integration-VirusTotal.yml

commonfields:
  id: VirusTotal
  version: -1
name: VirusTotal
display: VirusTotal
category: Data Enrichment & Threat Intelligence
image: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHgAAAAYCAYAAAAxkDmIAAAH2ElEQVR42u1aaYxTVRRG3ABRdBTXURRRIChBJjPttPPazsgiCLLERpa277WdGWAksqiAuEFUMi4xBqLRgIhAJCCSoIxKDEgUoYJLWJREfxhj0CBCEAiME+T4fW9u67PzynQ6ncVJX3LT9r77zj3nfPd+95zz2snnl+5uQ2KeCpGScMs0LWJ+HvME5ZZOuav1L6chNwOAr5NB9pSjVTSzlecAbhdXQUhucodltwkyATHkJNoa9K0CQKszbXj+cy2aA7hdXO4Jcj3oeqcXIAOUOoCzqNnsoMt92MUE+M8cwO1hJwfkOndEthNkBcxrBZVyYabyig3x5wBuZ5crKFe7wrLN8y/IbxDklgLYZUghGKOmRJcNZJGUDGPIk94KjDNknnpuNn+jf3xb+Kk4LMOh9ybok7JBt/XFUclrPa3kPJcuz9MvWkiKUg7TwtITFL01sZMNeXPECLm4JQAuNORayD/qmyqCOafYjvHXjymdJgIDKtmHz3eHzjBlP9EWAEPX6WUPilBvtrivvJWqD7pq+O0ol/x0ZWKRP+SJyEvOoPTPFGD4KUa9NEPGnhscv+RhBW627OS3fYZ0aQmKJkuYABuyhUo2uG9IBA6knN8cE+Ua08G6DMAzoxAU9m4LgItgD2wbTwYB490PwH9UOn7APne52T+mKT5DYLqnbBr8EJSRmQKMuT/zTTE35ejGV9QkuQKK13hV2sPIGnTdLdsAa7rcDbo7C+Y4iWf6JSuN5z/mAgCoS+O9lOcFvTvKATivBdLZGZDBMFDD4uzqMOQ26D4LbSFpkqyE5uXuaEBrk2QQGMFDe639GOvgrsJzTwGsAGX6/XJ+ikUao2Mx/ws2fujHRcpjBkfLXNh77wDUIBL3A9KHeqMdoL9cIXOMW9mSl7A5LDdC1j1kMezQ+YiXokxzMwaYl2OyXIaH3ifAKldeOzAol2QT4ILR0g1zfEd6AyCPWO/BiL4EHqv7rDskpZazeyUMSYzvgyME3/dhrrOQtQLfj5dW1VOnD06AQwxSPO69Z5UPR1+Evl3Uk85Tc17q1pkiknLr7Va61RWV29gB0HFvl9LnZWs/9FwAOSe9uKdFlSz6MSrfQleHYqNl1K0kYqlBqDmLQzLK55MLeJ7j/inKUccAPzn+IOOYjAFOGByWDXGQ+Z192QJYnT/PqnM4Zg3qoPCjSuG93JnnAhjz7FV5N4H8lM6G8xZSV+6glADrstsKMMbMpC6UVxKSccVgGMxn4Pdy7qI0AaaOFQCTwJ2gHc6wDAYLDOXRp2zab24gpJMAvBrjfjX1R3yBMc/hdzVZgxuKdQr83sSYA3KDjAHw/Wel5/JmAcyLzsXD6+gIKk3qpnJZBLgABtSx0RHsI9BQ9Eul8NPsawxgzGcbrGlwdro7GHLeKTWPBPtaQDoAY9d1wfdv2AcGmmMdjl15A+4dUXQ8xhLcxuhb+HXYf8RD/iBDLm+QgUSkUsUuH8X7MgY4nwDrspZKseH7Eq6sbAFMI6DUdnNFItRXyjpBb2cA+mlXVO5gX2MUzR3gDojWHIB5VlI25j0KmUtwNIxgcNcUgHHu94Hdf0FGbZLuuDAeRSXaCtnzLQDvIsCk5VRTcXEgRXORWYgBGRWfHzYLYHUmmRRNB8K51aSDbBc6XAho1LnyvaLOF9UK3cz50gWYZ3VzAGYtADavJ5twfhV7HGQA5auS7ukAjBRpIHXBvH8giOuVHNihf4tazM80BjDHQ6cgFvsO6HEcTdBq2aA3barJGGB1Rmyk4zVSikWhbAPMAMaNsXDM36SuEgCmghud91sCYAYwPAYSAFsuHhW4NxftCwZcar7H0gEY8voz4EM7DXCSd3DnBFuFZEZjAGPMEGYZ0OEYCzy0D323Q0ZQxUSZ7WCmDazI0Mlq5y5o6VIllN0IpTnXXg30ht+HSI9ZBHidTQC5LwFw6kraWzyX6Y80KToPdv9iAqbLxORqIe79nqwr+nab44My3DoeTPIwixcsHSenlxkCrAodumxOgKvL461Ri8ackz2ktoiK2OFY9mcB4KmsLnGMAwEd7LkV3x9g/sq54ETrGTwe94cRCAaXpFjMt00tkMVNiKJfUVHufkdISgr80gPxQV/IWK1y5p3Fs6SrBeCt9DcjfzBnPnbyXUMqpQd0n6BA+4p5L2Mfp5kn871BBhSt+aUnq0oWcOe01ssGFiSg3CHLkTAsBcBryqpMQ+ZZougf+BzTGruaNymOxqszrE6t/gOQccpDxxoyUjl6gwLmBNphtFrI5SLYY1s5qw8Q91AfBmWJ/H6iXMXdRRDir03RzngJbkT2JVM30ypSMfViYAmZZ5grq1pETOlUi3tHKAuyP6Fe/LQAHKMe8OMY+0BnHOgDq1WBe5opR2u/TWJeCCNms2LDHWQ3hjTmAXUxvYpH4aw2wXEzCyeoXNUGZNIcjK+B/JXMJ+/kMaRLiFUvRLu94pUnd1Smo+91vtdmnsk8mrSbssiPXUZ9WBFLDuJYsoReiykLn8tgX7QoJFfayWF0jHmXYv5VzIVZqYsvfObAwGQNdH+VjMCIWoPe0HesxS9+6oHjtbft60Ie/lxhZmoSkgD7c68LO8oL/7DsUDv3sBMcnnvh30GuQpTfGCSQ+xlw4PtP2PorSCm5v+x0hD/dGdY/3cUj2Nyf7v73l/m3WV125v422zGvfwBqKBTHeNI1tAAAAABJRU5ErkJggg==
description: Analyze suspicious hashes, URLs, domains and IP addresses
detaileddescription: |-
  Don’t have a Virustotal key?
  Register at https://www.virustotal.com
  After signing in click on your user name (top right) and go to “My API Key”

  Indicators thresholds:
  Configure the default threshold for each indicator type in the instance settings.
  Note that it is also possible to specify the threshold when runing the command.
  Indicators with positive results equal or bigger than the threshold will be considered malicious.
  Indicators with positive results equal or bigger than half of the threshold value, and lower than the threshold, will be considered suspicious.
configuration:
- display: Server URL (e.g. https://192.168.0.1)
  name: Server
  defaultvalue: https://www.virustotal.com/vtapi/v2/
  type: 0
  required: true
- display: API Key
  name: APIKey
  defaultvalue: ""
  type: 4
  required: true
- display: Use system proxy settings
  name: useproxy
  defaultvalue: "true"
  type: 8
  required: false
- display: Trust any certificate (unsecure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
- display: File Threshold. Minimun number of positive results from VT scanners to
    consider the file malicious.
  name: fileThreshold
  defaultvalue: "10"
  type: 0
  required: false
- display: IP Threshold. Minimun number of positive results from VT scanners to consider
    the IP malicious.
  name: ipThreshold
  defaultvalue: "10"
  type: 0
  required: false
- display: URL Threshold. Minimun number of positive results from VT scanners to consider
    the URL malicious.
  name: urlThreshold
  defaultvalue: "10"
  type: 0
  required: false
- display: Domain Threshold. Minimun number of positive results from VT scanners to
    consider the domain malicious.
  name: domainThreshold
  defaultvalue: "10"
  type: 0
  required: false
script:
  script: |-
    var serverUrl = params.Server;
    if (serverUrl[serverUrl.length - 1] !== '/') {
        serverUrl += '/';
    }
    function createScansTable(scans){
        // Returns a table with the scan result for each vendor

        scans_table = [];
        positives_scans_table = [];
        negative_scans_table = [];

        for (var scan in scans) {
            dict_for_table = {};
            dict_for_table['Source'] = scan;
            if (scans[scan]['detected']){
                dict_for_table['Detected'] = scans[scan]['detected'];
            }
            if (scans[scan]['result']){
                dict_for_table['Result'] = scans[scan]['result'];
            }
            if (scans[scan]['update']){
                dict_for_table['Update'] = scans[scan]['update'];
            }
            if (scans[scan]['detail']){
                dict_for_table['Details'] = scans[scan]['detail'];
            }

            if (dict_for_table['Detected'] && dict_for_table['Detected'] === true)
                positives_scans_table.push(dict_for_table);
            else
                negative_scans_table.push(dict_for_table);
        }

        positives_scans_table.sort(function(a, b){
          return a.Source > b.Source;
        });
        negative_scans_table.sort(function(a, b){
          return a.Source > b.Source;
        });

        scans_table = positives_scans_table.concat(negative_scans_table);
        return scans_table
    }

    var doReq = function(method, path, parameters) {
        if (!parameters) {
            parameters = {};
        }
        parameters.apikey = params.APIKey;
        var result = http(
            serverUrl + path + (method === 'GET' ? encodeToURLQuery(parameters) : ''),
            {
                Headers: {'Content-Type': ['application/x-www-form-urlencoded'], 'Accept': ['application/json']},
                Method: method,
                Body: method == 'POST' ? encodeToURLQuery(parameters).substring(1) : ''
            },
            params.insecure,
            params.useproxy
        );

        if (result.StatusCode < 200 || result.StatusCode > 299) {
            throw 'Failed to perform request ' + path + ', request status code: ' + result.StatusCode;
        }
        if (result.Body === '' && result.StatusCode === 204) {
            return {statusCode: result.StatusCode};
        }
        if (result.Body === '') {
            throw 'No content received. Maybe you tried a private API?.';
        }
        var obj;
        try {
            obj = JSON.parse(result.Body);
        } catch (ex) {
            throw 'Error parsing reply - ' + result.Body + ' - ' + ex;
        }
        if (!Array.isArray(obj) && obj.response_code !== 1 && obj.response_code !== 0) {
            throw 'Response code: ' + obj.response_code + ', message: ' + obj.verbose_msg;
        }
        return {body: result.Body, obj: obj, statusCode: result.StatusCode};
    };

    var withRetries = function(waitForRateLimit, retries, reqCall) {
        if (waitForRateLimit) {
            waitForRateLimit = parseInt(waitForRateLimit);
        }
        if (!waitForRateLimit) {
            waitForRateLimit = 60;
        }
        if (retries) {
            retries = parseInt(retries);
        }
        if (!retries) {
            retries = 0;
        }
        var res = reqCall();
        var tries = 0;
        while (res.statusCode === 204 && !res.body && tries < retries && waitForRateLimit > 0) {
            wait(waitForRateLimit);
            tries++;
            res = reqCall();
        }
        if (res.statusCode === 204 && !res.body) {
            throw 'No content received. Possible API rate limit reached.';
        }
        return res;
    };

    var doFile = function(hash, longFormat, threshold, waitForRateLimit, retries) {
        if (!threshold) {
            threshold = params.fileThreshold || 10;
        }
        threshold = parseInt(threshold);
        var res = withRetries(waitForRateLimit, retries, function() {return doReq('POST', 'file/report', {resource: hash});});
        var o = res.obj;
        var ec = {};
        if (o.response_code === 0) {
            ec.DBotScore = {Indicator: hash, Type: 'hash', Vendor: 'VirusTotal', Score: 0};
            return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, EntryContext: ec,
                HumanReadable: 'VirusTotal does not have details about ' + hash + '\n' + res.obj.verbose_msg};
        }
        var r = [];
        if (Array.isArray(res.obj)) { // Got multiple hashes so need to nicely iterate
            r = res.obj;
        } else {
            r = [res.obj];
        }

        var md = '';
        ec.DBotScore = [];
        ec[outputPaths.file] = [];
        for (var i=0; i<r.length; i++) {
            md += '## VirusTotal Hash Reputation for: ' + r[i].resource + '\n';
            md += 'Scan date: **' + r[i].scan_date + '**\n';
            md += 'Positives / Total: **' + r[i].positives + '/' + r[i].total + '**\n';
            md += 'VT Link: [' + r[i].resource + '](' + r[i].permalink + ')\n';
            var dbotScore = 0;
            if (r[i].positives >= threshold) {
                dbotScore = 3;
                var malFile = {};
                addMalicious(malFile, outputPaths.file, {
                    MD5: r[i].md5,
                    SHA1: r[i].sha1,
                    SHA256: r[i].sha256,
                    Malicious: {Vendor: 'VirusTotal', Detections: r[i].positives, TotalEngines: r[i].total}
                });
                ec[outputPaths.file].push(malFile[outputPaths.file]);
            } else if (r[i].positives >= threshold / 2) {
                dbotScore = 2;
            } else {
                dbotScore = 1;
            }
            ec.DBotScore.push({Indicator: hash, Type: 'hash', Vendor: 'VirusTotal', Score: dbotScore});
            md += 'MD5 / SHA1 / SHA256: **' + r[i].md5 + ' / ' + r[i].sha1 + ' / ' + r[i].sha256 + '**\n';
            if (longFormat === 'true' && r[i].scans) { // add scans table
                scansTable = createScansTable(r[i].scans);
                md += tableToMarkdown('Scans', scansTable);
                if (ec[outputPaths.file]){
                    scans_ec = {
                        Scans: scansTable,
                        ScanID: r[i].scan_id
                    };
                    if (typeof ec[outputPaths.file][i] === 'object') { // malicous
                        ec[outputPaths.file][i].VirusTotal = scans_ec;
                    } else { // not malicious
                        ec[outputPaths.file][i] = {
                            MD5: r[i].md5,
                            VirusTotal: scans_ec
                        };
                    }
                } else {
                    scans_ec = {
                        MD5: r[i].md5,
                        SHA1: r[i].sha1,
                        SHA256: r[i].sha256,
                        VirusTotal: {
                            Scans: scansTable,
                            ScanID: r[i].scan_id
                        }
                    };
                    ec[outputPaths.file] = scans_ec;
                }
            } else { // short format
                if (ec[outputPaths.file]){
                    scans_ec = {
                        ScanID: r[i].scan_id
                    };
                    if (typeof ec[outputPaths.file][i] === 'object') { // malicious
                        ec[outputPaths.file][i].VirusTotal = scans_ec;
                    } else { // not malicious
                        ec[outputPaths.file][i] = {
                            MD5: r[i].md5,
                            VirusTotal: scans_ec
                        };
                    }
                } else {
                    scans_ec = {
                        MD5: r[i].md5,
                        VirusTotal: {
                            ScanID: r[i].scan_id
                        }
                    };
                    ec[outputPaths.file] = scans_ec;
                }
            }
            md += '\n';
        }
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    };

    var calcRecentDownloads = function(checks) {
        var badDownloads = 0;
        var now = Date.now();
        for (var c=0; c<checks.length; c++) {
            if (checks[c]) {
                for (var ci=0; ci<checks[c].length; ci++) {
                    if (checks[c][ci].date) {
                        var d = new Date(checks[c][ci].date.replace(' ', 'T'));
                        if ((now - d.getTime()) / 1000 / 60 / 60 / 24 < 30) {
                            badDownloads++;
                        }
                    }
                }
            }
        }
        return badDownloads;
    };

    var doIP = function(ip, longFormat, threshold, sampleSize, waitForRateLimit, retries, fullResponse) {
        if (!isValidIP(ip)) {
            return {Type: entryTypes.error, Contents: 'IP - ' + ip + ' is not valid IP', ContentsFormat: formats.text};
        }
        if (!threshold) {
            threshold = params.ipThreshold || 10;
        }
        threshold = parseInt(threshold)
        if (!sampleSize) {
            sampleSize = 10;
        }
        var res = withRetries(waitForRateLimit, retries, function() {return doReq('GET', 'ip-address/report', {ip: ip});});
        var o = res.obj;
        var ec = {};
        if (o.response_code === 0) {
            ec.DBotScore = {Indicator: ip, Type: 'ip', Vendor: 'VirusTotal', Score: 0};
            return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, EntryContext: ec,
                HumanReadable: 'VirusTotal does not have details about ' + ip + ' ,it sent the following response:\n' + res.obj.verbose_msg};
        }
        if (fullResponse === 'true'){
            maxLen = 1000;
        } else {
            maxLen = 50;
        }

        // Calculate score based on recently found downloads
        var badDownloads = calcRecentDownloads([o.detected_downloaded_samples, o.undetected_downloaded_samples]);
        var dbotScore = 0;
        if (badDownloads >= threshold) {
            dbotScore = 3;
            addMalicious(ec, outputPaths.ip,{
                Address: ip,
                ASN: o.asn,
                Geo: {Country: o.country},
                Malicious: {Vendor: 'VirusTotal', Description: 'Recent malicious downloads: ' + badDownloads}
            });
        } else if (badDownloads >= threshold / 2) {
            dbotScore = 2;
        } else {
            dbotScore = 1;
        }
        ec.DBotScore = {Indicator: ip, Type: 'ip', Vendor: 'VirusTotal', Score: dbotScore};
        var md = '## VirusTotal IP Reputation for: ' + ip + '\n';
        md += (o.asn) ? 'ASN: **' + o.asn + ' (' + o.as_owner + ')**\n' : 'ASN: N/A\n';
        md += 'Country: **' + o.country + '**\n';
        md += 'VT Link: [' + ip + '](https://www.virustotal.com/en/search?query=' + encodeURIComponent(ip) + ')\n';

        var detectedUrls = o.detected_urls || []
        var detectedDownloadedSamples = o.detected_downloaded_samples || []
        var undetectedDownloadedSamples = o.undetected_downloaded_samples || []
        var detectedCommunicatingSamples = o.detected_communicating_samples || []
        var undetectedCommunicatingSamples = o.undetected_communicating_samples || []
        var detectedReferrerSamples = o.detected_referrer_samples || []
        var undetectedReferrerSamples = o.undetected_referrer_samples || []
        var resolutions = o.resolutions || []

        var arrTitle = [{a: detectedUrls, t: 'Detected URL'}, {a: detectedDownloadedSamples, t: 'Detected downloaded sample'},
            {a: undetectedDownloadedSamples, t: 'Undetected downloaded sample'}, {a: detectedCommunicatingSamples, t: 'Detected communicating sample'},
            {a: undetectedCommunicatingSamples, t: 'Undetected communicating sample'},{a: detectedReferrerSamples, t: 'Detected referrer sample'},
            {a: undetectedReferrerSamples, t: 'Undetected referrer sample'}, {a: resolutions, t: 'Resolutions'}];
        for (var i=0; i<arrTitle.length; i++) {
            if (arrTitle[i].a) {
                md += arrTitle[i].t + ' count: **' + arrTitle[i].a.length + '**\n';
            }
        }
        ip_ec = {
            'Address': ip,
            "VirusTotal": {
                'DownloadedHashes': detectedDownloadedSamples.slice(0,maxLen),
                'UnAVDetectedDownloadedHashes': undetectedDownloadedSamples.slice(0,maxLen),
                "DetectedURLs": detectedUrls.slice(0,maxLen),
                'CommunicatingHashes': detectedCommunicatingSamples.slice(0,maxLen),
                'UnAVDetectedCommunicatingHashes': undetectedCommunicatingSamples.slice(0,maxLen),
                'Resolutions': resolutions.slice(0,maxLen),
                'ReferrerHashes': detectedReferrerSamples.slice(0,maxLen),
                'UnAVDetectedReferrerHashes': undetectedReferrerSamples.slice(0,maxLen)
            }
        };
        if (ec[outputPaths.ip]){ // malicious
            ec[outputPaths.ip]['VirusTotal'] = {
                'DownloadedHashes': detectedDownloadedSamples.slice(0,maxLen),
                'UnAVDetectedDownloadedHashes': undetectedDownloadedSamples.slice(0,maxLen),
                "DetectedURLs": detectedUrls.slice(0,maxLen),
                'CommunicatingHashes': detectedCommunicatingSamples.slice(0,maxLen),
                'UnAVDetectedCommunicatingHashes': undetectedCommunicatingSamples.slice(0,maxLen),
                'Resolutions': resolutions.slice(0,maxLen),
                'ReferrerHashes': detectedReferrerSamples.slice(0,maxLen),
                'UnAVDetectedReferrerHashes': undetectedReferrerSamples.slice(0,maxLen)
            };
        } else { // not malicious
            ec[outputPaths.ip] = ip_ec;
        }
        if (longFormat === 'true') {
            for (var j=0; j<arrTitle.length; j++) {
                if (arrTitle[j].a) {
                    md += '### ' + arrTitle[j].t + '\n';
                    // Print only the first 10 rows
                    var curr = [];
                    for (var k=0; k<Math.min(arrTitle[j].a.length, sampleSize); k++) {
                        curr.push(arrTitle[j].a[k]);
                    }
                    md += arrToMd(curr) + '\n';
                }
            }
        }
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    };

    var doURL = function(url, threshold, longFormat, sampleSize, submitWait, waitForRateLimit, retries) {
        //lowercase the URL protocol
        //Example: https://www.demisto.com --> https://www.demisto.com, Http://www.demisto.com --> http://www.demisto.com, www.demisto.com --> www.demisto.com
        var protocol = url.match(/\b^[^:]+(?=:\/\/)\b/);
        if (protocol != null) { // if url doesn't start with a protocol, ignore
          protocol = protocol[0].toLowerCase();
          var not_protocol = url.replace(/(^\w+:|^)\/\//, '');
          url = protocol + '://' + not_protocol;
        }

        if (!submitWait) {
            submitWait = 0;
        }
        if (!sampleSize) {
            sampleSize = 10;
        }
        if (!threshold) {
            threshold = params.urlThreshold || 10;
        }
        threshold = parseInt(threshold)
        var res = withRetries(waitForRateLimit, retries, function() {return doReq('POST', 'url/report', {resource: url, scan:1});});
        var o = res.obj;
        var ec = {};
        if (o.response_code === 0) {
            ec.DBotScore = {Indicator: url, Type: 'url', Vendor: 'VirusTotal', Score: 0};
            return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, EntryContext: ec,
                HumanReadable: 'VirusTotal does not have details about ' + url + '\n' + res.obj.verbose_msg};
        }

        var md = '## VirusTotal URL Reputation for: ' + url + '\n';

        if (!o.scans && submitWait>0) {
            wait(parseInt(submitWait));
            res = doReq('GET', 'url/report', {resource: url});
            o = res.obj;
        }
        if (!o.scans) { // URL doesn't exist in VT
            md += 'URL submitted for scan. Please retry command later\n';
            ec[outputPaths.url] = {
                Data: url,
                VirusTotal: {
                    ScanID: o.scan_id
                }
            };
        } else {
            md += 'Last scan date: *' + o.scan_date + '*\n';
            md += 'Total scans: **' + o.total + '**\n';
            md += 'Positive scans: **' + o.positives + '**\n';
            md += 'VT Link: [' + url + '](' + o.permalink + ')\n';

            var dbotScore = 0;
            if (o.positives >= threshold) {
                dbotScore = 3;
                addMalicious(ec, outputPaths.url, {
                    Data: url,
                    Malicious: {Vendor: 'VirusTotal', Description: 'Positives / Total: ' + o.positives + ' / ' + o.total}
                });
            } else if (o.positives >= threshold / 2) {
                dbotScore = 2;
            } else {
                dbotScore = 1;
            }
            ec.DBotScore = {Indicator: url, Type: 'url', Vendor: 'VirusTotal', Score: dbotScore};

            if (longFormat === 'true') { // add scans table
                scansTable = createScansTable(o.scans);
                md += tableToMarkdown('Scans', scansTable)
                if (ec[outputPaths.url]){ // malicious
                    scans_ec = {
                        Scans: scansTable,
                        ScanID: o.scan_id
                    }
                    ec[outputPaths.url].VirusTotal = scans_ec;
                } else { // not malicious
                    scans_ec = {
                        Data: url,
                        "VirusTotal": {
                            Scans: scansTable,
                            ScanID: o.scan_id
                        }
                    }
                    ec[outputPaths.url] = scans_ec;
                }
            } else { // short format
                if (ec[outputPaths.url]){ // malicious
                    ec[outputPaths.url]['VirusTotal'] = {
                        ScanID: o.scan_id,
                    };
                } else { // not malicious
                    ec[outputPaths.url] = {
                        Data: url,
                        VirusTotal: {
                            ScanID: o.scan_id,
                        }
                    };
                }
            }
        }

        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    };

    var doDomain = function(domain, threshold, longFormat, sampleSize, waitForRateLimit, retries, fullResponse) {
        if (!sampleSize) {
            sampleSize = 10;
        }
        if (!threshold) {
            threshold = params.domainThreshold || 10;
        }
        threshold = parseInt(threshold)
        var res = withRetries(waitForRateLimit, retries, function() {return doReq('GET', 'domain/report', {domain: domain});});
        var o = res.obj;
        var ec = {};
        if (o.response_code === 0) {
            ec.DBotScore = {Indicator: domain, Type: 'domain', Vendor: 'VirusTotal', Score: 0};
            return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, EntryContext: ec,
                HumanReadable: 'VirusTotal does not have details about ' + domain + '\n' + res.obj.verbose_msg};
        }
        if (fullResponse === 'true'){
            maxLen = 1000;
        } else {
            maxLen = 50;
        }
        // Calculate score based on recently found downloads
        var badDownloads = calcRecentDownloads([o.detected_downloaded_samples, o.undetected_downloaded_samples]);
        var dbotScore = 0;
        if (badDownloads >= threshold) {
            dbotScore = 3;
            addMalicious(ec, outputPaths.domain, {Name: domain,
                Malicious: {Vendor: 'VirusTotal', Description: 'Recent malicious downloads: ' + badDownloads}});
        } else if (badDownloads >= threshold / 2) {
            dbotScore = 2;
        } else {
            dbotScore = 1;
        }
        ec.DBotScore = {Indicator: domain, Type: 'domain', Vendor: 'VirusTotal', Score: dbotScore};

        var md = '## VirusTotal Domain Reputation for: ' + domain + '\n';
        md += '#### Domain categories: *' + o.categories + "*\n";
        md += 'VT Link: [' + domain + '](https://www.virustotal.com/en/search?query=' + encodeURIComponent(domain) + ')\n';

        var detectedUrls = o.detected_urls || []
        var detectedDownloadedSamples = o.detected_downloaded_samples || []
        var undetectedDownloadedSamples = o.undetected_downloaded_samples || []
        var detectedCommunicatingSamples = o.detected_communicating_samples || []
        var undetectedCommunicatingSamples = o.undetected_communicating_samples || []
        var detectedReferrerSamples = o.detected_referrer_samples || []
        var undetectedReferrerSamples = o.undetected_referrer_samples || []
        var resolutions = o.resolutions || []

        var arrTitle = [{a: detectedUrls, t: 'Detected URL'}, {a: detectedDownloadedSamples, t: 'Detected downloaded sample'},
            {a: undetectedDownloadedSamples, t: 'Undetected downloaded sample'}, {a: detectedCommunicatingSamples, t: 'Detected communicating sample'},
            {a: undetectedCommunicatingSamples, t: 'Undetected communicating sample'},{a: detectedReferrerSamples, t: 'Detected referrer sample'},
            {a: undetectedReferrerSamples, t: 'Undetected referrer sample'}, {a: resolutions, t: 'Resolutions'}];

        for (var i=0; i<arrTitle.length; i++) {
            if (arrTitle[i].a) {
                md += arrTitle[i].t + ' count: **' + arrTitle[i].a.length + '**\n';
            }
        }
        if (longFormat === 'true') {
            for (var j=0; j<arrTitle.length; j++) {
                if (arrTitle[j].a) {
                    md += '### ' + arrTitle[j].t + '\n';
                    // Print only the first 10 rows
                    var curr = [];
                    for (var k=0; k<Math.min(arrTitle[j].a.length, sampleSize); k++) {
                        curr.push(arrTitle[j].a[k]);
                    }
                    md += arrToMd(curr) + '\n';
                }
            }
        }

        if (o.domain_siblings && o.domain_siblings.length > 0) {
            md += "### Observed subdomains\n";
            for (var i = 0; i < o.domain_siblings.length; i++) {
                md += "- " + o.domain_siblings[i] + "\n";
            }
        }
        if (o.whois) {
            var whoIs = o.whois.trim();
            var lines = whoIs ? whoIs.split("\n") : [];
            md += '### Whois Lookup\n';
            for (var i = 0; i < lines.length; i++) {
                var parts = lines[i].split(': ');
                if (parts[0] && parts[1]) {
                    md += "**" + parts[0].trim() + "**: " + parts[1] + "\n";
                }
            }
        }

        var detected_downloaded_samples = o.detected_downloaded_samples
        if (detected_downloaded_samples == undefined) {
            detected_downloaded_samples = []
        } else {
            detected_downloaded_samples = detected_downloaded_samples.slice(0,maxLen)
        }

        var undetected_downloaded_samples = o.undetected_downloaded_samples
        if (undetected_downloaded_samples == undefined) {
            undetected_downloaded_samples = []
        } else {
            undetected_downloaded_samples = undetected_downloaded_samples.slice(0,maxLen)
        }

        var detected_urls = o.detected_urls
        if (detected_urls == undefined) {
            detected_urls = []
        } else {
            detected_urls = detected_urls.slice(0,maxLen)
        }

        var detected_communicating_samples = o.detected_communicating_samples
        if (detected_communicating_samples == undefined) {
            detected_communicating_samples = []
        } else {
            detected_communicating_samples = detected_communicating_samples.slice(0,maxLen)
        }
        var undetected_communicating_samples = o.undetected_communicating_samples
        if (undetected_communicating_samples == undefined) {
            undetected_communicating_samples = []
        } else {
            undetected_communicating_samples = undetected_communicating_samples.slice(0,maxLen)
        }
        var resolutions = o.resolutions
        if (resolutions == undefined) {
            resolutions = []
        } else {
            resolutions = resolutions.slice(0,maxLen)
        }
        var detected_referrer_samples = o.detected_referrer_samples
        if (detected_referrer_samples == undefined) {
            detected_referrer_samples = []
        } else {
            detected_referrer_samples = detected_referrer_samples.slice(0,maxLen)
        }
        var undetected_referrer_samples = o.undetected_referrer_samples
        if (undetected_referrer_samples == undefined) {
            undetected_referrer_samples = []
        } else {
            undetected_referrer_samples = undetected_referrer_samples.slice(0,maxLen)
        }
        var domain_siblings = o.domain_siblings
        if (domain_siblings == undefined) {
            domain_siblings = []
        } else {
            domain_siblings = domain_siblings.slice(0,maxLen)
        }
        domain_ec = {
            "Name": domain,
            "VirusTotal": {
                'DownloadedHashes': detected_downloaded_samples,
                'UnAVDetectedDownloadedHashes': undetected_downloaded_samples,
                "DetectedURLs": detected_urls,
                'CommunicatingHashes': detected_communicating_samples,
                'UnAVDetectedCommunicatingHashes': undetected_communicating_samples,
                'Resolutions': resolutions,
                'ReferrerHashes': detected_referrer_samples,
                'UnAVDetectedReferrerHashes': undetected_referrer_samples,
                'Whois': o.whois,
                'Subdomains': domain_siblings,
            }
        };
        if (ec[outputPaths.domain]){ // malicious
            ec[outputPaths.domain].VirusTotal = {
                'DownloadedHashes': detected_downloaded_samples,
                'UnAVDetectedDownloadedHashes': undetected_downloaded_samples,
                "DetectedURLs": detected_urls,
                'CommunicatingHashes': detected_communicating_samples,
                'UnAVDetectedCommunicatingHashes': undetected_communicating_samples,
                'Resolutions': resolutions,
                'ReferrerHashes': detected_referrer_samples,
                'UnAVDetectedReferrerHashes': undetected_referrer_samples,
                'Whois': o.whois,
                'Subdomains': domain_siblings,
            }
        } else { // not malicious
            ec[outputPaths.domain] = domain_ec;
        }

        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    };

    var scanURL = function(url) {
        var res = doReq('POST', 'url/scan', {url: url});
        var r = [];
        if (Array.isArray(res.obj)) { // Got multiple URLs so need to nicely iterate
            r = res.obj;
        } else {
            r = [res.obj];
        }
        var md = '';
        var ec = {vtScanID: []};
        for (var i=0; i<r.length; i++) {
            md += '## VirusTotal URL scan for: [' + r[i].url + '](' + r[i].permalink + ')\n';
            md += 'Scan ID: **' + r[i].scan_id + '**\n';
            ec.vtScanID.push(r[i].scan_id);
            md += 'Scan Date: **' + r[i].scan_date + '**\n\n';
        }
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    };

    var scanFile = function(entry, uploadURL) {
        var url = uploadURL ? uploadURL : serverUrl + 'file/scan';
        var fileName = dq(invContext, "File(val.EntryID == '" + entry + "').Name");
        if (Array.isArray(fileName)) {
            if (fileName.length > 0) {
                fileName = fileName[0];
            } else {
                fileName = undefined;
            }
        }
        var result = httpMultipart(url, entry, {Method: 'POST', Headers: {'Accept': ['application/json']}}, {apikey: params.APIKey},
            params.insecure, params.proxy, undefined, 'file', fileName);
        if (result.StatusCode < 200 || result.StatusCode > 299) {
            throw 'Failed to perform request ' + url + ', request status code: ' + result.StatusCode;
        }
        if (result.Body === '' && result.StatusCode == 204) {
            throw 'No content recieved. Possible API rate limit reached.';
        }
        if (result.Body === '') {
            throw 'No content recieved. Maybe you tried a private API?.';
        }
        var obj;
        try {
            obj = JSON.parse(result.Body);
        } catch (ex) {
            throw 'Error parsing reply - ' + result.Body + ' - ' + ex;
        }
        if (obj.response_code !== 1) {
            throw 'Response code: ' + obj.response_code + ', message: ' + obj.verbose_msg;
        }
        var ec = {};
        ec.vtScanID = obj.scan_id;
        var md = '## VirusTotal scan file for [' + entry + '](' + obj.permalink + ')\n';
        md += 'Resource: **' + obj.resource + '**\n';
        md += 'MD5 / SHA1 / SHA256: **' + obj.md5 + ' / ' + obj.sha1 + ' / ' + obj.sha256 + '**\n';
        return {Type: entryTypes.note, Contents: result.Body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    };

    var rescanFile = function(hash) {
        var res = doReq('POST', 'file/rescan', {resource: hash});
        var r = [];
        if (Array.isArray(res.obj)) { // Got multiple hashes so need to nicely iterate
            r = res.obj;
        } else {
            r = [res.obj];
        }
        var md = '';
        var ec = {vtScanID: []};
        for (var i=0; i<r.length; i++) {
            md += '## VirusTotal File Rescan for: [' + r[i].resource + '](' + r[i].permalink + ')\n';
            md += 'Scan ID: **' + r[i].scan_id + '**\n';
            ec.vtScanID.push(r[i].scan_id);
            md += 'MD5 / SHA1 / SHA256: **' + r[i].md5 + ' / ' + r[i].sha1 + ' / ' + r[i].sha256 + '**\n\n';
        }
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: md, EntryContext: ec};
    };

    var doComments = function(resource, comment) {
        var res = doReq('POST', 'comments/put', {resource: resource, comment: comment});
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: res.obj.verbose_msg};
    }

    var getComments = function(resource, before) {
        var params = {resource: resource};
        if (before) {
            params.before = before;
        }
        var res = doReq('GET', 'comments/get', params);
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: arrToMd(res.obj.comments)};
    }

    var fileScanUploadURL = function() {
        var res = doReq('GET', 'file/scan/upload_url');
        return {Type: entryTypes.note, Contents: res.body, ContentsFormat: formats.json, HumanReadable: res.obj.upload_url, EntryContext: {vtUploadURL: res.obj.upload_url}};
    }

    switch (command) {
        case 'test-module':
            doFile('7657fcb7d772448a6d8504e4b20168b8'); // Check sample file - it will throw an error if not successful
            return true;
        case 'file':
            return doFile(args.file, args.long, args.threshold, args.wait, args.retries);
        case 'ip':
            return doIP(args.ip, args.long, args.threshold, args.sampleSize, args.wait, args.retries, args.fullResponse);
        case 'url':
            return doURL(args.url, args.threshold, args.long, args.sampleSize, args.submitWait, args.wait, args.retries);
        case 'domain':
            return doDomain(args.domain, args.threshold, args.long, args.sampleSize, args.wait, args.retries);
        case 'file-scan':
            return scanFile(args.entryID, args.uploadURL);
        case 'file-rescan':
            return rescanFile(args.file);
        case 'url-scan':
            return scanURL(args.url);
        case 'vt-comments-add':
            return doComments(args.resource, args.comment);
        case 'vt-comments-get':
            return getComments(args.resource, args.before);
        case 'vt-file-scan-upload-url':
            return fileScanUploadURL();
        default:
            throw 'Unknown command - ' + command;
    }
  type: javascript
  commands:
  - name: file
    arguments:
    - name: file
      required: true
      default: true
      description: Hash of the file to query. Supports MD5, SHA1 and SHA256. Notice
        that you can pass comma-separated multiple values to efficiently retrieve
        multiple responses.
    - name: long
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Should we return full response with scans
      defaultValue: "false"
    - name: threshold
      description: If the number of positives is bigger than the threshold the file
        will be considered malicious. If threshold is not specified, the default file
        threshold, as configured in the instance settings, will be used.
    - name: wait
      description: Wait time between tries if we reach the API rate limit in seconds
      defaultValue: "60"
    - name: retries
      description: Number of retries for API rate limit
      defaultValue: "0"
    outputs:
    - contextPath: File.MD5
      description: Bad hash found
    - contextPath: File.SHA1
      description: Bad hash SHA1
    - contextPath: File.SHA256
      description: Bad hash SHA256
    - contextPath: File.Malicious.Vendor
      description: For malicious files, the vendor that made the decision
    - contextPath: File.Malicious.Detections
      description: For malicious files. Total detections.
    - contextPath: File.Malicious.TotalEngines
      description: For malicious files. Total engines
    - contextPath: DBotScore.Indicator
      description: The indicator we tested
    - contextPath: DBotScore.Type
      description: The type of the indicator
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
    - contextPath: DBotScore.Score
      description: The actual score
    - contextPath: File.VirusTotal.Scans.Source
      description: Scan vendor for this hash
    - contextPath: File.VirusTotal.Scans.Detected
      description: Scan detection for this hash (True,False)
    - contextPath: File.VirusTotal.Scans.Result
      description: Scan result for this hash - signature, etc.
    - contextPath: File.VirusTotal.ScanID
      description: Scan ID for this hash
      type: string
    description: Check file reputation of the given hash
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      description: IP address to check
    - name: long
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Should we return full response with detected URLs
      defaultValue: "false"
    - name: threshold
      description: If the number of positives is bigger than the threshold the IP
        will be considered malicious. If threshold is not specified, the default IP
        threshold, as configured in the instance settings, will be used.
    - name: sampleSize
      description: The number of samples from each type (resolutions, detections,
        etc.) to display for long format
      defaultValue: "10"
    - name: wait
      description: Wait time between tries if we reach the API rate limit in seconds
      defaultValue: "60"
    - name: retries
      description: Number of retries for API rate limit
      defaultValue: "0"
    - name: fullResponse
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Return all of the results, note that it can be thousands of results.
        Prefer not to use in playbooks. The default value is "false"
      defaultValue: "false"
    outputs:
    - contextPath: IP.Address
      description: Bad IP Address found
    - contextPath: IP.ASN
      description: Bad IP ASN
    - contextPath: IP.Geo.Country
      description: Bad IP Country
    - contextPath: IP.Malicious.Vendor
      description: For malicious IPs, the vendor that made the decision
    - contextPath: IP.Malicious.Description
      description: For malicious IPs, the reason for the vendor to make the decision
    - contextPath: DBotScore.Indicator
      description: The indicator we tested
    - contextPath: DBotScore.Type
      description: The type of the indicator
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
    - contextPath: DBotScore.Score
      description: The actual score
    - contextPath: IP.VirusTotal.DownloadedHashes
      description: Latest files that are detected by at least one antivirus solution
        and were downloaded by VirusTotal from the IP address
    - contextPath: IP.VirusTotal.UnAVDetectedDownloadedHashes
      description: Latest files that are not detected by any antivirus solution and
        were downloaded by VirusTotal from the IP address provided
    - contextPath: IP.VirusTotal.DetectedURLs
      description: Latest URLs hosted in this IP address detected by at least one
        URL scanner
    - contextPath: IP.VirusTotal.CommunicatingHashes
      description: Latest detected files that communicate with this IP address
    - contextPath: IP.VirusTotal.UnAVDetectedCommunicatingHashes
      description: Latest undetected files that communicate with this IP address
    - contextPath: IP.VirusTotal.Resolutions.hostname
      description: The following domains resolved to the given IP
    - contextPath: IP.VirusTotal.ReferrerHashes
      description: Latest detected files that embed this IP address in their strings
    - contextPath: IP.VirusTotal.UnAVDetectedReferrerHashes
      description: Latest undetected files that embed this IP address in their strings
    - contextPath: IP.VirusTotal.Resolutions.last_resolved
      description: Last resolution times of the following domains resolved to the
        given IP
    description: Check IP Reputation
  - name: url
    arguments:
    - name: url
      required: true
      description: URL to be checked
    - name: sampleSize
      description: The number of samples from each type (resolutions, detections,
        etc.) to display for long format
      defaultValue: "10"
    - name: long
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Should we return full response with detected URLs
      defaultValue: "false"
    - name: threshold
      description: If the number of positives is bigger than the threshold the URL
        will be considered malicious. If threshold is not specified, the default URL
        threshold, as configured in the instance settings, will be used.
    - name: submitWait
      description: Seconds to wait if the URL does not exist and is submitted to be
        scanned
      defaultValue: "0"
    - name: wait
      description: Wait time between tries if we reach the API rate limit in seconds
      defaultValue: "60"
    - name: retries
      description: Number of retries for API rate limit
      defaultValue: "0"
    outputs:
    - contextPath: URL.Data
      description: Bad URLs found
    - contextPath: URL.Malicious.Vendor
      description: For malicious URLs, the vendor that made the decision
    - contextPath: URL.Malicious.Description
      description: For malicious URLs, the reason for the vendor to make the decision
    - contextPath: DBotScore.Indicator
      description: The indicator we tested
    - contextPath: DBotScore.Type
      description: The type of the indicator
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
    - contextPath: DBotScore.Score
      description: The actual score
    - contextPath: URL.VirusTotal.Scans.Source
      description: Scan vendor for this URL
    - contextPath: URL.VirusTotal.Scans.Detected
      description: Scan detection for this URL (True/False)
    - contextPath: URL.VirusTotal.Scans.Result
      description: Scan result for this URL - signature, etc.
    description: Check URL Reputation
  - name: domain
    arguments:
    - name: domain
      required: true
      default: true
      description: Domain name to check reputation
    - name: long
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Should we return full response with detected URLs
      defaultValue: "false"
    - name: sampleSize
      description: The number of samples from each type (resolutions, detections,
        etc.) to display for long format
      defaultValue: "10"
    - name: threshold
      description: If the number of positives is bigger than the threshold the domain
        will be considered malicious. If threshold is not specified, the default domain
        threshold, as configured in the instance settings, will be used.
    - name: wait
      description: Wait time between tries if we reach the API rate limit in seconds
      defaultValue: "60"
    - name: retries
      description: Number of retries for API rate limit
      defaultValue: "0"
    - name: fullResponse
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Return all of the results, note that it can be thousands of results.
        Prefer not to use in playbooks. The default value is "false"
      defaultValue: "false"
    outputs:
    - contextPath: Domain.Name
      description: Bad domain found
    - contextPath: Domain.Malicious.Vendor
      description: For malicious domains, the vendor that made the decision
    - contextPath: Domain.Malicious.Description
      description: For malicious domains, the reason for the vendor to make the decision
    - contextPath: DBotScore.Indicator
      description: The indicator we tested
    - contextPath: DBotScore.Type
      description: The type of the indicator
    - contextPath: DBotScore.Vendor
      description: Vendor used to calculate the score
    - contextPath: DBotScore.Score
      description: The actual score
    - contextPath: Domain.VirusTotal.DownloadedHashes
      description: Hashes of files who were downloaded from this domain
    - contextPath: Domain.VirusTotal.CommunicatingHashes
      description: Hashes of files who communicated with this domain in a sandbox
    - contextPath: Domain.VirusTotal.Resolutions.ip_address
      description: IPs who resolved to this domain
    - contextPath: Domain.VirusTotal.Whois
      description: Whois report
    - contextPath: Domain.VirusTotal.Subdomains
      description: Subdomains
    - contextPath: Domain.VirusTotal.UnAVDetectedDownloadedHashes
      description: Latest files that are not detected by any antivirus solution and
        were downloaded by VirusTotal from the IP address provided
    - contextPath: Domain.VirusTotal.DetectedURLs
      description: Latest URLs hosted in this Domain address detected by at least
        one URL scanner
    - contextPath: Domain.VirusTotal.ReferrerHashes
      description: Latest detected files that embed this Domain address in their strings
    - contextPath: Domain.VirusTotal.UnAVDetectedReferrerHashes
      description: Latest undetected files that embed this Domain address in their
        strings
    - contextPath: Domain.VirusTotal.UnAVDetectedCommunicatingHashes
      description: Latest undetected files who communicated with this domain in a
        sandbox
    - contextPath: Domain.VirusTotal.Resolutions.last_resolved
      description: Last resolutions time of the IPs who resolve to this domain
    description: Check domain reputation
  - name: file-scan
    arguments:
    - name: entryID
      required: true
      default: true
      description: The file entry ID to submit
    - name: uploadURL
      description: Private API extension. Special upload URL for files bigger than
        32M.
    outputs:
    - contextPath: vtScanID
      description: Scan IDs of the submitted files
    description: Submit a file for scanning
  - name: file-rescan
    arguments:
    - name: file
      required: true
      default: true
      description: Hash of the file to re-scan. Supports MD5, SHA1 and SHA256.
    outputs:
    - contextPath: vtScanID
      description: Scan IDs of the submitted files
    description: Rescan an already submitted file to save time and not upload
  - name: url-scan
    arguments:
    - name: url
      required: true
      default: true
      description: The URL to scan
    outputs:
    - contextPath: vtScanID
      description: Scan IDs of the submitted URLs
    description: Scan a given URL
  - name: vt-comments-add
    arguments:
    - name: resource
      required: true
      default: true
      description: The hash (md5/sha1/sha256) or URL you're commenting on
    - name: comment
      required: true
      description: 'The actual review, you can tag it using the "#" twitter-like syntax
        (e.g. #disinfection #zbot) and reference users using the "@" syntax (e.g.
        @VirusTotalTeam).'
    description: Add comments for files and URLs
  - name: vt-file-scan-upload-url
    arguments: []
    outputs:
    - contextPath: vtUploadURL
      description: The special upload URL for large files
    description: Private API. Get a special URL for files above 32M.
  - name: vt-comments-get
    arguments:
    - name: resource
      required: true
      default: true
      description: The hash (md5/sha1/sha256) or URL you're retrieving comments for
    - name: before
      description: Datetime token in format YYYYMMDDHHMISS that can be used for paging
    description: Private API. Retrieve comments for a given resource
  runonce: false
tests:
- virusTotal-test-playbook