Threat Lookup - VirusTotal workflow

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • The Threat Lookup - VirusTotal workflow performs a lookup on selected observables. If the observables are of a type recognized by VirusTotal, the observables are scanned for malware, and the results are returned.

    Before you begin

    Role required: admin

    About this task

    This workflow is triggered by the Security Operations Integration - Threat Lookup capability when you perform a threat lookup on one or more observables, and the VirusTotal implementation is selected. For more information, see Perform lookups on observables.

    Figure 1. Threat Lookup - VirusTotal workflow
    Threat Lookup - VirusTotal workflow

    For information on the activities used by this workflow, see Common Security Operations integration flows and orchestration activities.