VirusTotal App

VirusTotal App for Splunk is a custom search command that enables analysts to validate the reputation of file hashes (MD5, SHA-1, SHA-256) directly from Splunk by querying VirusTotal's file report API. Ideal for threat hunting, alert enrichment, and IOC investigations, this lightweight app integrates seamlessly with Splunk Enterprise and Splunk Cloud to provide real-time access to threat intelligence without uploading files or triggering new scans. Key Features - Queries the VirusTotal file report API based on file hashes - Supports MD5, SHA-1, and SHA-256 hash formats - Shows information such as file names, extensions, categorizations, tags, detection details by antivirus engines, and much more - Support for configuring the VirusTotal API key through a user-friendly interface - Custom SPL command easy to integrate into searches - Public and private API key support - Designed to work efficiently within automated alert enrichment pipelines - Fully compatible with Splunk Enterprise and Splunk Cloud