All Apps and Add-ons

VT4Splunk Comments

Oleskii
New Member

I have used VT4Splunk app for notable enriching process in Splunk Enterprise Security.

Does somebody know if  I can get comment values from VirusTotal <hash,ip, domain> results? Not only count of them.

Below is an example of 

 

 

| makeresutls
| eval file_hash="43dbf0a7df3b78cffbe5732b9da758fddfe13a8c9775da1214622837e8d30d28"
| vt4splunk hash=file_hash

 

 

the results

Oleskii_0-1703745141649.jpeg

 

Here is an example of a particular API request I found in the VT docs and want to use with splunk: https://docs.virustotal.com/reference/files-comments-get

Thanks in advance!

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...