If correctly understand your intent, you wish to augment your events with information brought back from VirusTotal?
You may automate the "cache building" - the creation of lookups that will contain the data relevant to your environment. This can be done in the "Set-Up" page of the TA, and is further documented here.
After enabling the "Cache Auto Update" sections, you will be able to use lookups in any of your searches to quickly reference VirusTotal data. This can be achieved easily by running a search like this:
| fields attachment_hash, from
| lookup virustotal_hash_cache vt_hashes AS attachment_hash OUTPUT vt_classification, vt_query_time
This will provide you with the "vt_classification" and "vt_query_time" for your data.
From here, you can build any Scheduled Searches, Reports, or even alerts that you need.
If you are looking to save the results of these searches to an index for audibility, I would suggest using the "collect" command.
Hopefully this helps answer your question.
... View more