---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Threat Lookup - VirusTotal workflow

# Threat Lookup - VirusTotal workflow {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

The Threat Lookup - VirusTotal workflow performs a lookup on selected observables. If the observables are of a type
recognized by VirusTotal, the
observables are scanned for malware, and the results are returned.

## Before you begin

Role required: admin

## About this task

This workflow is triggered by the [Security Operations Integration - Threat Lookup capability](https://servicenow-prod.fluidtopics.net/aKsui0~8zhutMOFnbigrAA "The Threat Lookups capability performs threat intelligence lookups to determine whether one or more observables are associated with known security threats.") when you perform a threat lookup on one or more observables, and the VirusTotal implementation
is selected. For more information, see [Perform lookups on observables](https://servicenow-prod.fluidtopics.net/lpoUE~l5Cuui5Nt5XCnFsA "You can perform threat intelligence lookups on one or more observables to determine whether they’re associated with known security threats. The scanning implementations that run depend on the ones you’ve activated.").
Figure 1. Threat Lookup - VirusTotal workflow

For information on the activities used by this workflow, see [Common Security Operations integration flows and orchestration activities](https://servicenow-prod.fluidtopics.net/VeHrUh9NzKmFfa~3wxWcqQ "Many of the flows associated with third-party integrations include the same activities. For example, activities for beginning and completing processing.").