VirusTotal

VirusTotal is a free online service that analyzes files and URLs using antivirus engines and website scanners.

Overview

VirusTotal is a powerful threat intelligence platform that analyzes suspicious files, domains, IPs, and URLs to detect malware and other breaches. By integrating VirusTotal with Qevlar AI, you can enhance your security investigations with comprehensive malware analysis and threat detection capabilities.

How to integrate VirusTotal with Qevlar

Step 1: Navigate to Integrations

1. Log in to your Qevlar AI platform
2. In the left sidebar, click on Integrations
3. Browse or search for the VirusTotal integration
4. Click on the VirusTotal integration card

Step 2: Choose Your Integration Method

Qevlar offers two options for integrating VirusTotal.

• Option 1: Use Qevlar's Account (Recommended for Quick Start)

  If you want to start using VirusTotal immediately without setting up your own API key:

  1. Check the box "I want to use Qevlar's account" (marked as 1 in the image)
  2. Click Save

  This option allows you to use VirusTotal's features through Qevlar's shared account. No additional configuration is required.

  info

  Using Qevlar's account may have usage limitations. Using your own API key is recommended to overcome the potential rate limits.

• Option 2: Use Your Personal VirusTotal API Key

  For unlimited access and personalized usage tracking:

  1. Leave the "I want to use Qevlar's account" checkbox unchecked
  2. Enter your VirusTotal API key in the API Key field (marked as 2 in the image)
  3. Click Test connection to verify your API key is valid (marked as 3 in the image)
  4. Once the connection test passes, click Save

Step 3: Obtain Your VirusTotal API Key

If you choose to use your personal API key, follow these steps to obtain it:

1. Go to VirusTotal.com and sign in to your account
2. The main VirusTotal interface will appear:

3. Click on your profile icon in the top-right corner
4. Select API Key from the dropdown menu
5. On the API Key page, you'll see your personal API key displayed in a text field:

6. Click the copy button to copy your API key
7. Return to Qevlar and paste the API key in the integration dialog

Step 4: Test and Save

1. After entering your API key, click Test connection
2. Wait for the connection test to complete
3. If successful, click Save to finalize the integration
4. If the test fails, verify your API key is correct and try again

Using VirusTotal in Qevlar

Once integrated, you can use VirusTotal features within your Qevlar investigations:

• File Analysis: Upload and analyze suspicious files
• URL Scanning: Check URLs for malicious content
• Domain Intelligence: Get detailed information about domains
• IP Analysis: Investigate IP addresses for threats
• Hash Lookups: Search for known malware by file hash

Troubleshooting

1. Connection Test Failed

• Verify your API key is correctly copied without extra spaces
• Ensure your VirusTotal account is active
• Check if your API key has the necessary permissions

2. Rate Limiting

• If using Qevlar's account, you may encounter rate limits during peak usage
• Consider using your personal API key for unlimited access

3. API Key Not Working

• Log in to VirusTotal and regenerate your API key
• Ensure you're copying the entire key
• Check if your VirusTotal account requires email verification

Best Practices

1. Security: Keep your API key confidential and rotate it periodically
2. Usage: Monitor your API usage to stay within limits
3. Integration: Test the integration regularly to ensure it's working properly
4. Updates: Keep track of VirusTotal API updates that might affect the integration

Support

If you encounter any issues with the VirusTotal integration:

• Contact Qevlar support
• Visit the VirusTotal documentation