VirusTotal Premium v1.1.2

About the connector

VirusTotal Premium Services are used to obtain additional threat context and expose advanced threat hunting and malware discovery endpoints and functionality.

This document provides information about the VirusTotal Premium Connector, which facilitates automated interactions, with a VirusTotal Premium server using FortiSOAR™ playbooks. Add the VirusTotal Premium connector as a step in FortiSOAR™ playbooks and perform automated operations such as searching for files in VirusTotal Premium, retrieving information for specific ZIP files from VirusTotal Premium, downloading VirustTotal report for a specified file from VirusTotal Premium, etc.

The VirusTotal Premium playbook collection contains pluggable enrichment playbooks that are used to provide verdicts for indicator types IP Address, File Hash, URL, and Domain. For more information, see Pluggable Enrichment.

Version information

Connector Version: 1.1.2

FortiSOAR™ Version Tested on: 7.4.1-3167

VirusTotal Premium Version Tested on: 3.0

Authored By: Fortinet

Certified: Yes

Release Notes for version 1.1.2

The following enhancements have been made to the VirusTotal Premium Connector in version 1.1.2:

• The file enrichment playbook File > VirusTotal Premium > Enrichment optionally uploads the file and compute enrichment summary to VirusTotal Premium.
  • A new configurable option now uploads or skips the file upload to VirusTotal Premium. A global variable virus_total_premium_upload_file when set to true uploads the file to VirusTotal Premium and skips the upload when set to false.

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.
You can also use the yum command as a root user to install the connector:

yum install cyops-connector-virustotal-premium

Prerequisites to configuring the connector

• You must have the URL of the VirusTotal Premium server to connect and perform automated operations and credentials to access that server.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the VirusTotal Premium server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the VirusTotal Premium connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Parameter	Description
Server	Specify the server URL of the VirusTotal Premium server to which you will connect and perform the automated operations.
API Key	Specify the API key that is configured for your account to access the VirusTotal Premium server.
Verify SSL	Specifies whether the SSL certificate for the server is to be verified or not. By default, this option is set as True.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations from FortiSOAR™:

Function	Description	Annotation and Category
Get Widget Rendering URL	Retrieves a URL from VirusTotal Premium that renders a widget within an iframe and is valid for three days.	get_widget_rendering_url Investigation
Get Widget HTML Content	Retrieves the actual HTML content of the widget report for a given observable.	get_widget_html_content Investigation
Submit File	Scans and analyzes files submitted to VirusTotal Premium from FortiSOAR™ to determine if it is suspicious based on the Attachment ID or File IRI you have specified.	submit_sample Investigation
Submit URL for Scanning	Scans and analyzes the URL submitted to VirusTotal Premium to determine if it is suspicious based on the URL you have specified.	scan_url Investigation
Get IP Reputation	Retrieves a report from VirusTotal Premium for the IP address submitted to determine if it is suspicious based on the IP address you have specified.	get_ip_reputation Investigation
Get Domain Reputation	Retrieves a report from VirusTotal Premium for the domain submitted to determine if it is suspicious based on the domain name you have specified.	get_domain_reputation Investigation
Get URL Reputation	Retrieves a report from VirusTotal Premium for the URL submitted to determine if it is suspicious based on the URL you have specified.	get_url_reputation Investigation
Get File Reputation	Retrieves a report from VirusTotal Premium for the file that you have submitted to determine if it is suspicious based on the file hash value you have specified.	get_file_reputation Investigation
Get File Or URL Analysis Report	Retrieves details of a File or URL analysis from VirusTotal Premium for the File or URL that you had submitted for scanning and analysis to VirusTotal Premium using the "Submit File" or "Submit URL for scanning" action.	analysis_file Investigation
Download File	Downloads VirusTotal Premium report for a specified file from VirusTotal Premium based on the hash value of the file you have specified.	download_file Investigation
Create ZIP File	Creates a password-protected ZIP file with the VirusTotal Premium files based on the hash values of the VirusTotal Premium files and the password you have specified.	create_zip_file Investigation
Get ZIP File Status	Retrieves information of the ZIP file from VirusTotal Premium based on the zip file ID you have specified.	get_zip_file_status Investigation
Get ZIP File URL	Retrieves a signed URL from where you can download the specified ZIP file from VirusTotal Premium based on the zip file ID you have specified. Note: The retrieved URL expires after 1 hour.	get_zip_file_url Investigation
Download ZIP File	Downloads a zip file from VirusTotal Premium based on the zip file ID you have specified.	download_zip_file Investigation
Get PCAP File Behaviour	Retrieves a PCAP file from VirusTotal Premium based on the report ID you have specified. A PCAP file is generated while analyzing the file's behavior in VirusTotal Premium.	get_pcap_file_behaviour Investigation
Search Intelligence	Searches for files in VirusTotal Premium using the query and other input parameters you have specified.	search_intelligence Investigation
Create Livehunt Ruleset	Creates a live-hunt rule-set in VirusTotal Premium based on the rule-set name, rules, and other input parameters that you have specified.	create_livehunt_ruleset Investigation
Get Livehunt Rulesets List	Retrieves a list of live-hunt rule sets from VirusTotal Premium based on the filter and other input parameters that you have specified.	get_livehunt_rulesets_list Investigation
Get Livehunt Ruleset Details	Retrieves details for a specific live-hunt rule set from VirusTotal Premium based on the ruleset ID you have specified.	get_livehunt_ruleset_details Investigation
Update Livehunt Ruleset	Updates a specific hunting live hunt rule-set in VirusTotal Premium based on the rule-set id, rule-set name, rules, and other input parameters that you have specified.	update_livehunt_ruleset Investigation
Delete Livehunt Ruleset	Deletes a specific live hunt ruleset from VirusTotal Premium based on the ruleset ID you have specified.	delete_livehunt_ruleset Investigation
Get Livehunt Notifications List	Retrieves a list of all live hunt notifications from VirusTotal Premium based on the filter and other input parameters that you have specified.	get_livehunt_notifications_list Investigation
Get Livehunt Notifications Files List	Retrieves a list of all file objects for live hunt notifications from VirusTotal Premium based on the filter and other input parameters that you have specified.	get_livehunt_notifications_files_list Investigation
Get Livehunt Notifications Details	Retrieves details for a specific live hunt notification from VirusTotal Premium based on the notification ID you have specified.	get_livehunt_notifications_details Investigation
Get Livehunt Rule Files List	Retrieves a hunting live hunt ruleset from VirusTotal Premium by hunting notification files relationship in VirusTotal Premium based on the ruleset ID and other input parameters that you have specified.	get_livehunt_rule_files_list Investigation
Create Retrohunt Job	Creates a Retrohunt job in VirusTotal Premium based on the rules, and other input parameters that you have specified.	create_retrohunt_job Investigation
Abort Retrohunt Job	Aborts a specific Retrohunt job in VirusTotal Premium based on the job ID you have specified.	abort_retrohunt_job Investigation
Get Retrohunt Jobs List	Retrieves a list of all Retrohunt jobs from VirusTotal Premium based on the filter and other input parameters that you have specified.	get_retrohunt_jobs_list Investigation
Get Retrohunt Job Details	Retrieves details for a specific Retrohunt job from VirusTotal Premium based on the job ID you have specified.	get_retrohunt_job_details Investigation
Get Retrohunt Job Matching Files	Retrieves a list of all Retrohunt job-matching files from VirusTotal Premium.	get_retrohunt_job_matching_files Investigation
Delete Retrohunt Job	Deletes a specific Retrohunt job from VirusTotal Premium based on the Retrohunt job ID you have specified.	delete_retrohunt_job Investigation

operation: Get Widget Rendering URL

Input parameters

Parameter	Description
Indicator	Specify the file hash (md5, sha1 or sha256), URL, IP address, or a Domain.
Foreground Color	Specify the theme primary foreground color in hex notation.
Primary Background Color	Specify the theme primary background color in hex notation.
Secondary Background Color	Specify the theme secondary background color in hex notation.
Border Color	Specify the theme border color.

Output

The output contains the following populated JSON schema:

{
    "data": {
        "url": "",
        "found": "",
        "detection_ratio": {
            "detections": "",
            "total": ""
        },
        "type": "",
        "id": ""
    }
}

operation: Get Widget HTML Content

Input parameters

Parameter	Description
Token	Specify the token provided by the Get Widget Rendering URL operation response.

Output

The output contains a non-dictionary value.

operation: Submit File

Input parameters

Parameter	Description
Type	Specify the type of file that you want to submit to VirusTotal Premium for analysis. The type can be an Attachment ID or a File IRI.
Reference ID	Specify the reference ID that is used to access the attachment metadata from the FortiSOAR™ Attachments module. In the playbook, this defaults to the{{vars.attachment_id}} value or the {{vars.file_iri}} value.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "type": ""
}

operation: Submit URL for Scanning

Input parameters

Parameter	Description
URL	Specify the URL that you want to submit to VirusTotal Premium for scanning.

Output

The output contains the following populated JSON schema:

{
    "type": "",
    "id": ""
}

operation: Get IP Reputation

Input parameters

Parameter	Description
IP	Specify the IP address for which you want to retrieve a VirusTotal Premium report.
Relationships to Include	(Optional) Select the relationships such as Comments, Graphs, etc. that you want to include in the output of this operation.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "type": "",
    "links": {
      "self": ""
    },
    "attributes": {
      "asn": "",
      "jarm": "",
      "tags": [],
      "whois": {
        "raw": [],
        "data": ""
      },
      "network": "",
      "as_owner": "",
      "reputation": "",
      "whois_date": "",
      "total_votes": {
        "harmless": "",
        "malicious": ""
      },
      "last_analysis_date": "",
      "last_analysis_stats": {
        "timeout": "",
        "harmless": "",
        "malicious": "",
        "suspicious": "",
        "undetected": ""
      },
      "last_analysis_results": {},
      "last_https_certificate": {
        "size": "",
        "tags": [],
        "issuer": {},
        "subject": {},
        "version": "",
        "validity": {
          "not_after": "",
          "not_before": ""
        },
        "extensions": {
          "CA": "",
          "tags": [],
          "key_usage": [],
          "extended_key_usage": [],
          "certificate_policies": [],
          "ca_information_access": {},
          "subject_key_identifier": "",
          "crl_distribution_points": [],
          "authority_key_identifier": {
            "keyid": ""
          },
          "subject_alternative_name": []
        },
        "public_key": {},
        "thumbprint": "",
        "serial_number": "",
        "cert_signature": {
          "signature": "",
          "signature_algorithm": ""
        },
        "thumbprint_sha256": "",
        "signature_algorithm": ""
      },
      "last_modification_date": "",
      "last_https_certificate_date": ""
    }
}

operation: Get Domain Reputation

Input parameters

Parameter	Description
Domain	Specify the domain name for which you want to retrieve a VirusTotal Premium report.
Relationships to Include	(Optional) Select the relationships such as Comments, Graphs, etc. that you want to include in the output of this operation.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "type": "",
    "links": {
      "self": ""
    },
    "attributes": {
      "tld": "",
      "jarm": "",
      "tags": [],
      "whois": {
        "raw": [],
        "data": ""
      },
      "favicon": {
        "dhash": "",
        "raw_md5": ""
      },
      "categories": {},
      "reputation": "",
      "whois_date": "",
      "total_votes": {
        "harmless": "",
        "malicious": ""
      },
      "last_dns_records": [],
      "popularity_ranks": {},
      "last_analysis_date": "",
      "last_analysis_stats": {
        "timeout": "",
        "harmless": "",
        "malicious": "",
        "suspicious": "",
        "undetected": ""
      },
      "last_analysis_results": {},
      "last_dns_records_date": "",
      "last_https_certificate": {
        "size": "",
        "tags": [],
        "issuer": {},
        "subject": {},
        "version": "",
        "validity": {
          "not_after": "",
          "not_before": ""
        },
        "extensions": {
          "CA": "",
          "tags": [],
          "key_usage": [],
          "extended_key_usage": [],
          "certificate_policies": [],
          "ca_information_access": {
            "OCSP": "",
            "CA Issuers": ""
          },
          "subject_key_identifier": "",
          "authority_key_identifier": {
            "keyid": ""
          },
          "subject_alternative_name": []
        },
        "public_key": {},
        "thumbprint": "",
        "serial_number": "",
        "cert_signature": {
          "signature": "",
          "signature_algorithm": ""
        },
        "thumbprint_sha256": "",
        "signature_algorithm": ""
      },
      "last_modification_date": "",
      "last_https_certificate_date": ""
    }
}

operation: Get URL Reputation

Input parameters

Parameter	Description
URL	Specify the URL for which you want to retrieve a VirusTotal Premium report.
Relationships to Include	(Optional) Select the relationships such as Comments, Graphs, etc. that you want to include in the output of this operation.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "type": "",
    "links": {
      "self": ""
    },
    "attributes": {
      "tld": "",
      "url": "",
      "tags": [],
      "favicon": {
        "dhash": "",
        "raw_md5": ""
      },
      "categories": {},
      "reputation": "",
      "has_content": "",
      "total_votes": {
        "harmless": "",
        "malicious": ""
      },
      "threat_names": [],
      "last_final_url": "",
      "times_submitted": "",
      "redirection_chain": [],
      "last_analysis_date": "",
      "last_analysis_stats": {
        "timeout": "",
        "harmless": "",
        "malicious": "",
        "suspicious": "",
        "undetected": ""
      },
      "last_submission_date": "",
      "first_submission_date": "",
      "last_analysis_results": {},
      "last_modification_date": "",
      "last_http_response_code": "",
      "last_http_response_headers": {},
      "last_http_response_content_length": "",
      "last_http_response_content_sha256": ""
    }
}

operation: Get File Reputation

Input parameters

Parameter	Description
File Hash	Specify the File Hash of the file for which you want to retrieve a VirusTotal Premium report.
Relationships to Include	(Optional) Select the relationships such as Comments, Graphs, etc. that you want to include in the output of this operation.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "type": "",
    "links": {
      "self": ""
    },
    "attributes": {
      "md5": "",
      "sha1": "",
      "size": "",
      "tags": [],
      "trid": [],
      "magic": "",
      "names": [],
      "vhash": "",
      "sha256": "",
      "ssdeep": "",
      "pe_info": {
        "imphash": "",
        "overlay": {
          "md5": "",
          "chi2": "",
          "size": "",
          "offset": "",
          "entropy": "",
          "filetype": ""
        },
        "sections": [],
        "timestamp": "",
        "entry_point": "",
        "import_list": [],
        "machine_type": ""
      },
      "type_tag": "",
      "type_tags": [],
      "reputation": "",
      "total_votes": {
        "harmless": "",
        "malicious": ""
      },
      "authentihash": "",
      "downloadable": "",
      "bytehero_info": "",
      "creation_date": "",
      "type_extension": "",
      "unique_sources": "",
      "times_submitted": "",
      "type_description": "",
      "capabilities_tags": [],
      "last_analysis_date": "",
      "last_analysis_stats": {
        "failure": "",
        "timeout": "",
        "harmless": "",
        "malicious": "",
        "suspicious": "",
        "undetected": "",
        "type-unsupported": "",
        "confirmed-timeout": ""
      },
      "last_submission_date": "",
      "first_submission_date": "",
      "last_analysis_results": {},
      "last_modification_date": "",
      "popular_threat_classification": {
        "popular_threat_name": [],
        "suggested_threat_label": "",
        "popular_threat_category": []
      }
    }
}

operation: Get File Or URL Analysis Report

Input parameters

Parameter	Description
Type	Select the type, either File or URL, whose analysis details you want to retrieve from VirusTotal Premium.
Analysis ID	Specify the ID of the File or URL analysis whose details you want to retrieve from VirusTotal Premium. NOTE: To retrieve the analysis ID, you can use the Submit File or Submit URL for scanning operation.

Output

The output contains the following populated JSON schema:

Output schema when you choose Type as File:

{
    "meta": {
        "file_info": {
            "size": "",
            "sha1": "",
            "sha256": "",
            "md5": ""
        }
    },
    "data": {
        "attributes": {
            "date": "",
            "status": "",
            "stats": {
                "harmless": "",
                "type-unsupported": "",
                "suspicious": "",
                "confirmed-timeout": "",
                "timeout": "",
                "failure": "",
                "malicious": "",
                "undetected": ""
            },
            "results": {}
        },
        "type": "",
        "id": "",
        "links": {
            "item": "",
            "self": ""
        }
    }
}

Output schema when you choose Type as URL:

{
    "meta": {
        "url_info": {
            "url": "",
            "id": ""
        }
    },
    "data": {
        "attributes": {
            "date": "",
            "status": "",
            "stats": {
                "harmless": "",
                "malicious": "",
                "suspicious": "",
                "undetected": "",
                "timeout": ""
            },
            "results": {}
        },
        "type": "",
        "id": "",
        "links": {
            "item": "",
            "self": ""
        }
    }
}

operation: Download File

Input parameters

Parameter	Description
Hash Value	Specify the SHA-256, SHA-1, or MD5 of the file for which you want to retrieve a VirusTotal Premium report.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "@id": "",
    "file": {
        "id": "",
        "@id": "",
        "size": "",
        "uuid": "",
        "@type": "",
        "assignee": "",
        "filename": "",
        "metadata": [],
        "mimeType": "",
        "thumbnail": "",
        "uploadDate": ""
    },
    "name": "",
    "type": "",
    "uuid": "",
    "@type": "",
    "tasks": [],
    "alerts": [],
    "assets": [],
    "owners": [],
    "people": [],
    "@context": "",
    "assignee": "",
    "comments": [],
    "warrooms": [],
    "incidents": [],
    "createDate": "",
    "createUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "indicators": [],
    "modifyDate": "",
    "modifyUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "recordTags": [],
    "userOwners": [],
    "description": ""
}

operation: Create ZIP File

Input parameters

Parameter	Description
Hashes	Specify the list of comma-separated hash values of the files to create a zip file in VirusTotal Premium.
Password	(Optional) Specify the password for protecting the ZIP file being created.

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "status": "",
        "files_error": "",
        "files_ok": "",
        "progress": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Get ZIP File Status

Input parameters

Parameter	Description
ZIP File ID	Specify the file identifier of the ZIP file for which you want to retrieve the zip file information from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "status": "",
        "files_error": "",
        "files_ok": "",
        "progress": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Get ZIP File URL

Input parameters

Parameter	Description
ZIP File ID	Specify the file identifier of the ZIP file for which you want to retrieve a signed URL from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "url": ""
}

operation: Download ZIP File

Input parameters

Parameter	Description
ZIP File ID	Specify the file identifier of the ZIP file that you want to download from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "id": "",
    "@id": "",
    "file": {
        "id": "",
        "@id": "",
        "size": "",
        "uuid": "",
        "@type": "",
        "assignee": "",
        "filename": "",
        "metadata": [],
        "mimeType": "",
        "thumbnail": "",
        "uploadDate": ""
    },
    "name": "",
    "type": "",
    "uuid": "",
    "@type": "",
    "tasks": [],
    "alerts": [],
    "assets": [],
    "owners": [],
    "people": [],
    "@context": "",
    "assignee": "",
    "comments": [],
    "warrooms": [],
    "incidents": [],
    "createDate": "",
    "createUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "indicators": [],
    "modifyDate": "",
    "modifyUser": {
        "id": "",
        "@id": "",
        "name": "",
        "uuid": "",
        "@type": "",
        "avatar": "",
        "userId": "",
        "userType": "",
        "createDate": "",
        "createUser": "",
        "modifyDate": "",
        "modifyUser": ""
    },
    "recordTags": [],
    "userOwners": [],
    "description": ""
}

operation: Get PCAP File Behaviour

Input parameters

Parameter	Description
Report ID	Specify the Report ID of the sandbox from which you want to retrieve the PCAP file from VirusTotal Premium. A PCAP file is generated while analyzing the file's behavior in VirusTotal Premium.

Output

The output contains a non-dictionary value.

operation: Search Intelligence

Input parameters

Parameter	Description
Query	Specify a query as a key-value pair to search for files in VirusTotal Premium. For example, content: "hello World".
Order By	(Optional) Specify the order in which to sort the results retrieved from VirusTotal Premium. NOTE: If your Query parameter contains content search, the Order parameter has no effect.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set to 10.
Descriptors Only	(Optional) Select this option to return the full object information. Clear this option (default) to return just the object descriptors.
Cursor	(Optional) This parameter is used only if the previous operation has returned a partial result. If the previous response contains a cursor element, the value of the cursor element includes a cursor parameter that specifies a starting point to use for subsequent calls.

Output

The output contains the following populated JSON schema:

{
    "meta": {
        "cursor": "",
        "days_back": ""
    },
    "data": [
        {
            "attributes": {
                "type_description": "",
                "tlsh": "",
                "vhash": "",
                "exiftool": {
                    "ZipRequiredVersion": "",
                    "MIMEType": "",
                    "ZipCRC": "",
                    "FileType": "",
                    "ZipCompression": "",
                    "ZipUncompressedSize": "",
                    "ZipCompressedSize": "",
                    "FileTypeExtension": "",
                    "ZipFileName": "",
                    "ZipBitFlag": "",
                    "ZipModifyDate": ""
                },
                "trid": [
                    {
                        "file_type": "",
                        "probability": ""
                    }
                ],
                "crowdsourced_yara_results": [
                    {
                        "description": "",
                        "source": "",
                        "author": "",
                        "ruleset_name": "",
                        "rule_name": "",
                        "ruleset_id": ""
                    }
                ],
                "names": [],
                "last_modification_date": "",
                "type_tag": "",
                "times_submitted": "",
                "total_votes": {
                    "harmless": "",
                    "malicious": ""
                },
                "size": "",
                "type_extension": "",
                "last_submission_date": "",
                "last_analysis_results": {},
                "downloadable": "",
                "sha256": "",
                "tags": [],
                "last_analysis_date": "",
                "unique_sources": "",
                "first_submission_date": "",
                "sha1": "",
                "ssdeep": "",
                "bundle_info": {
                    "highest_datetime": "",
                    "lowest_datetime": "",
                    "num_children": "",
                    "extensions": {
                        "dex": "",
                        "xml": "",
                        "MF": "",
                        "png": "",
                        "zip": "",
                        "RSA": "",
                        "jpg": "",
                        "swf": "",
                        "dat": "",
                        "so": "",
                        "mp3": "",
                        "ttf": "",
                        "ogg": "",
                        "txt": "",
                        "sg": "",
                        "SF": "",
                        "pbk": "",
                        "pbj": ""
                    },
                    "file_types": {
                        "XML": "",
                        "DEX": "",
                        "ZIP": "",
                        "unknown": "",
                        "ELF": "",
                        "JPG": "",
                        "MP3": "",
                        "OGG": "",
                        "PNG": ""
                    },
                    "type": "",
                    "uncompressed_size": ""
                },
                "md5": "",
                "androguard": {
                    "VTAndroidInfo": "",
                    "Libraries": [],
                    "AndroidApplicationError": "",
                    "MinSdkVersion": "",
                    "AndroguardVersion": "",
                    "Activities": [],
                    "certificate": {
                        "Subject": {
                            "DN": "",
                            "CN": ""
                        },
                        "validto": "",
                        "serialnumber": "",
                        "thumbprint": "",
                        "validfrom": "",
                        "Issuer": {
                            "DN": "",
                            "CN": ""
                        }
                    },
                    "AndroidApplication": "",
                    "RiskIndicator": {
                        "APK": {
                            "SHARED LIBRARIES": ""
                        },
                        "PERM": {
                            "DANGEROUS": "",
                            "INTERNET": "",
                            "INSTANT": "",
                            "NORMAL": ""
                        }
                    },
                    "Services": [],
                    "AndroidVersionCode": "",
                    "main_activity": "",
                    "Package": "",
                    "intent_filters": {},
                    "AndroidVersionName": "",
                    "TargetSdkVersion": "",
                    "AndroidApplicationInfo": "",
                    "Providers": [],
                    "permission_details": {},
                    "Receivers": [],
                    "StringsInformation": []
                },
                "magic": "",
                "last_analysis_stats": {
                    "harmless": "",
                    "type-unsupported": "",
                    "suspicious": "",
                    "confirmed-timeout": "",
                    "timeout": "",
                    "failure": "",
                    "malicious": "",
                    "undetected": ""
                },
                "meaningful_name": "",
                "reputation": ""
            },
            "type": "",
            "id": "",
            "links": {
                "self": ""
            },
            "context_attributes": {
                "snippet": "",
                "confidence": "",
                "match_in_subfile": ""
            }
        }
    ],
    "links": {
        "self": "",
        "next": ""
    }
}

operation: Create Livehunt Ruleset

Input parameters

Parameter	Description
Ruleset Name	Specify the name of the livehunt ruleset that you want to create in VirusTotal Premium.
Rules	Specify the rules based on which you want to create the livehunt ruleset in VirusTotal Premium.
Enabled	(Optional) Select this option (default) to enable the livehunt ruleset that you want to create in VirusTotal Premium.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set to 100.
Notification Emails	(Optional) Specify the list of comma-separated notifications emails using which you want to create the livehunt ruleset in VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "name": "",
        "modification_date": "",
        "rules": "",
        "enabled": "",
        "rate_limited": "",
        "creation_date": "",
        "rule_names": [],
        "limit": "",
        "rate_limited_ratio": "",
        "notification_emails": [],
        "number_of_rules": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Get Livehunt Rulesets List

Input parameters

Parameter	Description
Filter	(Optional) Specify the filter using values of certain attributes, for example, filter=enabled:true, based on which you want to filter the livehunt rulesets retrieved from VirusTotal Premium.
Order By	(Optional) Specify the order in which you want to sort the results retrieved from VirusTotal Premium. NOTE: If your Filter parameter contains content search, then the Order parameter does not have any effect.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set as 10.
Cursor	(Optional) This parameter is used only if the previous operation has returned a partial result. If the previous response contains a cursor element, the value of the cursor element includes a cursor parameter that specifies a starting point to use for subsequent calls.

Output

The output contains the following populated JSON schema:

{
    "meta": {
        "count": "",
        "cursor": ""
    },
    "data": [
        {
            "attributes": {
                "name": "",
                "modification_date": "",
                "rules": "",
                "enabled": "",
                "rate_limited": "",
                "creation_date": "",
                "rule_names": [],
                "limit": "",
                "rate_limited_ratio": "",
                "notification_emails": [],
                "number_of_rules": ""
            },
            "type": "",
            "id": "",
            "links": {
                "self": ""
            }
        }
    ],
    "links": {
        "self": "",
        "next": ""
    }
}

operation: Get Livehunt Ruleset Details

Input parameters

Parameter	Description
Ruleset ID	Specify the ID of the livehunt ruleset for which you want to retrieve details from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "name": "",
        "modification_date": "",
        "rules": "",
        "enabled": "",
        "rate_limited": "",
        "creation_date": "",
        "rule_names": [],
        "limit": "",
        "rate_limited_ratio": "",
        "notification_emails": [],
        "number_of_rules": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Update Livehunt Ruleset

Input parameters

Parameter	Description
Ruleset ID	Specify the ID of the livehunt ruleset that you want to update in VirusTotal Premium.
Ruleset Name	Specify the name of the livehunt ruleset that you want to update in VirusTotal Premium.
Rules	Specify the rules based on which you want to update the hunting livehunt ruleset in VirusTotal Premium.
Enabled	(Optional) Select this option (default) to enable the livehunt ruleset that you want to update in VirusTotal Premium.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set as 100.
Notification Emails	(Optional) Specify the list of comma-separated notifications emails using which you want to update the livehunt ruleset in VirusTotal Premium.

<

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "name": "",
        "modification_date": "",
        "rules": "",
        "enabled": "",
        "rate_limited": "",
        "creation_date": "",
        "rule_names": [],
        "limit": "",
        "rate_limited_ratio": "",
        "notification_emails": [],
        "number_of_rules": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Delete Livehunt Ruleset

Input parameters

Parameter	Description
Ruleset ID	Specify the ID of the livehunt ruleset for which you want to remove the livehunt ruleset details from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "message": ""
}

operation: Get Livehunt Notifications List

Input parameters

Parameter	Description
Filter	(Optional) Specify the filter using values of certain attributes, for example, filter=tag:my_rule, based on which you want to filter the livehunt notifications retrieved from VirusTotal Premium.
Order By	(Optional) Specify the order in which you want to sort the results retrieved from VirusTotal Premium. NOTE: If your Filter parameter contains content search, then the Order parameter does not have any effect.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set to 10.
Cursor	(Optional) This parameter is used only if the previous operation has returned a partial result. If the previous response contains a cursor element, the value of the cursor element includes a cursor parameter that specifies a starting point to use for subsequent calls.
Count Limit	(Optional) Specify the maximum count of notifications that this operation should return, per page, in the response. By default, this is set to 200, and the maximum value that can be set to 10,000.

Output

The output contains the following populated JSON schema:

{
    "meta": {
        "count": "",
        "cursor": ""
    },
    "data": [
        {
            "attributes": {
                "tags": [],
                "snippet": "",
                "rule_name": "",
                "date": "",
                "rule_tags": [],
                "match_in_subfile": ""
            },
            "type": "",
            "id": "",
            "links": {
                "self": ""
            }
        }
    ],
    "links": {
        "self": "",
        "next": ""
    }
}

operation: Get Livehunt Notifications Files List

Input parameters

Parameter	Description
Filter	(Optional) Specify the filter using values of certain attributes, for example, filter=tag:my_rule, based on which you want to filter the file objects for livehunt notifications retrieved from VirusTotal Premium.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set to 10.
Cursor	(Optional) This parameter is used only if the previous operation has returned a partial result. If the previous response contains a cursor element, the value of the cursor element includes a cursor parameter that specifies a starting point to use for subsequent calls.
Count Limit	(Optional) Specify the maximum count of notifications that this operation should return, per page, in the response. By default, this is set to 200, and the maximum value that can be set to 10,000.

Output

The output contains the following populated JSON schema:

{
    "meta": {
        "count": "",
        "cursor": ""
    },
    "data": [
        {
            "attributes": {
                "type_description": "",
                "tlsh": "",
                "vhash": "",
                "exiftool": {
                    "FileDescription": "",
                    "LinkerVersion": "",
                    "ImageVersion": "",
                    "FileVersionNumber": "",
                    "UninitializedDataSize": "",
                    "LanguageCode": "",
                    "InternalName": "",
                    "ImageFileCharacteristics": "",
                    "CharacterSet": "",
                    "InitializedDataSize": "",
                    "EntryPoint": "",
                    "OriginalFileName": "",
                    "MIMEType": "",
                    "Subsystem": "",
                    "FileVersion": "",
                    "TimeStamp": "",
                    "FileType": "",
                    "PEType": "",
                    "FileFlagsMask": "",
                    "ProductVersion": "",
                    "SubsystemVersion": "",
                    "OSVersion": "",
                    "FileOS": "",
                    "LegalCopyright": "",
                    "MachineType": "",
                    "CodeSize": "",
                    "FileSubtype": "",
                    "ProductVersionNumber": "",
                    "FileTypeExtension": "",
                    "ObjectFileType": ""
                },
                "trid": [
                    {
                        "file_type": "",
                        "probability": ""
                    }
                ],
                "signature_info": {
                    "description": "",
                    "copyright": "",
                    "internal name": "",
                    "file version": "",
                    "original name": ""
                },
                "creation_date": "",
                "names": [],
                "dot_net_guids": {
                    "mvid": ""
                },
                "last_modification_date": "",
                "type_tag": "",
                "times_submitted": "",
                "total_votes": {
                    "harmless": "",
                    "malicious": ""
                },
                "size": "",
                "type_extension": "",
                "authentihash": "",
                "last_submission_date": "",
                "meaningful_name": "",
                "downloadable": "",
                "sha256": "",
                "tags": [],
                "last_analysis_date": "",
                "unique_sources": "",
                "first_submission_date": "",
                "sha1": "",
                "ssdeep": "",
                "md5": "",
                "dot_net_assembly": {
                    "external_modules": [],
                    "tables_rows_map_log": "",
                    "type_definition_list": [
                        {
                            "type_definitions": [],
                            "namespace": ""
                        }
                    ],
                    "external_assemblies": {},
                    "tables_rows_map": "",
                    "assembly_name": "",
                    "streams": {},
                    "tables_present": "",
                    "clr_version": "",
                    "assembly_data": {
                        "majorversion": "",
                        "minorversion": "",
                        "hashalgid": "",
                        "flags_text": "",
                        "buildnumber": "",
                        "culture": "",
                        "flags": "",
                        "pubkey": "",
                        "revisionnumber": ""
                    },
                    "tables_present_map": "",
                    "clr_meta_version": ""
                },
                "pe_info": {
                    "resource_details": [
                        {
                            "lang": "",
                            "entropy": "",
                            "chi2": "",
                            "filetype": "",
                            "sha256": "",
                            "type": ""
                        }
                    ],
                    "resource_types": {
                        "RT_VERSION": ""
                    },
                    "imphash": "",
                    "resource_langs": {
                        "NEUTRAL": ""
                    },
                    "machine_type": "",
                    "timestamp": "",
                    "entry_point": "",
                    "sections": [
                        {
                            "name": "",
                            "chi2": "",
                            "virtual_address": "",
                            "entropy": "",
                            "raw_size": "",
                            "flags": "rx",
                            "virtual_size": "",
                            "md5": ""
                        }
                    ],
                    "import_list": [
                        {
                            "library_name": "",
                            "imported_functions": []
                        }
                    ]
                },
                "magic": "",
                "last_analysis_stats": {
                    "harmless": "",
                    "type-unsupported": "",
                    "suspicious": "",
                    "confirmed-timeout": "",
                    "timeout": "",
                    "failure": "",
                    "malicious": "",
                    "undetected": ""
                },
                "last_analysis_results": {},
                "reputation": ""
            },
            "type": "",
            "id": "",
            "links": {
                "self": ""
            },
            "context_attributes": {
                "notification_id": "",
                "notification_source_key": "",
                "notification_tags": [],
                "ruleset_name": "",
                "notification_source_country": "",
                "rule_name": "",
                "notification_snippet": "",
                "ruleset_id": "",
                "rule_tags": [],
                "notification_date": "",
                "match_in_subfile": ""
            }
        }
    ],
    "links": {
        "self": "",
        "next": ""
    }
}

operation: Get Livehunt Notifications Details

Input parameters

Parameter	Description
Notification ID	Specify the ID of the livehunt notification for which you want to retrieve details from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "tags": [],
        "snippet": "",
        "rule_name": "",
        "date": "",
        "rule_tags": [],
        "match_in_subfile": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Get Livehunt Rule Files List

Input parameters

Parameter	Description
Ruleset ID	Specify the ID of the ruleset for which you want to retrieve the associated hunting livehunt ruleset from VirusTotal Premium by hunting notification files relationship in VirusTotal Premium.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response.
Cursor	(Optional) This parameter is used only if the previous operation has returned a partial result. If the previous response contains a cursor element, the value of the cursor element includes a cursor parameter that specifies a starting point to use for subsequent calls.

Output

The output contains the following populated JSON schema:

{
    "meta": {
        "count": "",
        "cursor": ""
    },
    "data": [
        {
            "type": "",
            "id": "",
            "context_attributes": {
                "notification_id": "",
                "notification_source_key": "",
                "notification_tags": [],
                "ruleset_name": "",
                "notification_source_country": "",
                "rule_name": "",
                "notification_snippet": "",
                "ruleset_id": "",
                "rule_tags": [],
                "notification_date": "",
                "match_in_subfile": ""
            }
        }
    ],
    "links": {
        "self": "",
        "related": "",
        "next": ""
    }
}

operation: Create Retrohunt Job

Input parameters

Parameter	Description
Rules	Specify the rules based on which you want to create the Retrohunt job in VirusTotal Premium.
Notification Emails	(Optional) Specify the list of comma-separated notifications emails using which you want to create the Retrohunt job in VirusTotal Premium.
Corpus	(Optional) Select the dataset you want to scan with the job that you want to create in VirusTotal Premium. You can between Main or GoodWare.
Start Time	(Optional) Specify the starting DateTime from when you want to create the Retrohunt job in VirusTotal Premium.
End time	(Optional) Specify the ending DateTime till when you want to create the Retrohunt job in VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "status": "",
        "rules": "",
        "num_matches_outside_time_range": "",
        "scanned_bytes": "",
        "creation_date": "",
        "progress": "",
        "num_matches": "",
        "notification_email": "",
        "corpus": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Abort Retrohunt Job

Input parameters

Parameter	Description
Job ID	Specify the ID of the Retrohunt job that you want to abort in VirusTotal Premium.

Output

The output contains a non-dictionary value.

operation: Get Retrohunt Jobs List

Input parameters

Parameter	Description
Filter	(Optional) Specify the filter using values of certain attributes, for example, filter=tag:my_rule, based on which you want to filter the Retrohunt jobs retrieved from VirusTotal Premium.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set as 10.
Cursor	(Optional) This parameter is used only if the previous operation has returned a partial result. If the previous response contains a cursor element, the value of the cursor element includes a cursor parameter that specifies a starting point to use for subsequent calls.

Output

The output contains the following populated JSON schema:

{
    "attributes": {
        "status": "",
        "rules": "",
        "num_matches_outside_time_range": "",
        "scanned_bytes": "",
        "creation_date": "",
        "progress": "",
        "num_matches": "",
        "notification_email": "",
        "corpus": ""
    },
    "type": "",
    "id": "",
    "links": {
        "self": ""
    }
}

operation: Get Retrohunt Job Details

Input parameters

Parameter	Description
Job ID	Specify the ID of the Retrohunt job for which you want to retrieve details from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "data": {
        "attributes": {
            "status": "",
            "finish_date": "",
            "rules": "",
            "num_matches_outside_time_range": "",
            "scanned_bytes": "",
            "creation_date": "",
            "num_matches": "",
            "progress": "",
            "notification_email": "",
            "corpus": ""
        },
        "type": "",
        "id": "",
        "links": {
            "self": ""
        }
    }
}

operation: Get Retrohunt Job Matching Files

Input parameters

Parameter	Description
Job ID	Specify the ID of the Retrohunt job for which you want to retrieve details from VirusTotal Premium.
Limit	(Optional) Specify the maximum number of results this operation should return, per page, in the response. By default, this is set as 10.
Cursor	(Optional) This parameter is used only if the previous operation has returned a partial result. If the previous response contains a cursor element, the value of the cursor element includes a cursor parameter that specifies a starting point to use for subsequent calls.

Output

The output contains the following populated JSON schema:

{
    "meta": {
        "count": "",
        "cursor": ""
    },
    "data": [
        {
            "attributes": {
                "type_description": "",
                "tlsh": "",
                "vhash": "",
                "exiftool": {
                    "ZipRequiredVersion": "",
                    "MIMEType": "",
                    "ZipCRC": "",
                    "FileType": "",
                    "ZipCompression": "",
                    "ZipUncompressedSize": "",
                    "ZipCompressedSize": "",
                    "FileTypeExtension": "",
                    "ZipFileName": "",
                    "ZipBitFlag": "",
                    "ZipModifyDate": ""
                },
                "trid": [
                    {
                        "file_type": "",
                        "probability": ""
                    }
                ],
                "names": [],
                "last_modification_date": "",
                "type_tag": "",
                "times_submitted": "",
                "total_votes": {
                    "harmless": "",
                    "malicious": ""
                },
                "size": "",
                "type_extension": "",
                "last_submission_date": "",
                "last_analysis_results": {},
                "downloadable": "",
                "sha256": "",
                "tags": [],
                "last_analysis_date": "",
                "unique_sources": "",
                "first_submission_date": "",
                "sha1": "",
                "ssdeep": "",
                "bundle_info": {
                    "highest_datetime": "",
                    "lowest_datetime": "",
                    "num_children": "",
                    "extensions": {
                        "xml": "",
                        "dex": "",
                        "so": "",
                        "png": ""
                    },
                    "file_types": {
                        "XML": "",
                        "DEX": "",
                        "ELF": "",
                        "PNG": "",
                        "unknown": ""
                    },
                    "type": "",
                    "uncompressed_size": ""
                },
                "md5": "",
                "androguard": {
                    "VTAndroidInfo": "",
                    "Libraries": [],
                    "AndroidApplicationError": "",
                    "MinSdkVersion": "",
                    "AndroguardVersion": "",
                    "Activities": [],
                    "certificate": {
                        "Subject": {
                            "DN": "",
                            "C": "",
                            "CN": "",
                            "L": "",
                            "O": "",
                            "ST": "",
                            "OU": ""
                        },
                        "validto": "",
                        "serialnumber": "",
                        "thumbprint": "",
                        "validfrom": "",
                        "Issuer": {
                            "DN": "",
                            "C": "",
                            "CN": "",
                            "L": "",
                            "O": "",
                            "ST": "",
                            "OU": ""
                        }
                    },
                    "AndroidApplication": "",
                    "RiskIndicator": {
                        "APK": {
                            "DEX": "",
                            "SHARED LIBRARIES": ""
                        },
                        "PERM": {
                            "INSTANT": "",
                            "PRIVACY": "",
                            "DANGEROUS": "",
                            "NORMAL": "",
                            "INTERNET": "",
                            "GPS": ""
                        }
                    },
                    "Services": [],
                    "AndroidVersionCode": "",
                    "main_activity": "",
                    "Package": "",
                    "intent_filters": {
                        "Services": {},
                        "Activities": {},
                        "Receivers": {}
                    },
                    "AndroidVersionName": "",
                    "TargetSdkVersion": "",
                    "AndroidApplicationInfo": "",
                    "Providers": [],
                    "permission_details": {},
                    "Receivers": [],
                    "StringsInformation": []
                },
                "magic": "",
                "main_icon": {
                    "raw_md5": "",
                    "dhash": ""
                },
                "last_analysis_stats": {
                    "harmless": "",
                    "type-unsupported": "",
                    "suspicious": "",
                    "confirmed-timeout": "",
                    "timeout": "",
                    "failure": "",
                    "malicious": "",
                    "undetected": ""
                },
                "meaningful_name": "",
                "reputation": ""
            },
            "type": "",
            "id": "",
            "links": {
                "self": ""
            },
            "context_attributes": {
                "rule_name": "",
                "match_in_subfile": ""
            }
        }
    ],
    "links": {
        "self": "",
        "next": ""
    }
}

operation: Delete Retrohunt Job

Input parameters

Parameter	Description
Job ID	Specify the ID of the Retrohunt job that you want to delete from VirusTotal Premium.

Output

The output contains the following populated JSON schema:

{
    "message": ""
}

Included playbooks

The Sample - VirusTotal Premium - 1.1.2 playbook collection comes bundled with the VirusTotal Premium connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the VirusTotal Premium connector.

• Abort Retrohunt Job
• Create Livehunt Ruleset
• Create Retrohunt Job
• Create ZIP File
• Delete Livehunt Ruleset
• Delete Retrohunt Job
• Domain > VirusTotal Premium > Enrichment
• Download File
• Download ZIP File
• File > VirusTotal Premium > Enrichment
• File Hash > VirusTotal Premium > Enrichment
• Get Domain Reputation
• Get File Or URL Analysis Report
• Get File Reputation
• Get IP Reputation
• Get Livehunt Notifications Details
• Get Livehunt Notifications Files List
• Get Livehunt Notifications List
• Get Livehunt Rule Files List
• Get Livehunt Ruleset Details
• Get Livehunt Rulesets List
• Get PCAP File Behaviour
• Get Retrohunt Job Details
• Get Retrohunt Job Matching Files
• Get Retrohunt Jobs List
• Get URL Reputation
• Get Widget HTML Content
• Get Widget Rendering URL
• Get ZIP File Status
• Get ZIP File URL
• IP Address > VirusTotal Premium> Enrichment
• Search Intelligence
• Submit File
• Submit URL for Scanning
• URL > VirusTotal Premium > Enrichment
• Update Livehunt Ruleset

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection, since the sample playbook collection gets deleted during connector upgrade and delete.

Pluggable Enrichment

The Sample - VirusTotal Premium - 1.1.2 playbook collection contains pluggable enrichment playbooks that are used to provide verdicts for indicator types IP Address, File Hash, URL, and Domain. The pluggable enrichment playbooks are in the format: indicatorType > VirusTotal Premium > Enrichment format. For example, IP > VirusTotal Premium > Enrichment format.

The Configuration step in all the pluggable enrichment playbooks contains variables that have default values for calculating the Verdict for various indicator types.

NOTE: Create a global variable virus_total_premium_upload_file to manage the upload file operation performed by the File > VirusTotal Premium > Enrichment playbook. The value true uploads the file to VirusTotal Premium; false skips the upload.

Default variables for all supported indicator types

The VirusTotal Premium integration API response returns the verdict, cti_score, and enrichment_summary and other variables as listed in the following table:

Variable Name	Description	Return Value
verdict	This connector returns a high-reliability value called verdict. Use this verdict to find the reputation of the various types of indicators.	if the value in last_analysis_stats.malicious > 0 then the verdict returned is Malicious if the value in last_analysis_stats.suspicious > 0 then the verdict returned is Suspicious if the value in last_analysis_stats.harmless > 0 then the verdict returned is Good For any other value, return the verdict as No Reputation Available
cti_name	The name of the connector is called the CTI (Cyber Threat Intelligence) name	VirusTotal Premium
cti_score	The verdict value is returned by the integration API.	Returns the value contained in last_analysis_stats.malicious Returns the value in last_analysis_stats.suspicious if last_analysis_stats.malicious is empty Returns 0 if both are empty.
source_data	The source_data response is returned by the integration API.	A JSON response object containing the source data of the threat intelligence integration.
field_mapping	The mapping of the FortiSOAR Indicator module fields with the VirusTotal Premium response fields.	A JSON response object containing the field mapping of the threat intelligence integration.
enrichment_summary	The contents are added, in the HTML format, in the Description field of the specified FortiSOAR indicator record.	The following values are returned in the HTML format: Malicious Suspicious Harmless Community Votes The following image displays a sample of the populated Description field in a FortiSOAR indicator record: