VERISCO Alertio Investigate

Threat intelligence

Check any file hash, IP address, domain or URL against VirusTotal, see what your own fleet knows about it, and keep a record of every lookup.

Open Threat Intelligence in the Investigate group.

The Threat Intelligence page: a file hash entered in the lookup field, the history of previous lookups, and the result, flagged malicious by 66 of 68 engines, with the file details. — A lookup. The verdict, the engine counts and the file details, with every earlier lookup in the history above.

Looking something up#

Paste a file hash, an IP address, a domain or a URL into the field. Alertio recognises the type and shows it beside the field; Look up becomes available once the type is valid.

The result gives one verdict, with the number of engines behind each outcome:

Verdict	Means
Malicious	Engines flag it as harmful. Treat it as a live threat and check your fleet's exposure.
Suspicious	Some engines are wary of it. Investigate before trusting it.
Harmless	Engines consider it safe.
Undetected	No engine has an opinion. Absence of evidence, not evidence of safety.

Alongside the verdict you see what is known about the observable (for a file: its name, type, size and hashes; for any observable: its community reputation) and, where it appears in your own alerts, those alerts, ready to open.

Rescan asks for a fresh analysis. Open in VirusTotal opens the full public report.

Without leaving an investigation#

The same lookup runs from the Enrichment tab of an alert, so you can check the addresses, domains and hashes in it without leaving the panel. See Alerts.

History#

Every lookup is recorded with who made it and when, and the same observable looked up again is kept as a new entry, so you can see a verdict change over time. The range control sets the period; View full history opens the complete list.

Setting it up#

Threat intelligence needs a VirusTotal API key. An administrator enters it in Settings, under Integrations, then selects Test connection. The key is encrypted at rest and only ever used on the server. See Settings.

Public API limits

A free VirusTotal key allows a small number of lookups per minute. If lookups start failing during a busy investigation, wait a minute, or use a key with a higher allowance.

Something missing or wrong on this page? Tell us and we will fix it.