?v=dMKIicliOWw) with VirusTotal

## IBM Qradar

🚀 [Get the latest VT Integration](https://exchange.xforce.ibmcloud.com/hub/extension/db73ab17547d28409303c2c2583a5160) for Qradar from IBM's App Exchange

📖  Enrich your IOCs in Qradar following the [official documentation](https://exchange.xforce.ibmcloud.com/api/hub/extensionsNew/92db954438c783f1a38830316822b94c/README.pdf)

## Securonix Snypr

🚀 [Contact us](https://www.virustotal.com/gui/contact-us) to get an API key to configure automatic response with VirusTotal

📖  Run [enhanced playbooks](https://documentation.securonix.com/onlinedoc/Content/Cloud/Content/Apps%20and%20Add%20ons/PDF%20Guides/VirusTotal%20Autmated%20Response%20Integration%20Guide.pdf)

## Logpoint

🚀 Configure the VirusTotal integration in your Logpoint instance

📖  [Enhance your threat hunting](https://www.logpoint.com/en/blog/threat-hunting-with-logpoint/) with VirusTotal + Logpoint

## Wazuh

🚀 Follow these steps to [configure the VT integration](https://documentation.wazuh.com/current/user-manual/manager/manual-integration.html#virustotal)

📖  Learn how the [VirusTotal integration can be used for scanning files](https://documentation.wazuh.com/current/user-manual/capabilities/malware-detection/virus-total-integration.html)

ℹ️  [Detect and remove malware](https://documentation.wazuh.com/current/proof-of-concept-guide/detect-remove-malware-virustotal.html)

## Fortinet FortiSIEM

🚀 Follow these steps to [configure the VT integration](https://help.fortinet.com/fsiem/6-7-6/Online-Help/HTML5_Help/Integration-settings.htm#VirusTot2)

***

# EDRs / EPPs / Nextgens / AVs / Endpoint Agents

## Crowdstrike

🚀 Get the official [VirusTotal integration](https://store.crowdstrike.com/apps/virustotal)!

📖  Understand how [VirusTotal enhances your experience in Crowdstrike](https://www.crowdstrike.com/wp-content/uploads/2021/06/virustotal-partner-data-sheet.pdf)

📺 Watch how to [augment your Incident Response](https://www.youtube.com/watch?v=PiRrrQtY9KE)

ℹ️ Use VirusTotal to [automate your SOC workflow](https://www.crowdstrike.com/blog/how-to-modernize-your-soc-with-falcon-fusion/)

## McAfee / Trellix

🚀 Create and [import a malicious file hash feed](https://docs.trellix.com/bundle/dl_1-1-0_ug/page/using-the-deny-list-module/importing-file-hashes-from-third-party-feed.html)

🚀 [Enhance your Threat Intelligence Exchange](https://docs.trellix.com/bundle/threat-intelligence-exchange-3.0.x-installation-guide/page/GUID-21BD3C6B-F99C-43A8-AAE9-D2D7337020FD.html) server with VirusTotal enrichment

## Symantec

🚀 When investigating a file, [send it to VirusTotal](https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-security/sescloud/Discovered-Items/viewing-discovered-files-v118544946-d4155e2999.html) to gather context

📺 Watch how to [use VirusTotal as a second opinion](https://www.youtube.com/watch?v=Py55-JTmkmk)

## Tanium

🚀 [Overlay IoC reputation](https://docs.tanium.com/reputation/reputation/configuring_sources.html#Configure_VirusTotal_reputation_source) for processes and other artifacts recorded by Tanium

📺 Watch how to identify risk in your Enterprise by [checking Tanium data against VirusTotal](https://youtu.be/37xA4SWcNnc)

***

# TIP Platorms

## MISP

🚀 Get the VirusTotal [import module](https://misp.github.io/misp-modules/expansion/#virustotal)

📖  Check how to [export and import VT Collections to MISP](https://blog.virustotal.com/2022/02/misp-and-vt-collections.html) to empower your investigation!

## Anomali Threatstream

🚀 Find the VirusTotal [threat analysis tool](https://www.anomali.com/marketplace/threat-analysis-tools) in Anomali's marketplace

📖  Learn how to [set the VT integration up](https://drive.google.com/file/d/15j0Ph9kZ--dO76JErp8NTcXgBJ6uI8m7/view?resourcekey=0-_6ucYXQB6vIzPu0AwnyEOw) and what capabilities it offers

***

# Email gateways / Mailbox defense / Phishing email analysis

## KnowBe4 Phisher

🚀 [Enhance your phishing protection](https://support.knowbe4.com/hc/en-us/articles/360013919314-PhishER-Settings#VT) with VirusTotal

## Proofpoint

🚀 [Follow the guide](https://ptr-docs.proofpoint.com/ptr-guides/ptr-administration/#scripted-responses) to automate your Incident Response with VirusTotal

***

# SASE / Secure DNS

## Cloudflare One

🚀 Use threat intelligence from VirusTotal to [create rules within Cloudflare products](https://blog.cloudflare.com/bring-your-own-threat-feeds-with-cloudflare-one/)

## Zscaler

🚀 [Follow these simple steps](https://help.zscaler.com/deception/deception-and-virustotal-deployment-guide) and enrich your logs

***

# Network perimeter

# Broadcom Content Analysis

📖 Supercharge malware analysis by [activating the VirusTotal service](https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/content-analysis/3-1/about_sandboxing/ma_config_vt.html)

***

# Forensics

## EnCase

🚀 Generate hash values for all tagged files and [send the hash value to VirusTotal](https://github.com/lancemueller/EnCase-EnScripts/blob/master/Check%20tagged%20files%20to%20VirusTotal_v8.EnScript) for scoring

***

# Productivity Suites

## Google Workspace Alert Center

🚀 [View VirusTotal reports](https://support.google.com/a/answer/10502377) from the alert center

📖  Check how [VirusTotal enriches your alerts](https://workspaceupdates.googleblog.com/2021/07/virustotal-alert-center-integration-generally-available.html)

ℹ️ [Gmail events are also enriched](https://workspaceupdates.googleblog.com/2021/10/virustotal-security-investigation-tool-integration.html) with VirusTotal!

***

# Reversing Tools

🚀 [VirusTotal Plugin for IDA Pro](https://github.com/VirusTotal/vt-ida-plugin)

🚀 [VirusTotal GHIDRA Plugin](https://github.com/Sentinel-One/VTgrepGHIDRA)

🚀 [VirusTotal Plugin for Binary Ninja](https://github.com/kevinmuoz/vt-binary-ninja-plugin)

***

> ❗️ Is your platform missing?
>
> This list is not exhaustive, [contact us ](https://www.virustotal.com/gui/contact-us)to see if we support it or check [VT4Browsers](https://blog.virustotal.com/2022/03/vt4browsers-any-indicator-every-detail.html), our pragmatic browser extension that will enrich every indicator displayed in any platform!