Virus Total | APIv3 | URL enricher

The URL enricher provides additional intelligence connected to uri observables.

Observable types

This Enricher only enriches uri observables.

Endpoints & Outputs

Endpoint	Reponse	Output type
Communicating files	Files known to communicate with the enriched uri.	hash-sha256
Contacted domains	Domains from which the enriched uri has loaded resources.	domain
Contacted IPs	IP addresses from which the enriched uri has loaded resources.	ipv4
Downloaded files	Files that have been downloaded from the enriched uri.	hash-sha256
Embedded JS files	JS scripts found in the response retrieved from the enriched uri.	hash-sha256
Last serving IP address	Last-known IPv4 address that the enriched URL resolved to.	ipv4
Redirecting URLs	URLs that redirect to the enriched uri.	uri
Referrer files	Files that contain a string representation of the enriched uri.	hash-sha256
Referrer URLs	URLs that contain a string representation of the enriched uri.	uri

Configure

Make sure you’ve configured your VT APIv3 key.

Required fields

Fields on the Enricher pane marked with an asterisk (“*”) are required to fill in, but may come pre-filled.

1. Go to Data configuration > Enrichers.

2. Filter the list by searching for VirusTotal APIv3 URL enricher.

3. In the row of the URL enricher, select More > Edit.

4. For Source reliability, select the source reliability rating that will be applied to the Entities and Observables this enricher will produce if you haven’t configured it yet.

5. Under API key, enter your VirusTotal API key if you haven’t configured it yet.

6. Under Include Endpoints, select the Endpoints you’d like the enricher to hit.

7. (Optional) Change the Description.

8. (Optional) Change the Cache validity, Rate limit, or Monthly execution cap.

9. (Optional) Select Create Parent Report or SSL verification and supply a Path to SSL certificate file.

10. Check the Enabled box to enable the enricher when you’re done configuring it.

11. Select Save.