VT4Splunk Comments

All Apps and Add-ons

I have used VT4Splunk app for notable enriching process in Splunk Enterprise Security.

Does somebody know if I can get comment values from VirusTotal <hash,ip, domain> results? Not only count of them.

Below is an example of

| makeresutls
| eval file_hash="43dbf0a7df3b78cffbe5732b9da758fddfe13a8c9775da1214622837e8d30d28"
| vt4splunk hash=file_hash

the results

Here is an example of a particular API request I found in the VT docs and want to use with splunk: https://docs.virustotal.com/reference/files-comments-get

Thanks in advance!

Get Updates on the Splunk Community!

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Join the Conversation