URL Enrichment - Virus Total Report - Incident Triggered

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This playbook will take each URL entity and query VirusTotal for info (https://developers.virustotal.com/v3.0/reference#url-info).

Attribute	Value
Type	Playbook
Solution	VirusTotal
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
VTURLReport_CL	?	✓	?

Logic App Connectors

This playbook uses 3 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
azureloganalyticsdatacollector	Managed	1	2
azuresentinel	Managed	1	3
virustotal	Managed	1	2

Action parameters (URLs, paths, function IDs)

azureloganalyticsdatacollector (Managed)

Action	Method	Endpoint	Other
Send_Data	post	/api/logs	—
Send_Data_2	post	/api/logs	—

azuresentinel (Managed)

Action	Method	Endpoint	Other
Entities_-_Get_URLs	post	/entities/url	—
Add_comment_to_incident_(V3)	post	/Incidents/Comment	—
Add_comment_to_incident_(V3)_2	post	/Incidents/Comment	—

virustotal (Managed)

Action	Method	Endpoint	Other
Analyse_an_URL	post	/api/v3/urls	—
Retrieve_information_about_a_file_or_URL_analysis	get	/api/v3/analyses/@{encodeURIComponent(body('Analyse_an_URL')?['data']?['id'])}	—

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks · Back to VirusTotal