feat(virustotal): complete v3 command coverage (script-based)

Expand the VirusTotal integration from 3 form-based commands to 15 script-based commands covering the v3 API: ip/domain/file/url reputation (existing get_ip_report/get_domain_report ids preserved), file rescan, URL scan, analysis-get, intelligence search, file sandbox (behaviour) report, passive DNS, and comments get/add/get-by-id/delete. Scripts handle URL base64 ids, form-encoded URL submission and comment resource routing. File-content upload (file-scan) and private scanning are intentionally omitted: they require an XSOAR-style war-room file entry system Riposte does not have. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-27 15:53:22 +02:00
parent 70dffb3b0a
commit 934f2c52d7
16 changed files with 753 additions and 35 deletions
@@ -1,8 +1,8 @@
 id: virustotal
 name: VirusTotal
-version: 1.0.2
-description: VirusTotal API v3 — reputation lookups for IPs and domains.
-changelog: "1.0.2 — Re-publish to regenerate form-based command scripts (fixes 'script not found' on install). 1.0.1 — Added test_connection for the instance Test button. 1.0.0 — Initial release: IP and domain reputation lookups."
+version: 1.1.0
+description: "VirusTotal API v3 — reputation for IPs, domains, files and URLs, plus rescan/scan, intelligence search, analysis results, file behaviour (sandbox) reports, passive DNS and comments."
+changelog: "1.1.0 — Full v3 coverage: added file and URL reputation, file rescan, URL scan, search, analysis-get, file sandbox (behaviour) report, passive DNS and comments (get/add/get-by-id/delete). Commands are now script-based (URL base64, form-encoded scans, comment resource routing). 1.0.2 — Re-publish to regenerate form-based command scripts. 1.0.1 — Added test_connection. 1.0.0 — Initial release: IP and domain reputation lookups."
 category: enrichment

 config_schema:
@@ -27,40 +27,158 @@ auth:
    secret_field: api_key

 commands:
+  # ── Reputation ──────────────────────────────────────────────────────────────
  - id: get_ip_report
-    name: Get IP report
-    description: Reputation and last-analysis stats for an IP address.
+    name: virustotal-ip
+    description: "Reputation and last-analysis stats for an IP address."
+    risk: read
    inputs_schema:
      properties:
-        ip:
-          type: string
-          description: IP address to look up
-      required:
-        - ip
-    outputs_schema:
-      properties: {}
-    request:
-      method: GET
-      path: /ip_addresses/{ip}
-      auth_ref: apikey
+        ip: { type: string, description: "IP address to look up" }
+      required: [ip]
+    outputs_schema: { properties: {} }

  - id: get_domain_report
-    name: Get domain report
-    description: Reputation and last-analysis stats for a domain.
+    name: virustotal-domain
+    description: "Reputation and last-analysis stats for a domain."
+    risk: read
    inputs_schema:
      properties:
-        domain:
-          type: string
-          description: Domain to look up
-      required:
-        - domain
-    outputs_schema:
-      properties: {}
-    request:
-      method: GET
-      path: /domains/{domain}
-      auth_ref: apikey
+        domain: { type: string, description: "Domain to look up" }
+      required: [domain]
+    outputs_schema: { properties: {} }

+  - id: file
+    name: virustotal-file
+    description: "Reputation and analysis for a file hash (MD5, SHA1, SHA256)."
+    risk: read
+    inputs_schema:
+      properties:
+        file: { type: string, description: "File hash" }
+      required: [file]
+    outputs_schema: { properties: {} }
+
+  - id: url
+    name: virustotal-url
+    description: "Reputation and analysis for a URL (base64-id resolved automatically)."
+    risk: read
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL to look up" }
+      required: [url]
+    outputs_schema: { properties: {} }
+
+  # ── Scans ───────────────────────────────────────────────────────────────────
+  - id: file_rescan
+    name: virustotal-file-rescan
+    description: "Re-analyse an already-submitted file by hash. Use analysis_get to fetch results."
+    risk: safe_write
+    inputs_schema:
+      properties:
+        file: { type: string, description: "File hash to rescan" }
+      required: [file]
+    outputs_schema: { properties: {} }
+
+  - id: url_scan
+    name: virustotal-url-scan
+    description: "Submit a URL for scanning. Use analysis_get to fetch results."
+    risk: safe_write
+    inputs_schema:
+      properties:
+        url: { type: string, description: "URL to scan" }
+      required: [url]
+    outputs_schema: { properties: {} }
+
+  - id: analysis_get
+    name: virustotal-analysis-get
+    description: "Get the result of an analysis (from file_rescan or url_scan) by ID."
+    risk: read
+    inputs_schema:
+      properties:
+        id: { type: string, description: "Analysis ID" }
+      required: [id]
+    outputs_schema: { properties: {} }
+
+  # ── Intelligence / relationships ──────────────────────────────────────────
+  - id: search
+    name: virustotal-search
+    description: "Search VirusTotal for a file hash, URL, domain, IP, or tag."
+    risk: read
+    inputs_schema:
+      properties:
+        query: { type: string, description: "Search query" }
+        limit: { type: number, description: "Maximum number of results (default 10)" }
+      required: [query]
+    outputs_schema: { properties: {} }
+
+  - id: file_sandbox_report
+    name: virustotal-file-sandbox-report
+    description: "Retrieve sandbox behaviour reports for a file hash."
+    risk: read
+    inputs_schema:
+      properties:
+        file: { type: string, description: "File hash" }
+        limit: { type: number, description: "Maximum number of reports (default 10)" }
+      required: [file]
+    outputs_schema: { properties: {} }
+
+  - id: passive_dns
+    name: virustotal-passive-dns-data
+    description: "Passive DNS resolutions for an IP address or a domain."
+    risk: read
+    inputs_schema:
+      properties:
+        resource: { type: string, description: "IP address or domain" }
+        limit: { type: number, description: "Maximum number of resolutions (default 10)" }
+      required: [resource]
+    outputs_schema: { properties: {} }
+
+  # ── Comments ──────────────────────────────────────────────────────────────
+  - id: comments_get
+    name: virustotal-comments-get
+    description: "Get comments for an IP, domain, URL or file."
+    risk: read
+    inputs_schema:
+      properties:
+        resource: { type: string, description: "The IP, domain, URL or file hash" }
+        resource_type: { type: string, description: "Resource type: ip, domain, url or file (auto-detected if omitted)" }
+        limit: { type: number, description: "Maximum number of comments (default 10)" }
+      required: [resource]
+    outputs_schema: { properties: {} }
+
+  - id: comments_add
+    name: virustotal-comments-add
+    description: "Add a comment to an IP, domain, URL or file."
+    risk: safe_write
+    inputs_schema:
+      properties:
+        resource: { type: string, description: "The IP, domain, URL or file hash" }
+        resource_type: { type: string, description: "Resource type: ip, domain, url or file (auto-detected if omitted)" }
+        comment: { type: string, description: "Comment text" }
+      required: [resource, comment]
+    outputs_schema: { properties: {} }
+
+  - id: comments_get_by_id
+    name: virustotal-comments-get-by-id
+    description: "Get a single comment by its ID."
+    risk: read
+    inputs_schema:
+      properties:
+        id: { type: string, description: "Comment ID" }
+      required: [id]
+    outputs_schema: { properties: {} }
+
+  - id: comments_delete
+    name: virustotal-comments-delete
+    description: "Delete a comment by its ID."
+    risk: destructive
+    inputs_schema:
+      properties:
+        id: { type: string, description: "Comment ID" }
+      required: [id]
+    outputs_schema: { properties: {} }
+
+  # ── Connectivity test ─────────────────────────────────────────────────────
  - id: test_connection
    name: virustotal-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
@@ -68,9 +186,4 @@ commands:
    inputs_schema:
      properties: {}
      required: []
-    outputs_schema:
-      properties: {}
-    request:
-      method: GET
-      path: /ip_addresses/8.8.8.8
-      auth_ref: apikey
+    outputs_schema: { properties: {} }