VirusTotal playbook – IP enrichment
In our first example, we will utilize VirusTotal to enrich the IP found in the incident.
Before we begin, you will need the following:
- You need to have access to Microsoft Sentinel with appropriate permissions (Microsoft Sentinel Contributor, Logic App Contributor, and permission to assign RBAC controls – Owner or User Access Administrator)
- You need to create a free VirusTotal account and get your API token for connector authentication or utilize a premium account if you have one
- If you don’t have a VirusTotal account, you can create one at this link: https://www.virustotal.com/gui/join-us
- Once you have an account, you will need to get your API key, as shown in the following screenshot:
Figure 6.9 – Access to VirusTotal API key
For our demo, a standard API key is enough, as demonstrated in Figure 6.10. We will need this later to authenticate the API connection in the...
