id: virustotal
name: VirusTotal
version: 1.0.0
description: VirusTotal API v3 — reputation lookups for IPs and domains.
category: enrichment

config_schema:
  properties:
    base_url:
      type: string
      description: VirusTotal API v3 base URL
      default: https://www.virustotal.com/api/v3
    api_key:
      type: string
      description: VirusTotal API key
      x-soar-sensitive: true
  required:
    - api_key

auth:
  - id: apikey
    type: api_key
    in: header
    name: x-apikey
    value_template: "{{secret}}"
    secret_field: api_key

commands:
  - id: get_ip_report
    name: Get IP report
    description: Reputation and last-analysis stats for an IP address.
    inputs_schema:
      properties:
        ip:
          type: string
          description: IP address to look up
      required:
        - ip
    outputs_schema:
      properties: {}
    request:
      method: GET
      path: /ip_addresses/{ip}
      auth_ref: apikey

  - id: get_domain_report
    name: Get domain report
    description: Reputation and last-analysis stats for a domain.
    inputs_schema:
      properties:
        domain:
          type: string
          description: Domain to look up
      required:
        - domain
    outputs_schema:
      properties: {}
    request:
      method: GET
      path: /domains/{domain}
      auth_ref: apikey