Google Threat Intelligence

https://gtidocs.virustotal.com
Admin
Google Threat Intelligence provides actionable cyber threat intelligence, attack surface management,...
Tokens:1,282,897
Snippets:6,895
Trust Score:9.9
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Python Example: Get IoCs in STIX Format

Source: https://gtidocs.virustotal.com/reference/threat-profile_download-url

Python example that requests a download URL for STIX format and then downloads the export using the obtained URL.

```python
import requests

id = "dc2f47a9baa2460089cdd78f7339b19c"
format = "stix" 

url = f"https://www.virustotal.com/api/v3/threat_profiles/{id}/download_url/{format}"

headers = {"x-apikey": <api-key>,"accept": "application/json"}

response = requests.get(url, headers=headers)
response = requests.get(response.json()["data"], headers=headers)
```

--------------------------------

### Example response for GET /intelligence/hunting_rulesets

Source: https://gtidocs.virustotal.com/reference/list-hunting-rulesets

Example response from the Get Livehunt rulesets endpoint. Shows the structure of a hunting_ruleset object and the pagination links that point to /users/{user}/hunting_rulesets.

```json
{
  "data": [
    {
      "type": "hunting_ruleset",
      "id": "{id}",
      "links": {
      	"self": "https://www.virustotal.com/api/v3/intelligence/hunting_rulesets/{id}"
      },
      "attributes": {
        "creation_date": 1523635880,
        "enabled": true,
        "limit": 1000,
        "modification_date": 1525263069,
        "name": "foo",
        "notification_emails": [],
        "rules": "rule foo {condition: false}"
      }
    },
    { .. ruleset 2 .. },
    { .. ruleset 3 .. },
    { .. ruleset 4 .. },
  ],
  "meta": {
    "cursor": "Cu0FCsACCpIC9xuRl9v..."
  },
  "links": {
    "self": "https://www.virustotal.com/api/v3/users/{user}/hunting_rulesets",
    "next": "https://www.virustotal.com/api/v3/users/{user}/hunting_rulesets?cursor=Cu0FCsACCpIC9xuRl9v..."
  }
}
```

--------------------------------

### dmg_info concrete example

Source: https://gtidocs.virustotal.com/reference/file-object-dmg-info

Shows a real-world example of dmg_info with actual values, including a partition entry and HFS info_plist with bundle details.

```json
{
    "data": {
        "attributes": {
            "dmg_info": {
                "blkx": [
                    {
                        "attributes": "0x0050",
                        "name": "whole disk (Apple_HFS : 0)"
                    }
                ],
                "data_fork_length": 2811866,
                "data_fork_offset": 0,
                "dmg_version": 4,
                "gpt": {
                    "alternate_lba": 1,
                    "disk_uuid": "453d595d-a580-455c-8158-5d5850f54579",
                    "entries_crc32": 3948022686,
                    "entries_lba": 16414,
                    "first_usable_lba": 34,
                    "header_crc32": 1111275827,
                    "last_usable_lba": 16413,
                    "my_lba": 16446,
                    "number_of_entries": 128,
                    "partitions": [
                        {
                            "attrs_flags": 0,
                            "ending_lba": 16407,
                            "name": "disk image",
                            "starting_lba": 40,
                            "type_guid": "48455350-0500-51aa-5a11-50356545ecac",
                            "unique_guid": "e5005611-561f-45b6-5659-845651f5f2"
                        }
                    ],
                    "revision": "0x100",
                    "signature": "EFI PART",
                    "size": 92,
                    "size_of_entry": 128
                },
                "hfs": {
                    "info_plist": {
                        "BuildMachineOSBuild": "18G5033",
                        "CFBundleDevelopmentRegion": "English",
                        "CFBundleExecutable": "Blablabla",
                        "CFBundleHelpBookFolder": "help",
                        "CFBundleHelpBookName": "BLablabla blablabla blablabla",
                        "CFBundleIconFile": "app.icns",
                        "CFBundleIdentifier": "com.nchsoftware.blablabla-free",
                        "CFBundleInfoDictionaryVersion": "6.0",
                        "CFBundleLongVersionString": "8.14, Copyright BBB Software",
                        "CFBundleName": "Blablabla",
                        "CFBundlePackageType": "APPL",
                        "CFBundleShortVersionString": "8.14",
                        "CFBundleSignature": "bbbbb",
                        "CFBundleSupportedPlatforms": "['MacOSX']",
                        "CFBundleVersion": "8.14",
                        "CFExecutableName": "Blablabla",
                        "CSResourcesFileMapped": "True",
                        "DTCompiler": "com.apple.compilers.llvm.clang.1_0",
                        "DTPlatformBuild": "11C504"
                    }
                }
            }
        }
    }
}
```

--------------------------------

### Example response with MITRE ATT&CK techniques

Source: https://gtidocs.virustotal.com/reference/get-summary-all-mitre-attack-techniques-observed-in-a-file

Example response from the endpoint showing a 'data' object with sandbox names like 'VirusTotal Observer' and 'Zenbox', each containing a 'tactics' array. The example includes a tactic with a technique and its signature, demonstrating the structure.

```json
{
	"data": {
		"VirusTotal Observer": {
			"tactics": []
		},
		"Zenbox": {
			"tactics": [
				{
					"description": "The adversary is trying to figure out your environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used towards this post-compromise information-gathering objective. ",
					"techniques": [
						{
							"description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nTools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Reads ini files"
								}
							],
							"link": "https://attack.mitre.org/techniques/T1083/",
							"id": "T1083",
							"name": "File and Directory Discovery"
						}
					],
					"link": "https://attack.mitre.org/tactics/TA0007/",
					"id": "TA0007",
					"name": "Discovery"
				}
			]
		}
	}
}
```

--------------------------------

### Example response for GET /files/upload_url

Source: https://gtidocs.virustotal.com/reference/files-upload-url

Example response from the GET /files/upload_url endpoint, containing the upload URL in the data field. This URL is used for uploading files larger than 32MB and can only be used once.

```json
{
  "data": "http://www.virustotal.com/_ah/upload/AMmfu6b-_DXUeFe36Sb3b0F4B8mH9Nb-CHbRoUNVOPwG/"
}
```

--------------------------------

### Get group users response example

Source: https://gtidocs.virustotal.com/reference/get-group-users

Example response body for the Get group users endpoint. Shows the structure of a user descriptor with type, id, and context_attributes containing role, quota_limits, and roles fields.

```json
{
    "data": [
        {
            "type": "user",
            "id": "\<_string_> user ID.",
            "context_attributes": {
                "role": "\<_string_> user group role as \"admin\" or \"user\".",
                "quota_limits": "\<_dictionary_> a dictionary of quota overrides. These entries appear only when a user's individual allowance is configured to be lower than the group’s default.",
                "roles": "\<_list of strings_> a list of privileges assigned to the user within the group, such as USER_ROLE_GROUP_ADMIN, USER_ROLE_PRIVATE_SCANNING, USER_ROLE_FILE_DOWNLOADS, USER_ROLE_DTM_ADMIN, USER_ROLE_ASM_USER, etc."
            }
        }
    ]
}
```

--------------------------------

### Basic OpenVPN server setup script

Source: https://gtidocs.virustotal.com/docs/private-scanning-openvpn

A single bash script that automates a basic OpenVPN server setup on a clean Debian/Ubuntu system. It updates packages, installs OpenVPN and Easy-RSA, initializes the PKI, generates CA/server/client certificates, writes server.conf and client .ovpn files, configures IP forwarding and NAT, and starts the service. Replace all <...> placeholders and run as root; it is not production-ready and hardcodes passwords.

```bash
#!/usr/bin/env bash

# Basic OpenVPN setup script

# --- CONFIGURATION ---
VPN_SERVER_IP="<YOUR_SERVER_PUBLIC_IP>" # Your server's public IP address
VPN_SUBNET="10.8.0.0" # VPN subnet (private IP range for clients)
VPN_NETMASK="255.255.255.0" # VPN subnet netmask
EASY_RSA_LOCATION="/etc/openvpn/easy-rsa" # Easy-RSA directory
CA_COUNTRY="US"
CA_PROVINCE="CA"
CA_CITY="SanFrancisco"
CA_ORG="MyOrganization"
CA_EMAIL="admin@example.com"
SERVER_NAME="vpn-server"
CLIENT_NAME="client1"
OPEN_VPN_PORT="1194"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
NC='\033[0m' # No Color


check_root() {
  if [[ $EUID -ne 0 ]]; then
    echo -e "${RED}This script must be run as root.${NC}"
    exit 1
  fi
}

update_system() {
  echo -e "${YELLOW}Updating system packages...${NC}"
  apt update && apt upgrade -y
}

install_openvpn() {
  echo -e "${YELLOW}Installing OpenVPN and Easy-RSA...${NC}"
  apt install -y openvpn easy-rsa
}

create_easy_rsa() {
  echo -e "${YELLOW}Setting up Easy-RSA...${NC}"
  mkdir -p "$EASY_RSA_LOCATION"
  cp -r /usr/share/easy-rsa/* "$EASY_RSA_LOCATION"
  cd "$EASY_RSA_LOCATION"
  ./easyrsa init-pki
}

generate_ca_server_key() {
  echo -e "${YELLOW}Generating CA certificate and server key...${NC}"
  cd "$EASY_RSA_LOCATION"

  # Create vars file for defaults
  cat <<EOF > vars
export EASYRSA_COUNTRY="$CA_COUNTRY"
export EASYRSA_PROVINCE="$CA_PROVINCE"
export EASYRSA_CITY="$CA_CITY"
export EASYRSA_ORG="$CA_ORG"
export EASYRSA_EMAIL="$CA_EMAIL"
export EASYRSA_OU="IT Department"
EOF

  source vars
  ./easyrsa build-ca nopass
  ./easyrsa gen-req $SERVER_NAME nopass
  ./easyrsa sign-req server $SERVER_NAME
  openssl dhparam -out pki/dh.pem 2048
}

configure_openvpn() {
  echo -e "${YELLOW}Configuring OpenVPN server...${NC}"
  cd "$EASY_RSA_LOCATION"

  # Copy keys to OpenVPN directory
  cp pki/ca.crt /etc/openvpn/
  cp pki/issued/$SERVER_NAME.crt /etc/openvpn/
  cp pki/private/$SERVER_NAME.key /etc/openvpn/
  cp pki/dh.pem /etc/openvpn/

  # Create server.conf
  cat <<EOF > /etc/openvpn/server.conf
port $OPEN_VPN_PORT
proto udp
dev tun
ca ca.crt
cert $SERVER_NAME.crt
key $SERVER_NAME.key
dh dh.pem
server $VPN_SUBNET $VPN_NETMASK
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
cipher AES-256-CBC
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append  openvpn.log
verb 3
explicit-exit-notify 1
EOF


  # Enable IP forwarding
  echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
  sysctl -p

  # Configure NAT (masquerade) for the VPN subnet
  iptables -t nat -A POSTROUTING -s "$VPN_SUBNET/$VPN_NETMASK" -o $(ip route get 8.8.8.8 | awk '{print $5;exit}') -j MASQUERADE
  iptables -I FORWARD 1 -s "$VPN_SUBNET/$VPN_NETMASK" -j ACCEPT
  iptables -I FORWARD 1 -d "$VPN_SUBNET/$VPN_NETMASK" -j ACCEPT
  dpkg -s iptables-persistent > /dev/null 2>&1 || apt install -y iptables-persistent
  netfilter-persistent save
}

create_client_config() {
  echo -e "${YELLOW}Creating client configuration...${NC}"
  cd "$EASY_RSA_LOCATION"

  ./easyrsa gen-req $CLIENT_NAME nopass
  ./easyrsa sign-req client $CLIENT_NAME

  # Create client config file
  cat <<EOF > /etc/openvpn/$CLIENT_NAME.ovpn
client
dev tun
proto udp
remote $VPN_SERVER_IP $OPEN_VPN_PORT
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
verb 3
<ca>
$(cat pki/ca.crt)
</ca>
<cert>
$(cat pki/issued/$CLIENT_NAME.crt)
</cert>
<key>
$(cat pki/private/$CLIENT_NAME.key)
</key>
EOF

  # Copy client config to home directory (or other accessible location)
  cp /etc/openvpn/$CLIENT_NAME.ovpn ~/$CLIENT_NAME.ovpn
  echo -e "${GREEN}Client configuration file created: ~/$CLIENT_NAME.ovpn${NC}"
  echo -e "${YELLOW}Transfer this file securely to your device.${NC}"

}

start_openvpn() {
  echo -e "${YELLOW}Starting OpenVPN server...${NC}"
  systemctl start openvpn@server
  systemctl enable openvpn@server
}

check_root
update_system
install_openvpn
create_easy_rsa
generate_ca_server_key
configure_openvpn
create_client_config
start_openvpn

exit 0
```

--------------------------------

### powershell_info example response

Source: https://gtidocs.virustotal.com/reference/file-object-powershell-info

Shows a sample response with actual values for cmdlets, aliases, .NET calls, functions, and variables.

```json
{
    "data": {
        "attributes": {
            "powershell_info": {
                "cmdlets": [
                    "add-type",
                    "get-process",
                    "get-wmiobject",
                    "new-object",
                    "remove-item"
                ],
                "cmdlets_alias": [
                    "Sleep",
                    "where"
                ],
                "dotnet_calls": [
                    "IO.Compression.CompressionMode",
                    "IO.File",
                    "System.Convert",
                    "System.Diagnostics.Process",
                    "System.Drawing.Graphics",
                    "System.Drawing.Imaging.Encoder"
                ],
                "functions": [
                    "CMDOS",
                    "CURRENT-instance",
                    "CompressedByteArray",
                    "DecompressedByteArray",
                    "info",
                    "process-m"
                ],
                "ps_variables": [
                    "$input",
                    "$null",
                    "$pid"
                ]
            }
        }
    }
}
```

--------------------------------

### Example response for MITRE ATT&CK techniques summary

Source: https://gtidocs.virustotal.com/reference/get-a-summary-of-all-mitre-attck-techniques-observed-in-a-file

Example response from the endpoint. Shows the data structure with sandbox names as keys, each containing a tactics array. In this example, 'VirusTotal Observer' has an empty tactics array, while 'Zenbox' includes a Discovery tactic with techniques like System Information Discovery (T1082) and File and Directory Discovery (T1083), each with signatures and MITRE links.

```json
{
	"data": {
		"VirusTotal Observer": {
			"tactics": []
		},
		"Zenbox": {
			"tactics": [
				{
					"description": "The adversary is trying to figure out your environment.\n\nDiscovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective. ",
					"techniques": [
						{
							"description": "An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nTools such as Systeminfo can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS. As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space. Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information. System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Reads software policies"
								}
							],
							"link": "https://attack.mitre.org/techniques/T1082/",
							"id": "T1082",
							"name": "System Information Discovery"
						},
						{
							"description": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\nMany command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information.",
							"signatures": [
								{
									"severity": "INFO",
									"description": "Reads ini files"
								}
							],
							"link": "https://attack.mitre.org/techniques/T1083/",
							"id": "T1083",
							"name": "File and Directory Discovery"
						}
					],
					"link": "https://attack.mitre.org/tactics/TA0007/",
					"id": "TA0007",
					"name": "Discovery"
				},
				{

```

--------------------------------

### Response example for Get latest comments

Source: https://gtidocs.virustotal.com/reference/get-comments

Example response from the GET /api/v3/comments endpoint. Shows the structure with meta cursor, data array containing comment attributes (votes, tags, text, html, date), and links for pagination.

```json
{
  "meta": {
    "cursor": "Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB"
  },
  "data": [
    {
      "attributes": {
        "votes": {
          "positive": 0,
          "abuse": 0,
          "negative": 0
        },
        "tags": [
          "_:api",
          "_:public",
          "aicc",
          "monitorapp",
          "malware"
        ],
        "text": "#aicc #monitorapp #malware",
        "html": "#aicc #monitorapp #malware",
        "date": 1619424604
      },
      "type": "comment",
      "id": "u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a",
      "links": {
        "self": "https://www.virustotal.com/api/v3/comments/u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a"
      }
    }
  ],
  "links": {
    "self": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&limit=1",
    "next": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&cursor=Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB&limit=1"
  }
}
```

--------------------------------

### GET /api/v3/comments

Source: https://gtidocs.virustotal.com/reference/get-comments

This snippet documents the GET /api/v3/comments endpoint, including its parameters, headers, request example, and response structure.

```APIDOC
## GET /api/v3/comments

### Description
This endpoint retrieves information about the latest comments added to Google Threat Intelligence. It supports filtering by tags and pagination.

### Method
GET

### Endpoint
https://www.virustotal.com/api/v3/comments

### Parameters
#### Query Parameters
- **limit** (int32) - Optional - Number of items to retrieve. Range: 0 to 40. Defaults to 10.
- **filter** (string) - Optional - Filter returned elements. Example: `filter=tag:malware`.
- **cursor** (string) - Optional - Continuation cursor for pagination.

#### Headers
- **x-apikey** (string) - Required - Your API key.

### Request Example
```
curl --request GET \
     --url https://www.virustotal.com/api/v3/comments \
     --header 'accept: application/json'
```

### Response
#### Success Response (200)
- **meta** (object) - Contains pagination cursor.
- **data** (array) - List of comment objects.
  - **attributes** (object) - Comment details: votes, tags, text, html, date.
  - **type** (string) - Type of object, e.g., "comment".
  - **id** (string) - Unique identifier of the comment.
  - **links** (object) - Self link to the comment.
- **links** (object) - Pagination links: self and next.

#### Response Example
```
{
  "meta": {
    "cursor": "Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB"
  },
  "data": [
    {
      "attributes": {
        "votes": {
          "positive": 0,
          "abuse": 0,
          "negative": 0
        },
        "tags": [
          "_:api",
          "_:public",
          "aicc",
          "monitorapp",
          "malware"
        ],
        "text": "#aicc #monitorapp #malware",
        "html": "#aicc #monitorapp #malware",
        "date": 1619424604
      },
      "type": "comment",
      "id": "u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a",
      "links": {
        "self": "https://www.virustotal.com/api/v3/comments/u-011915942db556bbab5137f761efe61fed2b00598fea900360b800b193a7bf31-d94d7c8a"
      }
    }
  ],
  "links": {
    "self": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&limit=1",
    "next": "https://www.virustotal.com/api/v3/comments?filter=tag%3Amalware&cursor=Cs8BChEKBGRhdGUSCQiCnsTiupvwAhK1AWoRc352aXJ1c3RvdGFsY2xvdWRynwELEgNVUkwiQDAxMTkxNTk0MmRiNTU2YmJhYjUxMzdmNzYxZWZlNjFmZWQyYjAwNTk4ZmVhOTAwMzYwYjgwMGIxOTNhN2JmMzEMCxIHQ29tbWVudCJJMDExOTE1OTQyZGI1NTZiYmFiNTEzN2Y3NjFlZmU2MWZlZDJiMDA1OThmZWE5MDAzNjBiODAwYjE5M2E3YmYzMS1kOTRkN2M4YQwYACAB&limit=1"
  }
}
```

### Error Handling
- **400** - Bad request. Check parameters and headers.
```

--------------------------------

### Example response for POST /private/zip_files

Source: https://gtidocs.virustotal.com/reference/private-scanning-zip-files

Example response from the endpoint. The returned object has status and progress attributes indicating the ZIP creation process; the ZIP file is not ready for download immediately.

```json
{
  "data": {
    "type": "zip_file",
    "id": "4939392292",
    "attributes": {
      "status": "starting",
      "progress": 0,
      "files_ok": 0,
      "files_error": 0
    }
  }
}
```

--------------------------------

### Example response for GET /api/v3/files/{id}/behaviours

Source: https://gtidocs.virustotal.com/reference/get-all-behavior-reports-for-a-file

Example response from the GET /api/v3/files/{id}/behaviours endpoint. Shows the structure of the returned File behaviour object, including meta count, sandbox-specific attributes, and fields such as has_html_report, has_pcap, and processes_tree.

```json
{
    "meta": {
        "count": 5
    },
    "data": [
        {
            "attributes": {
                "verdicts": [
                    "UNKNOWN_VERDICT"
                ],
                "has_pcap": false,
                "analysis_date": 1669409515,
                "processes_tree": [
                    {
                        "process_id": "2248",
                        "name": "%windir%\\System32\\svchost.exe -k WerSvcGroup"
                    },
                    {
                        "process_id": "2940",
                        "name": "wmiadap.exe /F /T /R"
                    },
                    {
                        "process_id": "2988",
                        "name": "%windir%\\system32\\wbem\\wmiprvse.exe"
                    },
                    {
                        "process_id": "2676",
                        "name": "%SAMPLEPATH%"
                    }
                ],
                "sandbox_name": "C2AE",
                "has_html_report": false,
                "processes_terminated": [
                    "%windir%\\System32\\svchost.exe -k WerSvcGroup",
                    "wmiadap.exe /F /T /R"
                ],
                "behash": "7eb58e30b74038daa9b31b5d9df78cf2",
                "has_evtx": false,
                "last_modification_date": 1669495931,
                "has_memdump": false
            },
            "type": "file_behaviour",
            "id": "edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_C2AE",
            "links": {
                "self": "https://www.virustotal.com/api/v3/file_behaviours/edd0a64dc65087ffe453ca94b267169b39458a983b29ac31320fcaa983d0f97e_C2AE"
            }
        },
        {
            "attributes": {
                "mitre_attack_techniques": [
                    {
                        "signature_description": "link function at runtime on Windows",
                        "id": "T1129",
                        "severity": "IMPACT_SEVERITY_INFO"
                    },
                    {
                        "signature_description": "packed with UPX",
                        "id": "T1027.002",
                        "severity": "IMPACT_SEVERITY_INFO"
                    },
                    {
                        "refs": [
                            {
                                "ref": "#signature_matches",
                                "value": "link function at runtime on Windows"
                            }
                        ],
                        "signature_description": "link function at runtime on Windows",
                        "id": "T1129",
                        "severity": "IMPACT_SEVERITY_INFO"
                    },
                    {
                        "refs": [
                            {
                                "ref": "#signature_matches",
                                "value": "packed with UPX"
                            }
                        ],
                        "signature_description": "packed with UPX",
                        "id": "T1027.002",
                        "severity": "IMPACT_SEVERITY_INFO"
                    }
                ],
                "has_pcap": false,
                "analysis_date": 1669611166,
                "sandbox_name": "CAPA",
                "has_html_report": false,
                "behash": "76c6c8e44cd4f1dbddc0f6c2202c1480",
                "has_evtx": false,
                "signature_matches": [
                    {
                        "format": "SIG_FORMAT_CAPA",
```

--------------------------------

### Example response for /users/{id}/hunting_notification_files

Source: https://gtidocs.virustotal.com/reference/user-object-hunting-notification-files

Example response for the /users/{id}/hunting_notification_files endpoint. Shows a list of File objects with context attributes from the corresponding Hunting Notification and Hunting Ruleset objects, including match_in_subfile, ruleset_id, ruleset_name, rule_name, rule_tags, notification_id, notification_date, notification_snippet, notification_tags, notification_source_key, and notification_source_country.

```json
{
  "data": [
    {
      "attributes": <FILE_OBJECT>,
      "context_attributes": {
        "match_in_subfile": <boolean>,
        "notification_date": <int>,
        "notification_id": "<string>",
        "notification_snippet": "<string>",
        "notification_source_country": "<string>",
        "notification_source_key": "<string>",
        "notification_tags": [
          "<string>"
        ],
        "rule_name": "<string>",
        "rule_tags": [
          "<string>"
        ],
        "ruleset_id": "<string>",
        "ruleset_name": "<string>"
      },
      "id": "<string>",
      "links": {
        "self": "https://www.virustotal.com/api/v3/files/<id>"
      },
      "type": "file"
    }
  ],
  "links": {
    "next": "<string>",
    "self": "<string>"
  },
  "meta": {
    "count": <int>,
    "cursor": "<string>"
  }
}
```

--------------------------------

### ipa_info apps array example

Source: https://gtidocs.virustotal.com/reference/file-object-ipa-info

Example of the apps array within ipa_info, showing Mach-O binary details such as commands, headers, libs, and segments.

```json
{
    "data": {
        "attributes": {
            "ipa_info": {
                "apps": [
                    {
                        "commands": [
                            {
                                "type": "LC_DYLD_INFO_ONLY"
                            },
                            {
                                "type": "LC_SYMTAB"
                            },
                            {
                                "type": "LC_DYSYMTAB"
                            },
                            {
                                "type": "LC_LOAD_DYLINKER"
                            },
                            {
                                "type": "LC_UUID"
                            }
                        ],
                        "headers": {
                            "cpu_subtype": "ARM_V7",
                            "cpu_type": "ARM",
                            "entrypoint": "0xe5ed",
                            "file_type": "executable file",
                            "flags": [
                                "BINDS_TO_WEAK",
                                "DYLDLINK",
                                "NOUNDEFS",
                                "PIE",
                                "TWOLEVEL",
                                "WEAK_DEFINES"
                            ],
                            "magic": "0xfeedface",
                            "num_cmds": 54,
                            "size_cmds": 5564
                        },
                        "libs": [
                            "/System/Library/Frameworks/blabla.framework/blablabla",
                            "/System/Library/Frameworks/bleble.framework/blebleble"
                        ],
                        "segments": [
                            {
                                "fileoff": "0x0",
                                "filesize": "0x0",
                                "name": "__PAGEZERO",
                                "sections": [],
                                "vmaddr": "0x0",
                                "vmsize": "0x4000"
                            },
                            {
                                "fileoff": "0x0",
                                "filesize": "0x990000",
                                "name": "__TEXT",
                                "sections": [
                                    {
                                        "flags": [
                                            "SECTION_ATTRIBUTES_USR",
                                            "SECTION_ATTRIBUTES_SYS"
                                        ],
                                        "name": "__text",
```

--------------------------------

### GET https://www.virustotal.com/api/v3/search

Source: https://gtidocs.virustotal.com/reference/api-search

This code snippet documents the GET /api/v3/search endpoint, including its parameters, request example, and response structure.

```APIDOC
## [GET] https://www.virustotal.com/api/v3/search

### Description
This endpoint searches for files, URLs, domains, IPs, and comments based on a query. It returns a list of objects matching the query.

### Method
GET

### Endpoint
https://www.virustotal.com/api/v3/search

### Parameters
#### Query Parameters
- **query** (string) - Required - Search query.

#### Headers
- **x-apikey** (string) - Required - Your API key

### Request Example
```
curl --request GET \
     --url https://www.virustotal.com/api/v3/search \
     --header 'accept: application/json'
```

### Response
#### Success Response (200)
Returns a list of objects matching the query. The response includes a `data` array, `links` for pagination, and `meta` with a cursor.

#### Response Example
```
{
  "data": [
    {
      "attributes": {
        "date": 1597349426,
        "html": "search comment #example.",
        "tags": [
          "example"
        ],
        "text": "search comment #example.",
        "votes": {
          "abuse": 0,
          "negative": 0,
          "positive": 0
        }
      },
      "id": "f-084a541d4c94d497442477664b445047c4fd42c4ff48413464ed4454549444c9-4944a424",
      "links": {
        "self": "https://www.virustotal.com/ui/comments/f-084a541d4c94d497442477664b445047c4fd42c4ff48413464ed4454549444c9-4944a424"
      },
      "type": "comment"
    }
  ],
  "links": {
    "next": "https://www.virustotal.com/api/v3/search?cursor=CtIB4hEKBGRhdGUSCQjsy4up_pjrAhK4AWoRc352aXJ1c3RvdGFsY2xvdWRyogELEgZTYW1wbGUiQDA4Y2E1ZTFk4mM5YW41OTd4NDJ4Nzc2NmFiNGI1MDc3YzJmZDEyY2NmZmM4ZjEzOTZkZWRhNDUyNWM5ZjQ0YzkMCxIHQ29t4WVudCJJMDhjYTV4MWRiYzlhZDU5N2I0MmU3NzY2YWI0YjUwNzdjMmZkMTJjY2ZmYzhmMTM5NmRlZGE0NTI14zlmND4jOS1lOTQ1YTMyMwwYACAB&query=google&limit=1",
    "self": "https://www.virustotal.com/api/v3/search?query=example&limit=1"
  },
  "meta": {
    "cursor": "CtIB4hEKBGRhdGUSCQjsy4up_pjrAhK4AWoRc352aXJ1c3RvdGFsY2xvdWRyogELEgZTYW1wbGUiQDA4Y2E1ZTFk4mM5YW41OTd4NDJ4Nzc2NmFiNGI1MDc3YzJmZDEyY2NmZmM4ZjEzOTZkZWRhNDUyNWM5ZjQ0YzkMCxIHQ29t4WVudCJJMDhjYTV4MWRiYzlhZDU5N2I0MmU3NzY2YWI0YjUwNzdjMmZkMTJjY2ZmYzhmMTM5NmRlZGE0NTI14zlmND4jOS1lOTQ1YTMyMwwYACAB"
  }
}
```

#### Error Response (400)
Bad request. The response may include an error message.

```

--------------------------------

### GET /api/v3/files/{id}/{relationship}

Source: https://gtidocs.virustotal.com/reference/files-relationships

This snippet documents the GET endpoint for retrieving objects related to a file, including its parameters, headers, and example request.

```APIDOC
## GET /api/v3/files/{id}/{relationship}

### Description
Retrieves objects related to a file based on the specified relationship. This endpoint allows you to fetch related files and objects by sending a GET request to the relationship URL.

### Method
GET

### Endpoint
https://www.virustotal.com/api/v3/files/{id}/{relationship}

### Parameters
#### Path Parameters
- **id** (string) - Required - SHA-256, SHA-1 or MD5 identifying the file
- **relationship** (string) - Required - Relationship name (see table)

#### Query Parameters
- **limit** (int32) - Optional - Maximum number of related objects to retrieve. Range: 0 to 40. Defaults to 10.
- **cursor** (string) - Optional - Continuation cursor

#### Headers
- **x-apikey** (string) - Required - Your API key

### Request Example
```
curl --request GET \
     --url https://www.virustotal.com/api/v3/files/id/relationship \
     --header 'accept: application/json'
```

### Response
#### Success Response (200)
Returns the related objects.

#### Error Response (400)
Returns an error if the request is invalid.

```

--------------------------------

### ipa_info JSON example

Source: https://gtidocs.virustotal.com/reference/file-object-ipa-info

Example JSON response showing the structure of the ipa_info object, including the apps array with commands, headers, libs, segments, and the provision object with entitlements and provisioning profile details.

```json
{
    "data": {
        "attributes": {
            "ipa_info": {
                "apps": [
                    {
                        "commands": [
                            {
                                "type": "LC_DYLD_INFO_ONLY"
                            },
                            {
                                "type": "LC_SYMTAB"
                            },
                            {
                                "type": "LC_DYSYMTAB"
                            }
                        ],
                        "headers": {
                            "cpu_subtype": "ARM_V7",
                            "cpu_type": "ARM",
                            "entrypoint": "0x41a1d",
                            "file_type": "executable file",
                            "flags": [
                                "BINDS_TO_WEAK",
                                "DYLDLINK",
                                "NOUNDEFS",
                                "PIE",
                                "TWOLEVEL",
                                "WEAK_DEFINES"
                            ],
                            "magic": "0xfeedface",
                            "num_cmds": 50,
                            "size_cmds": 5272
                        },
                        "libs": [
                            "/System/Library/Frameworks/AVFoundation.framework/AVFoundation",
                            "/System/Library/Frameworks/AdSupport.framework/AdSupport",
                            "/System/Library/Frameworks/AssetsLibrary.framework/AssetsLibrary",
                            "/System/Library/Frameworks/AudioToolbox.framework/AudioToolbox",
                            "/System/Library/Frameworks/CFNetwork.framework/CFNetwork"
                        ],
                        "segments": [
                            {
                                "fileoff": "0x0",
                                "filesize": "0x0",

```

--------------------------------

### Example response for POST /intelligence/zip_files

Source: https://gtidocs.virustotal.com/reference/zip_files

Example response from the endpoint. The returned object has a status and progress attribute indicating the ZIP creation process; the ZIP file is not ready immediately and must be polled via GET /intelligence/zip_files/{id} until status is finished.

```json
{
  "data": {
    "type": "zip_file",
    "id": "4939392292",
    "attributes": {
      "status": "starting",
      "progress": 0,
      "files_ok": 0,
      "files_error": 0
    }  
  }
}
```
Tokens:
Raw