Detection & Response Enablement
Aperçu
VirusTotal Livehunt connector imports malware samples matching custom YARA rules in real time, creating incidents, file observables, and YARA indicators in OpenCTI.
VirusTotal Livehunt is a YARA-based real-time scanning service that alerts users when new files matching their rules are submitted to VirusTotal. This connector fetches Livehunt notifications and creates corresponding incidents, file objects, and YARA indicators in OpenCTI.
Key features:
- Real-time import of malware samples matching custom YARA rules
- Incident/alert creation for each notification
- File observable and artifact creation with hash metadata
- YARA indicator generation from matching rules
- Configurable filters: file extensions, size, age, and minimum AV detections