Jump to Content
VirusTotal
HomeGuidesAPI Reference
VirusTotal
API Reference
HomeGuidesAPI Reference
All
Guides
Reference
Pages
Start typing to search…

Introduction

  • VirusTotal API v3 Overview
  • Public vs Premium API
  • Technology Integrations
  • Getting started
  • Authentication
  • API responses
    • Errors
    • Key concepts
    • Objects
    • Collections
    • Relationships
  • Legend
  • API v2 to v3 Migration Guide

IOC REPUTATION & ENRICHMENT

  • IP addresses
    • Get an IP address reportget
    • Request an IP address rescan (re-analyze)post
    • Get comments on an IP addressget
    • Add a comment to an IP addresspost
    • Get objects related to an IP addressget
    • Get object descriptors related to an IP addressget
    • Get votes on an IP addressget
    • Add a vote to an IP addresspost
  • Domains & Resolutions
    • Get a domain reportget
    • Request an domain rescan (re-analyze)post
    • Get comments on a domainget
    • Add a comment to a domainpost
    • Get objects related to a domainget
    • Get object descriptors related to a domainget
    • Get a DNS resolution objectget
    • Get votes on a domainget
    • Add a vote to a domainpost
  • Files
    • Upload a filepost
    • Get a URL for uploading large filesget
    • Get a file reportget
    • Request a file rescan (re-analyze)post
    • Get a file’s download URLget
    • Download a fileget
    • Get comments on a fileget
    • Add a comment to a filepost
    • Get objects related to a fileget
    • Get object descriptors related to a fileget
    • Get a crowdsourced Sigma rule objectget
    • Get a crowdsourced YARA rulesetget
    • Get votes on a fileget
    • Add a vote on a filepost
  • File Behaviours
    • Get a summary of all behavior reports for a fileget
    • Get a summary of all MITRE ATT&CK techniques observed in a fileget
    • Get all behavior reports for a fileget
    • Get a file behavior report from a sandboxget
    • Get objects related to a behaviour reportget
    • Get object descriptors related to a behaviour reportget
    • Get a detailed HTML behaviour reportget
    • Get the EVTX file generated during a file’s behavior analysisget
    • Get the PCAP file generated during a file’s behavior analysisget
    • Get the memdump file generated during a file’s behavior analysisget
  • URLs
    • Scan URLpost
    • Get a URL reportget
    • Request a URL rescan (re-analyze)post
    • Get comments on a URLget
    • Add a comment on a URLpost
    • Get objects related to a URLget
    • Get object descriptors related to a URLget
    • Get votes on a URLget
    • Add a vote on a URLpost
  • Comments
    • Get latest commentsget
    • Get a comment objectget
    • Delete a commentdelete
    • Get objects related to a commentget
    • Get object descriptors related to a commentget
    • Add a vote to a commentpost
  • Analyses, Submissions & Operations
    • Get a URL / file analysisget
    • Get objects related to an analysisget
    • Get object descriptors related to an analysisget
    • Get a submission objectget
    • Get an operation objectget
  • Attack Tactics
    • Get an attack tactic objectget
    • Get objects related to an attack tacticget
    • Get object descriptors related to an attack tacticget
  • Attack Techniques
    • Get an attack technique objectget
    • Get objects related to an attack techniqueget
    • Get object descriptors related to an attack techniqueget
  • Popular Threat Categories
    • Get a list of popular threat categoriesget

VT Enterprise

  • Search & Metadata
    • Search for files, URLs, domains, IPs and commentsget
    • Advanced corpus searchget
    • Get file content search snippetsget
    • Get VirusTotal metadataget
  • Collections
    • Create a new collectionpost
    • Get a collectionget
    • Update a collectionpatch
    • Delete a collectiondelete
    • Get comments on a collectionget
    • Add a comment to a collectionpost
    • Get objects related to a collectionget
    • Get object descriptors related to a collectionget
    • Add new items to a collectionpost
    • Delete items from a collectiondelete
    • πŸ”’ List collectionsget
    • πŸ”’ Export IOCs from a collectionget
    • πŸ”’ Export IOCs from a given collection's relationshipget
    • πŸ”’ Export aggregations from a collectionget
    • πŸ”’ Search IoCs inside a collectionget
  • πŸ”’ Threat Actors
    • List threat actorsget
    • Get a threat actorget
    • Get objects related to a threat actorget
    • Retrieve object descriptors related to a threat actorget
  • πŸ”’ References
    • Create a new referencepost
    • Get a referenceget
    • Delete a referencedelete
    • Get objects related to a referenceget
    • Get object descriptors related to a referenceget
  • Zipping files
    • Create a password-protected ZIP with VirusTotal filespost
    • Check a ZIP file’s statusget
    • Get a ZIP file’s download URLget
    • Download a ZIP fileget

VT Hunting

  • YARA Rules
    • List Crowdsourced YARA Rulesget
    • Get a Crowdsourced YARA ruleget
    • Get objects related to a Crowdsourced YARA ruleget
    • Get objects descriptors related to a Crowdsourced YARA ruleget
  • IoC Stream
    • Get objects from the IoC Streamget
    • Delete notifications from the IoC Streamdelete
    • Get an IoC Stream notificationget
    • Delete an IoC Stream notificationdelete
  • πŸ”’ Livehunt
    • Get Livehunt rulesetsget
    • Create a new Livehunt rulesetpost
    • Remove all Livehunt rulesetsdelete
    • Get a Livehunt rulesetget
    • Update a Livehunt rulesetpatch
    • Check if a user or group is a Livehunt ruleset editorget
    • Revoke Livehunt ruleset edit permission from a user or groupdelete
    • Delete a Livehunt rulesetdelete
    • Get objects related to a Livehunt rulesetget
    • Get object descriptors related to a Livehunt rulesetget
    • Grant Livehunt ruleset edit permissions for a user or grouppost
    • Transfer Livehunt ruleset to another userpost
    • Get Livehunt notificationsget
    • Delete Livehunt notificationsdelete
    • Get a Livehunt notification objectget
    • Delete a Livehunt notificationdelete
    • Retrieve file objects for Livehunt notificationsget
  • πŸ”’ Retrohunt
    • Get a list of Retrohunt jobsget
    • Create a new Retrohunt jobpost
    • Get a Retrohunt job objectget
    • Delete a Retrohunt jobdelete
    • Abort a Retrohunt jobpost
    • Retrieve matches for a Retrohunt jobget

VT GRAPH

  • VT Graphs
    • Search graphsget
    • Create a graphpost
    • Get a graph objectget
    • Update a graph objectpatch
    • Delete a graphdelete
    • Get comments on a graphget
    • Add a comment to a graphpost
    • Get objects related to a graphget
    • Get object descriptors related to a graphget
  • VT Graphs Permissions & ACL
    • Get users and groups that can view a graphget
    • Grant users and groups permission to see a graphpost
    • Check if a user or group can view a graphget
    • Revoke view permission from a user or groupdelete
    • Get users and groups that can edit a graphget
    • Grant users and groups permission to edit a graphpost
    • Check if a user or group can edit a graphget
    • Revoke edit graph permissions from a user or groupdelete

VT Private Scanning

  • πŸ”’ Files
    • Upload a filepost
    • List private filesget
    • Get a URL for uploading large filesget
    • Rescan a private filepost
    • Get a private file reportget
    • Delete a private file reportdelete
    • Get objects related to a private fileget
    • Get object descriptors related to a fileget
  • πŸ”’ Analyses
    • List private analysesget
    • Get a private analysisget
    • Get objects related to a private analysisget
    • Get object descriptors related to a private analysisget
  • πŸ”’ File Behaviours
    • Get a behaviour report from a private fileget
    • Get the behaviour reports from a private fileget
    • Get objects related to a private file's behaviour reportget
    • Get object descriptors related to a private file's behaviour reportget
    • Get a summary of all behavior reports for a fileget
    • Get a summary of all MITRE ATT&CK techniques observed in a fileget
    • Get a detailed HTML behaviour reportget
    • Get the EVTX file generated during a private file’s behavior analysisget
    • Get the PCAP file generated during a private file’s behavior analysisget
    • Get the memdump file generated during a private file’s behavior analysisget
  • πŸ”’ URLs
    • Private Scan URLpost
    • Get a URL analysis reportget
    • Get objects related to a private URLget
    • Get object descriptors related to a private URLget
  • Zipping private files
    • Create a password-protected ZIP with VirusTotal private filespost
    • Check a ZIP file’s statusget
    • Get a ZIP file’s download URLget
    • Download a ZIP fileget

VT FeedS

  • πŸ”’ File intelligence feed
    • Get a per-minute file feed batchget
    • Get a hourly file feed batchget
    • Download a file published in the file feedget
  • πŸ”’ Sandbox analyses feed
    • Get a per-minute file behaviour feed batchget
    • Get an hourly file behaviour feed batchget
    • Get the EVTX file generated during a file’s behavior analysisget
    • Get the memdump file generated during a file’s behavior analysisget
    • Get the PCAP file generated during a file’s behavior analysisget
    • Get a file behaviour's detailed HTML reportget
  • πŸ”’ Domain intelligence feed
    • Get a minutely domain feed batchget
    • Get an hourly domain feed batchget
  • πŸ”’ IP intelligence feed
    • Get a minutely IP address feed batchget
    • Get an hourly IP address feed batchget
  • πŸ”’ URL intelligence feed
    • Get a minutely URL feed batchget
    • Get an hourly URL feed batchget

VT ENTERPRISE ADMINISTRATION

  • User management
    • Get a user objectget
    • Update a user objectpatch
    • Delete a userdelete
    • Get objects related to a userget
    • Get object descriptors related to a userget
  • Group management
    • Get a group objectget
    • Update a group objectpatch
    • Get administrators for a groupget
    • Grant group admin permissions to a list of userspost
    • Check if a user is a group adminget
    • Revoke group admin permissions from a userdelete
    • Get group usersget
    • Check if a user is a group memberget
    • Remove a user from a groupdelete
    • Add users to a grouppost
    • Get objects related to a groupget
    • Get object descriptors related to a groupget
  • Quota management
    • Get a user’s API usageget
    • Get a user’s quota summaryget
    • Get a group’s API usageget
  • Service Account Management
    • Create a new Service Accountpost
    • Get Service Accounts of a groupget
    • Get a Service Account objectget

VT Augment

  • Overview
  • Rendering
    • Get a widget rendering URLget
    • Retrieve the widget's HTML contentget
  • Theming

API Objects

  • Analyses
    • πŸ”€ item
  • Attack Tactics
    • πŸ”€ attack_techniques
  • Attack Techniques
    • πŸ”€ attack_tactics
    • πŸ”€ parent_technique
    • πŸ”€ revoking_technique
    • πŸ”€ subtechniques
    • πŸ”€πŸ”’ threat_actors
  • Collections
    • πŸ”€ autogenerated_graphs
    • πŸ”€ comments
    • πŸ”€ domains
    • πŸ”€ files
    • πŸ”€ ip_addresses
    • πŸ”€ owner
    • πŸ”€ references
    • πŸ”€πŸ”’ related_collections
    • πŸ”€πŸ”’ related_references
    • πŸ”€πŸ”’ threat_actors
    • πŸ”€ urls
  • Comments
    • πŸ”€ author
  • Domains
    • πŸ”€πŸ”’ caa_records
    • πŸ”€πŸ”’ cname_records
    • πŸ”€ collections
    • πŸ”€ comments
    • πŸ”€ communicating_files
    • πŸ”€πŸ”’ downloaded_files
    • πŸ”€ graphs
    • πŸ”€ historical_ssl_certificates
    • πŸ”€ historical_whois
    • πŸ”€ immediate_parent
    • πŸ”€πŸ”’ mx_records
    • πŸ”€πŸ”’ ns_records
    • πŸ”€ parent
    • πŸ”€ referrer_files
    • πŸ”€ related_comments
    • πŸ”€πŸ”’ related_references
    • πŸ”€πŸ”’ related_threat_actors
    • πŸ”€ resolutions
    • πŸ”€ siblings
    • πŸ”€πŸ”’ soa_records
    • πŸ”€ subdomains
    • πŸ”€πŸ”’ urls
    • πŸ”€πŸ§‘β€πŸ’» user_votes
    • πŸ”€ votes
  • Files
    • androguard
    • asf_info
    • authentihash
    • bundle_info
    • class_info
    • crowdsourced_ids_results
    • crowdsourced_ids_stats
    • crowdsourced_yara_results
    • deb_info
    • detectiteasy
    • dmg_info
    • dot_net_assembly
    • dot_net_guids
    • elf_info
    • πŸ”’ exiftool
    • html_info
    • image_code_injections
    • ipa_info
    • isoimage_info
    • jar_info
    • javascript_info
    • known_distributors
    • lnk_info
    • macho_info
    • magic
    • πŸ”’ malware_config
    • monitor_info
    • nsrl_info
    • πŸ”’ office_info
    • πŸ”’ openxml_info
    • packers
    • password_info
    • pdf_info
    • pe_info
    • popular_threat_classification
    • powershell_info
    • rombios_info
    • πŸ”’ rtf_info
    • sandbox_verdicts
    • sigma_analysis_results
    • sigma_analysis_stats
    • signature_info
    • snort
    • suricata
    • ssdeep
    • swf_info
    • telfhash
    • tlsh
    • traffic_inspection
    • trid
    • vba_info
    • wireshark
    • πŸ”€πŸ”’ analyses
    • πŸ”€ behaviours
    • πŸ”€ bundled_files
    • πŸ”€πŸ”’ carbonblack_children
    • πŸ”€πŸ”’ carbonblack_parents
    • πŸ”€ collections
    • πŸ”€ comments
    • πŸ”€πŸ”’ compressed_parents
    • πŸ”€ contacted_domains
    • πŸ”€ contacted_ips
    • πŸ”€ contacted_urls
    • πŸ”€ dropped_files
    • πŸ”€πŸ”’ email_attachments
    • πŸ”€πŸ”’ email_parents
    • πŸ”€πŸ”’ embedded_domains
    • πŸ”€πŸ”’ embedded_ips
    • πŸ”€πŸ”’ embedded_urls
    • πŸ”€ execution_parents
    • πŸ”€ graphs
    • πŸ”€πŸ”’ itw_domains
    • πŸ”€πŸ”’ itw_ips
    • πŸ”€πŸ”’ itw_urls
    • πŸ”€πŸ”’ overlay_children
    • πŸ”€πŸ”’ overlay_parents
    • πŸ”€πŸ”’ pcap_children
    • πŸ”€πŸ”’ pcap_parents
    • πŸ”€ pe_resource_children
    • πŸ”€ pe_resource_parents
    • πŸ”€πŸ”’ related_references
    • πŸ”€πŸ”’ related_threat_actors
    • πŸ”€πŸ”’ screenshots
    • πŸ”€ sigma_analysis
    • πŸ”€πŸ”’ similar_files
    • πŸ”€πŸ”’ submissions
    • πŸ”€πŸ”’ urls_for_embedded_js
    • πŸ”€πŸ§‘β€πŸ’» user_votes
    • πŸ”€ votes
    • πŸ”€ memory_pattern_domains
    • πŸ”€ memory_pattern_ips
    • πŸ”€ memory_pattern_urls
  • Files Behaviour
    • dns_lookups
    • files_copied
    • files_dropped
    • http_conversations
    • ip_traffic
    • permissions_checked
    • processes_tree
    • sms_sent
    • tags
    • verdicts
    • πŸ”€ file
    • πŸ”€ attack_techniques
  • Graphs
    • πŸ”€ comments
    • πŸ”€ editors
    • πŸ”€ group
    • πŸ”€ items
    • πŸ”€ owner
    • πŸ”€ viewers
  • Groups
    • πŸ”€πŸ§‘β€πŸ’» administrators
    • πŸ”€πŸ§‘β€πŸ’» graphs
    • πŸ”€πŸ§‘β€πŸ’» users
  • Hunting Notifications
  • Hunting Rulesets
    • πŸ”€ πŸ§‘β€πŸ’»owner
    • πŸ”€πŸ§‘β€πŸ’» editors
    • πŸ”€πŸ§‘β€πŸ’» viewers
    • πŸ”€πŸ§‘β€πŸ’» hunting_notification_files
  • IoC-Stream Notifications
  • IP addresses
    • πŸ”€ collections
    • πŸ”€ comments
    • πŸ”€ communicating_files
    • πŸ”€πŸ”’ downloaded_files
    • πŸ”€ graphs
    • πŸ”€ historical_ssl_certificates
    • πŸ”€ historical_whois
    • πŸ”€ related_comments
    • πŸ”€πŸ”’ related_references
    • πŸ”€πŸ”’ related_threat_actors
    • πŸ”€ referrer_files
    • πŸ”€ resolutions
    • πŸ”€πŸ”’ urls
    • πŸ”€πŸ§‘β€πŸ’» user_votes
    • πŸ”€ votes
  • Operations
  • πŸ”’ Private Analyses
    • πŸ”€ item
    • πŸ”€ submitter
  • πŸ”’ Private Files
    • πŸ”€ behaviours
    • πŸ”€ dropped_files
    • πŸ”€ execution_parents
    • πŸ”€ embedded_urls
    • πŸ”€ embedded_domains
    • πŸ”€ embedded_ips
  • πŸ”’ Private Files Behaviours
    • πŸ”€ attack_techniques
    • πŸ”€ file
  • πŸ”’ Private URLs
  • πŸ”’ Private URLs Behaviours
  • πŸ”’ References
    • πŸ”€ collections
    • πŸ”€πŸ”’ threat_actors
  • Resolutions
  • Retrohunt Jobs
    • πŸ”€πŸ§‘β€πŸ’» matching_files
    • πŸ”€πŸ§‘β€πŸ’» owner
  • Screenshots
  • Sigma Analyses
    • πŸ”€ rules
  • Sigma Rules
  • SSL Certificate
  • Submissions
  • πŸ”’ Threat Actors
    • πŸ”€ collections
    • πŸ”€ comments
    • πŸ”€ references
    • πŸ”€ related_domains
    • πŸ”€ related_files
    • πŸ”€ related_ip_addresses
    • πŸ”€ related_references
    • πŸ”€ related_urls
  • URLs
    • πŸ”€πŸ”’ analyses
    • πŸ”€ collections
    • πŸ”€ comments
    • πŸ”€πŸ”’ communicating_files
    • πŸ”€πŸ”’ contacted_domains
    • πŸ”€πŸ”’ contacted_ips
    • πŸ”€πŸ”’ downloaded_files
    • πŸ”€πŸ”’ embedded_js_files
    • πŸ”€ graphs
    • πŸ”€ last_serving_ip_address
    • πŸ”€ network_location
    • πŸ”€πŸ”’ redirecting_urls
    • πŸ”€πŸ”’ redirects_to
    • πŸ”€πŸ”’ referrer_files
    • πŸ”€πŸ”’ referrer_urls
    • πŸ”€ related_comments
    • πŸ”€πŸ”’ related_references
    • πŸ”€πŸ”’ related_threat_actors
    • πŸ”€πŸ”’ submissions
    • πŸ”€πŸ§‘β€πŸ’» user_votes
    • πŸ”€ votes
    • πŸ”€πŸ”’ urls_related_by_tracker_id
  • Users
    • πŸ”€πŸ§‘β€πŸ’» api_quota_group
    • πŸ”€ collections
    • πŸ”€ comments
    • πŸ”€ graphs
    • πŸ”€πŸ§‘β€πŸ’» groups
    • πŸ”€πŸ§‘β€πŸ’» hunting_rulesets
    • πŸ”€πŸ§‘β€πŸ’» hunting_notifications
    • πŸ”€πŸ§‘β€πŸ’» hunting_notification_files
    • πŸ”€πŸ§‘β€πŸ’» intelligence_quota_group
    • πŸ”€ mentions
    • πŸ”€πŸ§‘β€πŸ’» retrohunt_jobs
    • πŸ”€ votes
  • Service Accounts
    • πŸ”€πŸ§‘β€πŸ’» api_quota_group
    • πŸ”€ comments
    • πŸ”€πŸ§‘β€πŸ’» groups
    • πŸ”€πŸ§‘β€πŸ’» intelligence_quota_group
    • πŸ”€ mentions
  • Votes
  • Whois
  • YARA Rules
  • YARA Rulesets

VT Monitor

  • Software Publishers
    • Monitor Items
    • Get a list of MonitorItem objects by path or tagget
    • Upload a file or create a new folderpost
    • Get a URL for uploading files larger than 32MBget
    • Get attributes and metadata for a specific MonitorItemget
    • Delete a VirusTotal Monitor file or folderdelete
    • Configure a given VirusTotal Monitor item (file or folder)patch
    • Download a file in VirusTotal Monitorget
    • Get a URL for downloading a file in VirusTotal Monitorget
    • Get the latest file analysesget
    • Get user owning the MonitorItem objectget
    • Retrieve partner's comments on a fileget
    • Retrieve statistics about analyses performed on your software collectionget
    • Retrieve historical events about your software collectionget
  • Antivirus Partners
    • Get a list of MonitorHashes detected by an engineget
    • Get a list of analyses for a fileget
    • Get a list of items with a given sha256 hashget
    • Create a comment over a hashpost
    • Get comments on a sha256 hashget
    • Add a comment on a sha256 hashpatch
    • Remove a comment detection for a hash.delete
    • Download a file with a given sha256 hashget
    • Retrieve a download url for a file with a given sha256 hashget
    • Download a daily detection bundle directlyget
    • Get a daily detection bundle download URLget
    • Get a list of MonitorHashes detected by an engineget

Zipping private files

Sometimes you may want to download files in bulk in a password-protected ZIP file. This is specially useful in corporate environments where a gateway antivirus may be blocking your downloads because they contain malware (as expected from files downloaded from VirusTotal)

Updated 8 months ago


Get object descriptors related to a private URL
Create a password-protected ZIP with VirusTotal private files

Updated 8 months ago


Get object descriptors related to a private URL
Create a password-protected ZIP with VirusTotal private files
  1. Introduction
  2. VirusTotal API v3 Overview
  3. Public vs Premium API
  4. Getting started
  5. Authentication
  6. API responses
  7. Relationships
  8. Collections
  9. Objects
  10. Key concepts
  11. Errors
  12. Legend
  13. API v2 to v3 Migration Guide
  1. IOC REPUTATION & ENRICHMENT
  2. IP addresses
  3. Add a vote to an IP addresspost
  4. Get votes on an IP addressget
  5. Get object descriptors related to an IP addressget
  6. Get objects related to an IP addressget
  7. Add a comment to an IP addresspost
  8. Get comments on an IP addressget
  9. Request an IP address rescan (re-analyze)post
  10. Get an IP address reportget
  11. Domains & Resolutions
  12. Add a vote to a domainpost
  13. Get votes on a domainget
  14. Get a DNS resolution objectget
  15. Get object descriptors related to a domainget
  16. Get objects related to a domainget
  17. Add a comment to a domainpost
  18. Get comments on a domainget
  19. Request an domain rescan (re-analyze)post
  20. Get a domain reportget
  21. Files
  22. Add a vote on a filepost
  23. Get votes on a fileget
  24. Get a crowdsourced YARA rulesetget
  25. Get a crowdsourced Sigma rule objectget
  26. Get object descriptors related to a fileget
  27. Get objects related to a fileget
  28. Add a comment to a filepost
  29. Get comments on a fileget
  30. Download a fileget
  31. Get a file’s download URLget
  32. Request a file rescan (re-analyze)post
  33. Get a file reportget
  34. Get a URL for uploading large filesget
  35. Upload a filepost
  36. File Behaviours
  37. Get the memdump file generated during a file’s behavior analysisget
  38. Get the PCAP file generated during a file’s behavior analysisget
  39. Get the EVTX file generated during a file’s behavior analysisget
  40. Get a detailed HTML behaviour reportget
  41. Get object descriptors related to a behaviour reportget
  42. Get objects related to a behaviour reportget
  43. Get a file behavior report from a sandboxget
  44. Get all behavior reports for a fileget
  45. Get a summary of all MITRE ATT&CK techniques observed in a fileget
  46. Get a summary of all behavior reports for a fileget
  47. URLs
  48. Add a vote on a URLpost
  49. Get votes on a URLget
  50. Get object descriptors related to a URLget
  51. Get objects related to a URLget
  52. Add a comment on a URLpost
  53. Get comments on a URLget
  54. Request a URL rescan (re-analyze)post
  55. Get a URL reportget
  56. Scan URLpost
  57. Comments
  58. Add a vote to a commentpost
  59. Get object descriptors related to a commentget
  60. Get objects related to a commentget
  61. Delete a commentdelete
  62. Get a comment objectget
  63. Get latest commentsget
  64. Analyses, Submissions & Operations
  65. Get an operation objectget
  66. Get a submission objectget
  67. Get object descriptors related to an analysisget
  68. Get objects related to an analysisget
  69. Get a URL / file analysisget
  70. Attack Tactics
  71. Get object descriptors related to an attack tacticget
  72. Get objects related to an attack tacticget
  73. Get an attack tactic objectget
  74. Attack Techniques
  75. Get object descriptors related to an attack techniqueget
  76. Get objects related to an attack techniqueget
  77. Get an attack technique objectget
  78. Popular Threat Categories
  79. Get a list of popular threat categoriesget
  1. VT Enterprise
  2. Search & Metadata
  3. Get VirusTotal metadataget
  4. Get file content search snippetsget
  5. Advanced corpus searchget
  6. Search for files, URLs, domains, IPs and commentsget
  7. Collections
  8. πŸ”’ Search IoCs inside a collectionget
  9. πŸ”’ Export aggregations from a collectionget
  10. πŸ”’ Export IOCs from a given collection's relationshipget
  11. πŸ”’ Export IOCs from a collectionget
  12. πŸ”’ List collectionsget
  13. Delete items from a collectiondelete
  14. Add new items to a collectionpost
  15. Get object descriptors related to a collectionget
  16. Get objects related to a collectionget
  17. Add a comment to a collectionpost
  18. Get comments on a collectionget
  19. Delete a collectiondelete
  20. Update a collectionpatch
  21. Get a collectionget
  22. Create a new collectionpost
  23. πŸ”’ Threat Actors
  24. Retrieve object descriptors related to a threat actorget
  25. Get objects related to a threat actorget
  26. Get a threat actorget
  27. List threat actorsget
  28. πŸ”’ References
  29. Get object descriptors related to a referenceget
  30. Get objects related to a referenceget
  31. Delete a referencedelete
  32. Get a referenceget
  33. Create a new referencepost
  34. Zipping files
  35. Download a ZIP fileget
  36. Get a ZIP file’s download URLget
  37. Check a ZIP file’s statusget
  38. Create a password-protected ZIP with VirusTotal filespost
  1. VT Hunting
  2. YARA Rules
  3. Get objects descriptors related to a Crowdsourced YARA ruleget
  4. Get objects related to a Crowdsourced YARA ruleget
  5. Get a Crowdsourced YARA ruleget
  6. List Crowdsourced YARA Rulesget
  7. IoC Stream
  8. Delete an IoC Stream notificationdelete
  9. Get an IoC Stream notificationget
  10. Delete notifications from the IoC Streamdelete
  11. Get objects from the IoC Streamget
  12. πŸ”’ Livehunt
  13. Retrieve file objects for Livehunt notificationsget
  14. Delete a Livehunt notificationdelete
  15. Get a Livehunt notification objectget
  16. Delete Livehunt notificationsdelete
  17. Get Livehunt notificationsget
  18. Transfer Livehunt ruleset to another userpost
  19. Grant Livehunt ruleset edit permissions for a user or grouppost
  20. Get object descriptors related to a Livehunt rulesetget
  21. Get objects related to a Livehunt rulesetget
  22. Delete a Livehunt rulesetdelete
  23. Revoke Livehunt ruleset edit permission from a user or groupdelete
  24. Check if a user or group is a Livehunt ruleset editorget
  25. Update a Livehunt rulesetpatch
  26. Get a Livehunt rulesetget
  27. Remove all Livehunt rulesetsdelete
  28. Create a new Livehunt rulesetpost
  29. Get Livehunt rulesetsget
  30. πŸ”’ Retrohunt
  31. Retrieve matches for a Retrohunt jobget
  32. Abort a Retrohunt jobpost
  33. Delete a Retrohunt jobdelete
  34. Get a Retrohunt job objectget
  35. Create a new Retrohunt jobpost
  36. Get a list of Retrohunt jobsget
  1. VT GRAPH
  2. VT Graphs
  3. Get object descriptors related to a graphget
  4. Get objects related to a graphget
  5. Add a comment to a graphpost
  6. Get comments on a graphget
  7. Delete a graphdelete
  8. Update a graph objectpatch
  9. Get a graph objectget
  10. Create a graphpost
  11. Search graphsget
  12. VT Graphs Permissions & ACL
  13. Revoke edit graph permissions from a user or groupdelete
  14. Check if a user or group can edit a graphget
  15. Grant users and groups permission to edit a graphpost
  16. Get users and groups that can edit a graphget
  17. Revoke view permission from a user or groupdelete
  18. Check if a user or group can view a graphget
  19. Grant users and groups permission to see a graphpost
  20. Get users and groups that can view a graphget
  1. VT Private Scanning
  2. πŸ”’ Files
  3. Get object descriptors related to a fileget
  4. Get objects related to a private fileget
  5. Delete a private file reportdelete
  6. Get a private file reportget
  7. Rescan a private filepost
  8. Get a URL for uploading large filesget
  9. List private filesget
  10. Upload a filepost
  11. πŸ”’ Analyses
  12. Get object descriptors related to a private analysisget
  13. Get objects related to a private analysisget
  14. Get a private analysisget
  15. List private analysesget
  16. πŸ”’ File Behaviours
  17. Get the memdump file generated during a private file’s behavior analysisget
  18. Get the PCAP file generated during a private file’s behavior analysisget
  19. Get the EVTX file generated during a private file’s behavior analysisget
  20. Get a detailed HTML behaviour reportget
  21. Get a summary of all MITRE ATT&CK techniques observed in a fileget
  22. Get a summary of all behavior reports for a fileget
  23. Get object descriptors related to a private file's behaviour reportget
  24. Get objects related to a private file's behaviour reportget
  25. Get the behaviour reports from a private fileget
  26. Get a behaviour report from a private fileget
  27. πŸ”’ URLs
  28. Get object descriptors related to a private URLget
  29. Get objects related to a private URLget
  30. Get a URL analysis reportget
  31. Private Scan URLpost
  32. Zipping private files
  33. Download a ZIP fileget
  34. Get a ZIP file’s download URLget
  35. Check a ZIP file’s statusget
  36. Create a password-protected ZIP with VirusTotal private filespost
  1. VT FeedS
  2. πŸ”’ File intelligence feed
  3. Download a file published in the file feedget
  4. Get a hourly file feed batchget
  5. Get a per-minute file feed batchget
  6. πŸ”’ Sandbox analyses feed
  7. Get a file behaviour's detailed HTML reportget
  8. Get the PCAP file generated during a file’s behavior analysisget
  9. Get the memdump file generated during a file’s behavior analysisget
  10. Get the EVTX file generated during a file’s behavior analysisget
  11. Get an hourly file behaviour feed batchget
  12. Get a per-minute file behaviour feed batchget
  13. πŸ”’ Domain intelligence feed
  14. Get an hourly domain feed batchget
  15. Get a minutely domain feed batchget
  16. πŸ”’ IP intelligence feed
  17. Get an hourly IP address feed batchget
  18. Get a minutely IP address feed batchget
  19. πŸ”’ URL intelligence feed
  20. Get an hourly URL feed batchget
  21. Get a minutely URL feed batchget
  1. VT ENTERPRISE ADMINISTRATION
  2. User management
  3. Get object descriptors related to a userget
  4. Get objects related to a userget
  5. Delete a userdelete
  6. Update a user objectpatch
  7. Get a user objectget
  8. Group management
  9. Get object descriptors related to a groupget
  10. Get objects related to a groupget
  11. Add users to a grouppost
  12. Remove a user from a groupdelete
  13. Check if a user is a group memberget
  14. Get group usersget
  15. Revoke group admin permissions from a userdelete
  16. Check if a user is a group adminget
  17. Grant group admin permissions to a list of userspost
  18. Get administrators for a groupget
  19. Update a group objectpatch
  20. Get a group objectget
  21. Quota management
  22. Get a group’s API usageget
  23. Get a user’s quota summaryget
  24. Get a user’s API usageget
  25. Service Account Management
  26. Get a Service Account objectget
  27. Get Service Accounts of a groupget
  28. Create a new Service Accountpost
  1. VT Augment
  2. Overview
  3. Rendering
  4. Retrieve the widget's HTML contentget
  5. Get a widget rendering URLget
  6. Theming
  1. API Objects
  2. Analyses
  3. πŸ”€ item
  4. Attack Tactics
  5. πŸ”€ attack_techniques
  6. Attack Techniques
  7. πŸ”€πŸ”’ threat_actors
  8. πŸ”€ subtechniques
  9. πŸ”€ revoking_technique
  10. πŸ”€ parent_technique
  11. πŸ”€ attack_tactics
  12. Collections
  13. πŸ”€ urls
  14. πŸ”€πŸ”’ threat_actors
  15. πŸ”€πŸ”’ related_references
  16. πŸ”€πŸ”’ related_collections
  17. πŸ”€ references
  18. πŸ”€ owner
  19. πŸ”€ ip_addresses
  20. πŸ”€ files
  21. πŸ”€ domains
  22. πŸ”€ comments
  23. πŸ”€ autogenerated_graphs
  24. Comments
  25. πŸ”€ author
  26. Domains
  27. πŸ”€ votes
  28. πŸ”€πŸ§‘β€πŸ’» user_votes
  29. πŸ”€πŸ”’ urls
  30. πŸ”€ subdomains
  31. πŸ”€πŸ”’ soa_records
  32. πŸ”€ siblings
  33. πŸ”€ resolutions
  34. πŸ”€πŸ”’ related_threat_actors
  35. πŸ”€πŸ”’ related_references
  36. πŸ”€ related_comments
  37. πŸ”€ referrer_files
  38. πŸ”€ parent
  39. πŸ”€πŸ”’ ns_records
  40. πŸ”€πŸ”’ mx_records
  41. πŸ”€ immediate_parent
  42. πŸ”€ historical_whois
  43. πŸ”€ historical_ssl_certificates
  44. πŸ”€ graphs
  45. πŸ”€πŸ”’ downloaded_files
  46. πŸ”€ communicating_files
  47. πŸ”€ comments
  48. πŸ”€ collections
  49. πŸ”€πŸ”’ cname_records
  50. πŸ”€πŸ”’ caa_records
  51. Files
  52. πŸ”€ memory_pattern_urls
  53. πŸ”€ memory_pattern_ips
  54. πŸ”€ memory_pattern_domains
  55. πŸ”€ votes
  56. πŸ”€πŸ§‘β€πŸ’» user_votes
  57. πŸ”€πŸ”’ urls_for_embedded_js
  58. πŸ”€πŸ”’ submissions
  59. πŸ”€πŸ”’ similar_files
  60. πŸ”€ sigma_analysis
  61. πŸ”€πŸ”’ screenshots
  62. πŸ”€πŸ”’ related_threat_actors
  63. πŸ”€πŸ”’ related_references
  64. πŸ”€ pe_resource_parents
  65. πŸ”€ pe_resource_children
  66. πŸ”€πŸ”’ pcap_parents
  67. πŸ”€πŸ”’ pcap_children
  68. πŸ”€πŸ”’ overlay_parents
  69. πŸ”€πŸ”’ overlay_children
  70. πŸ”€πŸ”’ itw_urls
  71. πŸ”€πŸ”’ itw_ips
  72. πŸ”€πŸ”’ itw_domains
  73. πŸ”€ graphs
  74. πŸ”€ execution_parents
  75. πŸ”€πŸ”’ embedded_urls
  76. πŸ”€πŸ”’ embedded_ips
  77. πŸ”€πŸ”’ embedded_domains
  78. πŸ”€πŸ”’ email_parents
  79. πŸ”€πŸ”’ email_attachments
  80. πŸ”€ dropped_files
  81. πŸ”€ contacted_urls
  82. πŸ”€ contacted_ips
  83. πŸ”€ contacted_domains
  84. πŸ”€πŸ”’ compressed_parents
  85. πŸ”€ comments
  86. πŸ”€ collections
  87. πŸ”€πŸ”’ carbonblack_parents
  88. πŸ”€πŸ”’ carbonblack_children
  89. πŸ”€ bundled_files
  90. πŸ”€ behaviours
  91. πŸ”€πŸ”’ analyses
  92. wireshark
  93. vba_info
  94. trid
  95. traffic_inspection
  96. tlsh
  97. telfhash
  98. swf_info
  99. ssdeep
  100. suricata
  101. snort
  102. signature_info
  103. sigma_analysis_stats
  104. sigma_analysis_results
  105. sandbox_verdicts
  106. πŸ”’ rtf_info
  107. rombios_info
  108. powershell_info
  109. popular_threat_classification
  110. pe_info
  111. pdf_info
  112. password_info
  113. packers
  114. πŸ”’ openxml_info
  115. πŸ”’ office_info
  116. nsrl_info
  117. monitor_info
  118. πŸ”’ malware_config
  119. magic
  120. macho_info
  121. lnk_info
  122. known_distributors
  123. javascript_info
  124. jar_info
  125. isoimage_info
  126. ipa_info
  127. image_code_injections
  128. html_info
  129. πŸ”’ exiftool
  130. elf_info
  131. dot_net_guids
  132. dot_net_assembly
  133. dmg_info
  134. detectiteasy
  135. deb_info
  136. crowdsourced_yara_results
  137. crowdsourced_ids_stats
  138. crowdsourced_ids_results
  139. class_info
  140. bundle_info
  141. authentihash
  142. asf_info
  143. androguard
  144. Files Behaviour
  145. πŸ”€ attack_techniques
  146. πŸ”€ file
  147. verdicts
  148. tags
  149. sms_sent
  150. processes_tree
  151. permissions_checked
  152. ip_traffic
  153. http_conversations
  154. files_dropped
  155. files_copied
  156. dns_lookups
  157. Graphs
  158. πŸ”€ viewers
  159. πŸ”€ owner
  160. πŸ”€ items
  161. πŸ”€ group
  162. πŸ”€ editors
  163. πŸ”€ comments
  164. Groups
  165. πŸ”€πŸ§‘β€πŸ’» users
  166. πŸ”€πŸ§‘β€πŸ’» graphs
  167. πŸ”€πŸ§‘β€πŸ’» administrators
  168. Hunting Notifications
  169. Hunting Rulesets
  170. πŸ”€πŸ§‘β€πŸ’» hunting_notification_files
  171. πŸ”€πŸ§‘β€πŸ’» viewers
  172. πŸ”€πŸ§‘β€πŸ’» editors
  173. πŸ”€ πŸ§‘β€πŸ’»owner
  174. IoC-Stream Notifications
  175. IP addresses
  176. πŸ”€ votes
  177. πŸ”€πŸ§‘β€πŸ’» user_votes
  178. πŸ”€πŸ”’ urls
  179. πŸ”€ resolutions
  180. πŸ”€ referrer_files
  181. πŸ”€πŸ”’ related_threat_actors
  182. πŸ”€πŸ”’ related_references
  183. πŸ”€ related_comments
  184. πŸ”€ historical_whois
  185. πŸ”€ historical_ssl_certificates
  186. πŸ”€ graphs
  187. πŸ”€πŸ”’ downloaded_files
  188. πŸ”€ communicating_files
  189. πŸ”€ comments
  190. πŸ”€ collections
  191. Operations
  192. πŸ”’ Private Analyses
  193. πŸ”€ submitter
  194. πŸ”€ item
  195. πŸ”’ Private Files
  196. πŸ”€ embedded_ips
  197. πŸ”€ embedded_domains
  198. πŸ”€ embedded_urls
  199. πŸ”€ execution_parents
  200. πŸ”€ dropped_files
  201. πŸ”€ behaviours
  202. πŸ”’ Private Files Behaviours
  203. πŸ”€ file
  204. πŸ”€ attack_techniques
  205. πŸ”’ Private URLs
  206. πŸ”’ Private URLs Behaviours
  207. πŸ”’ References
  208. πŸ”€πŸ”’ threat_actors
  209. πŸ”€ collections
  210. Resolutions
  211. Retrohunt Jobs
  212. πŸ”€πŸ§‘β€πŸ’» owner
  213. πŸ”€πŸ§‘β€πŸ’» matching_files
  214. Screenshots
  215. Sigma Analyses
  216. πŸ”€ rules
  217. Sigma Rules
  218. SSL Certificate
  219. Submissions
  220. πŸ”’ Threat Actors
  221. πŸ”€ related_urls
  222. πŸ”€ related_references
  223. πŸ”€ related_ip_addresses
  224. πŸ”€ related_files
  225. πŸ”€ related_domains
  226. πŸ”€ references
  227. πŸ”€ comments
  228. πŸ”€ collections
  229. URLs
  230. πŸ”€πŸ”’ urls_related_by_tracker_id
  231. πŸ”€ votes
  232. πŸ”€πŸ§‘β€πŸ’» user_votes
  233. πŸ”€πŸ”’ submissions
  234. πŸ”€πŸ”’ related_threat_actors
  235. πŸ”€πŸ”’ related_references
  236. πŸ”€ related_comments
  237. πŸ”€πŸ”’ referrer_urls
  238. πŸ”€πŸ”’ referrer_files
  239. πŸ”€πŸ”’ redirects_to
  240. πŸ”€πŸ”’ redirecting_urls
  241. πŸ”€ network_location
  242. πŸ”€ last_serving_ip_address
  243. πŸ”€ graphs
  244. πŸ”€πŸ”’ embedded_js_files
  245. πŸ”€πŸ”’ downloaded_files
  246. πŸ”€πŸ”’ contacted_ips
  247. πŸ”€πŸ”’ contacted_domains
  248. πŸ”€πŸ”’ communicating_files
  249. πŸ”€ comments
  250. πŸ”€ collections
  251. πŸ”€πŸ”’ analyses
  252. Users
  253. πŸ”€ votes
  254. πŸ”€πŸ§‘β€πŸ’» retrohunt_jobs
  255. πŸ”€ mentions
  256. πŸ”€πŸ§‘β€πŸ’» intelligence_quota_group
  257. πŸ”€πŸ§‘β€πŸ’» hunting_notification_files
  258. πŸ”€πŸ§‘β€πŸ’» hunting_notifications
  259. πŸ”€πŸ§‘β€πŸ’» hunting_rulesets
  260. πŸ”€πŸ§‘β€πŸ’» groups
  261. πŸ”€ graphs
  262. πŸ”€ comments
  263. πŸ”€ collections
  264. πŸ”€πŸ§‘β€πŸ’» api_quota_group
  265. Service Accounts
  266. πŸ”€ mentions
  267. πŸ”€πŸ§‘β€πŸ’» intelligence_quota_group
  268. πŸ”€πŸ§‘β€πŸ’» groups
  269. πŸ”€ comments
  270. πŸ”€πŸ§‘β€πŸ’» api_quota_group
  271. Votes
  272. Whois
  273. YARA Rules
  274. YARA Rulesets
  1. VT Monitor
  2. Software Publishers
  3. Retrieve historical events about your software collectionget
  4. Retrieve statistics about analyses performed on your software collectionget
  5. Retrieve partner's comments on a fileget
  6. Get user owning the MonitorItem objectget
  7. Get the latest file analysesget
  8. Get a URL for downloading a file in VirusTotal Monitorget
  9. Download a file in VirusTotal Monitorget
  10. Configure a given VirusTotal Monitor item (file or folder)patch
  11. Delete a VirusTotal Monitor file or folderdelete
  12. Get attributes and metadata for a specific MonitorItemget
  13. Get a URL for uploading files larger than 32MBget
  14. Upload a file or create a new folderpost
  15. Get a list of MonitorItem objects by path or tagget
  16. Monitor Items
  17. Antivirus Partners
  18. Get a list of MonitorHashes detected by an engineget
  19. Get a daily detection bundle download URLget
  20. Download a daily detection bundle directlyget
  21. Retrieve a download url for a file with a given sha256 hashget
  22. Download a file with a given sha256 hashget
  23. Remove a comment detection for a hash.delete
  24. Add a comment on a sha256 hashpatch
  25. Get comments on a sha256 hashget
  26. Create a comment over a hashpost
  27. Get a list of items with a given sha256 hashget
  28. Get a list of analyses for a fileget
  29. Get a list of MonitorHashes detected by an engineget