Integration Details

ThreatQuotient provides the following details for this integration:

Introduction

The VirusTotal Livehunt operation pushes YARA signatures from ThreatQ to VirusTotal Livehunt.

The VirusTotal Livehunt CDF integration, in return, will ingest data related to each signature pushed with this operation from VirusTotal Livehunt back into ThreatQ.

Installation

Configuration

ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.

To configure the integration:

1. Navigate to your integrations management page in ThreatQ.
2. Select the Operation option from the Type dropdown (optional).
3. Click on the integration entry to open its details page.
4. Enter the following parameters under the Configuration tab:

   Parameter	Description
   API Key	Private or public VirusTotal LiveHunt API key.
   Email Addresses to Notify	The email addresses to receive notifications by email (Optional). Separate multiple email addresses with commas.

5. Review any additional settings, make any changes if needed, and click on Save.
6. Click on the toggle switch, located above the Additional Information section, to enable it.

Actions

The VirusTotal LiveHunt operation provides the following actions:

{
   "data":{
      "type":"hunting_ruleset",
      "attributes":{
         "notification_emails":[
            "test@test.com"
         ],
         "name":"CTM_Webshell_b374k_ops",
         "rules":"rule CTM_Webshell_b374k_ops {strings:\n$general1 = \"Shell\"\ncondition:\nall of ($general*) )\n}\n\n"
      }
   }
}

Change Log

• Version 1.0.0
  • Initial release