The VirusTotal Action submits a collection of FQDN and supported objects to the VirusTotal API in individual HTTP Requests. VirusTotal returns a response for each object containing any information it has about the indicator.
The action can perform the following functions:

The action is compatible with the following indicator types:

The action returns the following enriched indicator objects:

Note:  This action is intended for use with ThreatQ TDR Orchestrator (TQO). An active TQO license is required for this feature.