> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# VirusTotal

> Reference for the Tracecat VirusTotal integration: registered actions, required secrets, expected inputs, and example workflow usage.

## List threats

Action ID: `tools.virustotal.list_threats`

List threats from VirusTotal.

Reference: [https://docs.virustotal.com/reference/overview](https://docs.virustotal.com/reference/overview)

### Secrets

Required secrets:

* `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="filter" type="string" required>
  Filter to apply to the list of threats.
</ParamField>

<ParamField path="limit" type="integer">
  Maximum number of threats to return.

  Default: `10`.
</ParamField>

## Lookup domain

Action ID: `tools.virustotal.lookup_domain`

Get VirusTotal report for a domain.

Reference: [https://docs.virustotal.com/reference/domain-info](https://docs.virustotal.com/reference/domain-info)

### Secrets

Required secrets:

* `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>
  Domain to lookup.
</ParamField>

## Lookup file hash

Action ID: `tools.virustotal.lookup_file_hash`

Get VirusTotal report for a file hash.

Reference: [https://docs.virustotal.com/reference/file-info](https://docs.virustotal.com/reference/file-info)

### Secrets

Required secrets:

* `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="file_hash" type="string" required>
  File hash to lookup.
</ParamField>

## Lookup IP address

Action ID: `tools.virustotal.lookup_ip_address`

Get VirusTotal report for an IP address.

Reference: [https://docs.virustotal.com/reference/ip-info](https://docs.virustotal.com/reference/ip-info)

### Secrets

Required secrets:

* `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="ip_address" type="string" required>
  IP address to lookup.
</ParamField>

## Lookup URL

Action ID: `tools.virustotal.lookup_url`

Get VirusTotal report for a URL.

Reference: [https://docs.virustotal.com/reference/url-info](https://docs.virustotal.com/reference/url-info)

### Secrets

Required secrets:

* `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="url" type="string" required>
  URL to lookup.
</ParamField>