---
title: VirusTotal V3
description: ''
slug: /help/docs/integrations/automation-integrations/virustotal-v3/
canonical: https://www.sumologic.com/help/docs/integrations/automation-integrations/virustotal-v3/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

<img src=/help/img/platform-services/automation-service/app-central/logos/virustotal.png alt="virustotal"
width="100"/>

***Version: 1.5  
Updated: July 31, 2026***

Perform threat intelligence evidence gathering with [VirusTotal V3 API](https://docs.virustotal.com/reference/overview).

## Actions

* **Add Comment** (*Notification*) - Add a new comment.
* **Add Vote to Comment** (*Notification*) - Add a vote to a comment.
* **Check Scanned Status** (*Scheduled*) - Check the status of a Scan File and Scan URL.
* **Domain Reputation** (*Enrichment*) - Gather domain reputation information on a specific domain.
* **Download Report** (*Enrichment*) - Download a file of scanned report.
* **File Reputation** (*Enrichment*) - Gather reputation information on a specific file.
* **Get Comment** (*Enrichment*) - Gather all comments.
* **Get Domain Resolutions** (*Enrichment*) - Retrieve DNS resolution history for a specific domain.
* **Get File Behaviour** (*Enrichment*) - Retrieve sandbox behaviour reports for a specific file.
* **Get IP Resolutions** (*Enrichment*) - Retrieve DNS resolution history for a specific IP address.
* **Get Report** (*Enrichment*) - Gather a report on a specific File or URL.
* **IP Reputation** (*Enrichment*) - Gather IP reputation information for multiple IP addresses.
* **Rescan File** (*Enrichment*) - Rescan a previously submitted file with the latest antivirus engines.
* **Scan File** (*Enrichment*) - Scan the specific file.
* **Scan URL** (*Enrichment*) - Scan on a specific URL.
* **Search VirusTotal** (*Enrichment*) - Search for File Hash, URL, Domain, IP address and comments by tags.
* **URL Reputation** (*Enrichment*) - Gather reputation information for multiple URLs.

## Category

Threat Intelligence-Reputation

## Configure VirusTotal v3 in Automation Service and Cloud SOAR

import IntegrationsAuth from '../../reuse/integrations-authentication.md';
import IntegrationCertificate from '../../reuse/automation-service/integration-certificate.md';
import IntegrationEngine from '../../reuse/automation-service/integration-engine.md';
import IntegrationLabel from '../../reuse/automation-service/integration-label.md';
import IntegrationProxy from '../../reuse/automation-service/integration-proxy.md';
import IntegrationTimeout from '../../reuse/automation-service/integration-timeout.md';
import SumoLogicAPIURL from '../../reuse/automation-service/sumo-logic-api-url.md';
import CloudSOARAPIURL from '../../reuse/automation-service/cloud-soar-api-url.md';
import AccessID from '../../reuse/automation-service/access-id.md';
import AccessKey from '../../reuse/automation-service/access-key.md';

<IntegrationsAuth/>
* <IntegrationLabel/>
* **API URL**. Enter your VirusTotal API URL, for example, `https://www.virustotal.com`.

* **API Key**. Enter your [VirusTotal API key](https://docs.virustotal.com/docs/please-give-me-an-api-key).
* <CloudSOARAPIURL/>
* <AccessID/>
* <AccessKey/>
* <IntegrationTimeout/>
* <IntegrationCertificate/>
* <IntegrationEngine/>
* <IntegrationProxy/>

<img src=/help/img/platform-services/automation-service/app-central/integrations/misc/virustotal-v3-configuration.png style={{border:'1px solid gray'}} alt="VirusTotal v3 configuration" width="400"/>

For information about VirusTotal v3, see [VirusTotal v3 documentation](https://docs.virustotal.com/reference/overview).

## Change Log

| Version | Date | Description |
|:--|:--|:--|
| v1.5 | July 31, 2026 | <ul><li>Added new actions: **Get Domain Resolutions**, **Get File Behaviour**, **Get IP Resolutions**, and **Rescan File**.</li><li>Improved reliability and consistency across all actions with standardized request handling and enhanced error messages.</li></ul> |
| | April 8, 2026 | Upgraded the `python3_generic` Docker image (Python 3.8) to `python3_12_generic` (Python 3.12) to address Python 3.8 end-of-life and improve security and performance. |
| | October 3, 2025 | Implemented a polling mechanism (`poll_analysis`) in the **Scan URL** action to wait until the VirusTotal scan status becomes completed. |
| | July 22, 2025 | Fixed a URL parsing issue in the **URL Reputation** action. |
| | July 03, 2024 | Initial release of the VirusTotal V3 integration, an updated version of VirusTotal that works with the V3 API. |