VirusTotal IOC Stream CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

VirusTotal IOC Stream

The VirusTotal IOC Stream feed ingests IOCs from the VirusTotal IOC Stream feed and stores them along with selected Context attributes.

GET https://www.virustotal.com/api/v3/ioc_stream

Sample Response:

{
  "meta": {
    "cursor": "eJyrCa9yNfIPSTf1DXE09M1KLvZ09qzwzYqs9HdJNvEPSTbxdfZKAQDpQQwc",
    "count": 76
  },
  "data": [
    {
      "attributes": {
        "whois": "NetRange: 10.0.0.0 - 10.255.255.255\nCIDR: 10.0.0.0/8\nNetName: PRIVATE-ADDRESS-ABLK-RFC1918-IANA-RESERVED\nNetHandle: NET-10-0-0-0-1\nParent: ()\nNetType: IANA Special Use\nOriginAS: \nOrganization: Internet Assigned Numbers Authority (IANA)\nRegDate: \nUpdated: 2013-08-30\nComment: These addresses are in use by many millions of independently operated networks, which might be as small as a single computer connected to a home gateway, and are automatically configured in hundreds of millions of devices. They are only intended for use within a private context and traffic that needs to cross the Internet will need to use a different, unique address.\r\nComment: \r\nComment: These addresses can be used by anyone without any need to coordinate with IANA or an Internet registry. The traffic from these addresses does not come from ICANN or IANA. We are not the source of activity you may see on logs or in e-mail records. Please refer to http://www.iana.org/abuse/answers\r\nComment: \r\nComment: These addresses were assigned by the IETF, the organization that develops Internet protocols, in the Best Current Practice document, RFC 1918 which can be found at:\r\nComment: http://datatracker.ietf.org/doc/rfc1918\nRef: https://rdap.arin.net/registry/ip/10.0.0.0\nOrgName: Internet Assigned Numbers Authority\nOrgId: IANA\nAddress: 12025 Waterfront Drive\r\nAddress: Suite 300\nCity: Los Angeles\nStateProv: CA\nPostalCode: 90292\nCountry: US\nRegDate: \nUpdated: 2012-08-31\nRef: https://rdap.arin.net/registry/entity/IANA\nOrgAbuseHandle: IANA-IP-ARIN\nOrgAbuseName: ICANN\nOrgAbusePhone: +1-310-301-5820 \nOrgAbuseEmail: abuse@iana.org\nOrgAbuseRef: https://rdap.arin.net/registry/entity/IANA-IP-ARIN\nOrgTechHandle: IANA-IP-ARIN\nOrgTechName: ICANN\nOrgTechPhone: +1-310-301-5820 \nOrgTechEmail: abuse@iana.org\nOrgTechRef: https://rdap.arin.net/registry/entity/IANA-IP-ARIN\n",
        "whois_date": 1652963616,
        "last_analysis_date": 1698893708,
        "tags": [
          "private"
        ],
        "last_analysis_stats": {
          "harmless": 56,
          "malicious": 0,
          "suspicious": 0,
          "undetected": 33,
          "timeout": 0
        },
        "threat_severity": {
          "threat_severity_level": "SEVERITY_NONE",
          "threat_severity_data": {
            "has_bad_communicating_files_high": true,
            "has_bad_communicating_files_medium": true
          },
          "last_analysis_date": "1698894041",
          "version": "I2",
          "level_description": "Severity NONE because it has no detections."
        },
        "reputation": 0,
        "last_analysis_results": 
        {
          "Bkav": {
            "category": "undetected",
            "result": "unrated",
            "method": "blacklist",
            "engine_name": "Bkav"
          },
          "CMC Threat Intelligence": 
          {
              "category": "harmless",
              "result": "clean",
              "method": "blacklist",
              "engine_name": "CMC Threat Intelligence"
          }
        },
        "last_modification_date": 1698921525,
        "total_votes": {
          "harmless": 0,
          "malicious": 0
        }
      },
      "type": "ip_address",
      "id": "10.127.0.3",
      "links": {
        "self": "https://www.virustotal.com/api/v3/ip_addresses/10.127.0.3"
      },
      "context_attributes": {
        "notification_id": "12558362696",
        "origin": "hunting",
        "hunting_info": {
          "rule_name": "IpsContactedByADetectedFile"
        },
        "tags": [
          "untitled_yara_ruleset",
          "ipscontactedbyadetectedfile"
        ],
        "sources": [
          {
            "type": "hunting_ruleset",
            "id": "12682106570",
            "label": "Untitled YARA ruleset"
          }
        ],
        "notification_date": 1698921520
      }
    }
  ],
    "links": {
        "self": "https://www.virustotal.com/api/v3/ioc_stream",
        "next": "https://www.virustotal.com/api/v3/ioc_stream?cursor=eJyrCa9yNfIPSTf1DXE09M1KLvZ09qzwzYqs9HdJNvEPSTbxdfZKAQDpQQwc"
    }
}

ThreatQuotient provides the following default mapping for this feed:

PDF Guides