VirusTotal Integration in a SIEM: Automated File Reputation Without Sending Your Files Away

VirusTotal is a service that analyses files and URLs against more than seventy antivirus engines and threat intelligence feeds simultaneously, returning an aggregated verdict. Integrated into a SIEM, it turns a bare file hash in a log entry into a piece of enriched evidence: known malicious, known clean, or unknown.

It is one of the highest-value, lowest-effort integrations available to a security team. It also carries a data leakage risk that is easy to trigger by accident, so it is worth understanding properly before enabling it.

Hash lookup versus file upload — the distinction that matters most

VirusTotal supports two fundamentally different operations, and conflating them is the single most consequential mistake in this integration.

Hash lookup sends only a cryptographic fingerprint — typically SHA-256 — and asks whether VirusTotal has seen a file with that hash before. The file itself never leaves your network. A hash is a one-way function: it cannot be reversed to recover the content.

File submission uploads the actual file for analysis. This gets you a verdict on files nobody has seen before, but the file is now held by a third party. On the public service, uploaded files are accessible to VirusTotal's paying customers and enterprise subscribers.

The consequence is not theoretical. Organisations have leaked contracts, source code, credentials in configuration files, patient records and internal financial models by uploading files for analysis. Researchers routinely mine VirusTotal for exactly this kind of accidental disclosure. A file uploaded once cannot be recalled.

For any SIEM integration, hash-only lookups should be the default and file upload should be a deliberate, per-case decision. If your platform can be configured to never upload file contents, configure it that way and verify the setting rather than trusting it.

How the enrichment flow works

A typical automated pipeline looks like this:

1. An endpoint agent detects a new or modified executable and computes its SHA-256 hash — via file integrity monitoring or process execution telemetry.
2. The hash arrives at the SIEM as part of the event.
3. The SIEM checks a local cache. Reputation for a given hash rarely changes hour to hour, and caching is what keeps you inside API limits.
4. On a cache miss, the SIEM queries the VirusTotal API for that hash.
5. The response — detection ratio, engine names, first and last seen dates, file type, known names — is attached to the original event.
6. Correlation rules use the enriched data. A file flagged by 45 of 72 engines and executing from a temporary directory is a very different alert from an unrecognised hash.

The result is that analysts stop context-switching to a browser to paste hashes by hand, which is otherwise one of the most common repetitive tasks in a SOC.

Rate limits will shape your design

VirusTotal's public API is generous for research and restrictive for automation. The free tier permits roughly four requests per minute and a few hundred per day. A mid-sized network generates far more unique hashes than that in an hour.

Three practical consequences:

Cache aggressively. Store every result locally with a timestamp. A hash checked yesterday almost never needs rechecking today. A sensible cache window is seven to thirty days for known-malicious verdicts and shorter for unknowns, since an unknown file may be classified later.

Prioritise what you query. Do not enrich every hash you observe. Query files that are newly seen, executing from unusual paths, unsigned, or already implicated in an alert. Enriching known operating system binaries wastes your entire quota.

Consider the paid tier if you rely on it. VirusTotal's commercial API offers substantially higher throughput. If enrichment is load-bearing in your detection logic, the free tier will eventually fail you at the worst moment.

Reading the detection ratio correctly

VirusTotal returns a ratio such as 52/72 — fifty-two engines flagged the file, seventy-two scanned it. Analysts new to the service tend to read this as a confidence percentage. It is not.

A small number of detections does not mean clean. Novel malware and targeted tooling frequently show one or two detections, or zero. Absence of detection means absence of prior knowledge, nothing more.

A moderate number of detections does not mean malicious. Several engines are aggressive with heuristics and routinely flag packed installers, cryptocurrency miners, remote administration tools and security utilities. A file flagged by three engines with generic names like Heuristic.Suspicious is weaker evidence than one flagged by three engines that all name the same malware family.

Engine agreement on a family name is the strongest signal. When multiple independent vendors identify the same specific threat, the verdict is reliable. When names disagree wildly, treat it as unresolved.

First-seen dates carry information. A file first submitted to VirusTotal an hour ago, appearing in your environment now, is far more interesting than one that has been catalogued for six years.

Where it fits with other detection layers

VirusTotal enrichment is reputation-based, which means it answers "has this been seen before?" and nothing else. It is complementary to, not a substitute for:

• YARA rules, which match structural patterns and therefore catch variants of known malware families that have never been submitted anywhere.
• Behavioural detection, which watches what a process does rather than what it is.
• Threat intelligence feeds in STIX format, which supply indicators tied to specific campaigns and actors.

An attacker who compiles a unique binary for your organisation will be invisible to hash reputation and visible to the other three. Reputation is the cheap first pass, not the last line.

Deployment considerations for regulated and air-gapped environments

Two constraints come up repeatedly in regulated sectors.

Outbound connectivity. VirusTotal is a cloud service. A fully air-gapped deployment cannot query it at all, and a segmented network may only permit the query through a controlled proxy. Any platform that treats reputation enrichment as mandatory will be unusable in these environments — enrichment must degrade gracefully when the lookup is unavailable.

Hashes are still metadata. Even hash-only lookups disclose something: that your organisation encountered a file with that hash at that moment. For most organisations this is an acceptable trade. For some intelligence, defence and government contexts, it is not, and the integration should be disabled entirely rather than restricted.

Both cases argue for the same architectural property: enrichment should be configurable per integration, per environment, and fully switchable — never a hard dependency of the detection pipeline.

---

See the VirusTotal integration configuration options, including hash-only mode and cache behaviour, in the nPro documentation.