Activate and configure the VirusTotal integration
Before you can use the VirusTotal integration, you must download it from the ServiceNow Store.
Before you begin
Role required: admin
Threat Intelligence must be installed and activated before you can use VirusTotal. The VirusTotal integration has been upgraded to version 3 APIs.
Procedure
When the installation is complete, access VirusTotal and obtain the API Key under your VirusTotal profile.
In your instance, navigate to Security Operations > Integration Configuration.
The available security integrations appear as a series of cards.
In the VirusTotal card, click Configure.
| Field | Description |
|---|---|
| Name | Name of the integration. For example, VirusTotal. |
| API Key | Enter (or paste) the API Key you acquired from the VirusTotal site. |
| Enable VT Private Scanning | Select this check box to analyze files with VirusTotal in a privacy preserving fashion. The files uploaded via this offering won't be shared with anyone beyond your organization, and will remain in VirusTotal only for a brief period of time.The resulting analyses will be ephemeral too and only visible to your VirusTotal group. Important: To use the VT Private Scanning, your VirusTotal license should be entitled to this feature. |
| Send URL as SHA-256 Hash | Select this check box to send the URLs as hashes for threat lookup and protect the users' privacy on the integration.Note: If disabled, the URL is sent as Base64 encoding to the VirusTotal API. |
- Click Submit.
VirusTotal Configuration page
Result
After it is configured, VirusTotal can be selected for performing lookups on observables in Threat Intelligence and on observables in security incidents.
Related topics