VirusTotal Integration

View the GitHub project here or download the latest release here.

Overview

This repo contains a script and a workerside script that will search selected files against the third-party VirusTotal API service. Should results be found, those results will be stored in custom metadata fields on the relevant items. The workerside script can also encrich the properties further with data from virus total.

For more details, refer to the wiki

Note: You must have an internet connection and must supply your own VirusTotal API key in the required variable.

Getting Started

To run the script, you will require an active VirusTotal account and generate an API key, which you can get from VirusTotal. See the wiki for further instructions.

Setup

• Begin by downloading the latest release of this code here.
  • If you intend to run the standard script, download the asset "VirusTotalIntegration.nuixscript.zip".
  • If you intend to run the worker side script, download the asset "VirusTotalWSS.py".

For details on the difference between the scripts, check choosing which script to run on the wiki.

• Each script will require you to edit it and enter the API key VirusTotal provided you at the relevant location. You can also adjust other options in the files as required.

Standard Script

• Extract the folder "VirusTotalIntegration.nuixscript" and its contents into your Nuix scripts directory. In Windows the script directory is likely going to be either of the following:

    %appdata%\Nuix\Scripts - User level script directory
    %programdata%\Nuix\Scripts - System level script directory

• Browse to the extracted directory, and edit the file VirusTotalIntegration.py in a text editor.
• Add your API key from virus total, and modify any settings you wish to before running the script.

See Standard script on the wiki for full details and troubleshooting.

Worker side script

• If you are running as a worker side script, you will just require the file VirusTotalWSS.py
• Edit VirusTotalWSS.py in a text editor.
• Add your API key from virus total, and modify any settings you wish to before running the script.

See Worker side script on the wiki for full details and troubleshooting.

License

Copyright 2019 Nuix

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.