VirusTotal is a cybersecurity platform that analyzes files, URLs, and domains for malware and suspicious content using multiple antivirus engines and security tools, providing comprehensive threat intelligence for security professionals.
Power end-to-end data operations for your VirusTotal API with Nexla. Our bi-directional VirusTotal connector is purpose-built for VirusTotal, making it simple to ingest data, sync it across systems, and deliver it anywhere — all with no coding required. Nexla turns API-sourced data into ready-to-use, reusable data products and makes it easy to send data to VirusTotal or any other destination. With comprehensive monitoring, lineage tracking, and access controls, Nexla keeps your VirusTotal workflows fast, secure, and fully governed.
Features
Type: API
SourceDestination
Seamless API Integration: Connect to any endpoint as source or destination without coding, with automatic data product creation
Visual Composition & Chaining: Build complex integrations using visual templates, chain API calls, and compose workflows with data validation and filtering
API Proxy: Expose curated slices of your data securely with a secure and customizable API proxy that validates and transforms data on the fly
Request optimization with intelligent batching, retry, and caching to minimize API calls and costs
Before creating a VirusTotal credential, you need to obtain your Personal API Key from your VirusTotal account. VirusTotal uses API key authentication for all API requests, with the key sent in the x-apikey header.
To obtain your VirusTotal Personal API Key, follow these steps:
Sign in to your VirusTotal account using your administrator credentials.
Navigate to your account settings by clicking on your profile icon in the top right corner of the VirusTotal dashboard, then select My API Key or API Settings.
In your account settings, navigate to the API Key section or Personal API Key tab.
If you don't have a personal API key yet, click Generate API Key or Create API Key to create a new personal API key.
Configure your API key settings:
Enter a name for the API key (e.g., "Nexla Integration")
Review the API key permissions or scopes (if applicable)
Click Create or Generate to create the API key
After the API key is created, copy the Personal API Key value immediately, as it may not be accessible again after you navigate away from the page.
Store the API key securely, as you will need it to configure your Nexla credential. The Personal API Key is sensitive information and should be kept confidential.
The Personal API Key is sent in the x-apikey header for all API requests to the VirusTotal API. The key authenticates your requests and grants access to VirusTotal resources based on your account permissions. If your API key is compromised, you should immediately revoke it in your VirusTotal account settings and generate a new one. For detailed information about obtaining personal API keys, API authentication, and available endpoints, refer to the VirusTotal API documentation.
After selecting the data source/destination type, click the Add Credential tile to open the Add New Credential overlay.
New Credential Overlay – VirusTotal
Enter a name for the credential in the Credential Name field and a short, meaningful description in the Credential Description field.
Enter your API Key in the API Key field. This is the VirusTotal Personal API key. Your API key can be found in your VirusTotal account user menu. The API key is sent in the x-apikey header for all API requests to the VirusTotal API and must be kept confidential.
Your VirusTotal Personal API key can be found in your VirusTotal account user menu under My API Key or API Settings. The API key is sent in the x-apikey header for all API requests to the VirusTotal API.
If your API key is compromised, you should immediately revoke it in your VirusTotal account settings and generate a new one. The Personal API Key provides access to your VirusTotal account data and should be treated as sensitive information. Keep your API key secure and do not share it publicly.
Click the Save button at the bottom of the overlay. The newly added credential will now appear in a tile on the Authenticate screen during data source/destination creation.
To create a new data flow, navigate to the Integrate section, and click the New Data Flow button. Select the VirusTotal connector tile, then select the credential that will be used to connect to the VirusTotal instance, and click Next; or, create a new VirusTotal credential for use in this flow.
Nexla provides pre-built templates that can be used to rapidly configure data sources to ingest data from common VirusTotal endpoints. Each template is designed specifically for the corresponding VirusTotal endpoint, making data source setup easy and efficient. Select the endpoint from which this source will fetch data from the Endpoint pulldown menu. Available endpoint templates are listed in the expandable boxes below.
Get Domain Information
This endpoint template retrieves VirusTotal information about one internet domain name from your VirusTotal account. Use this template when you need to access domain security information, threat intelligence, or domain metadata for analysis, reporting, or integration purposes.
Enter the Domain Name in the Domain Name field. This should be the internet domain name for which you want VirusTotal information. The Domain Name determines which domain's information will be retrieved.
This endpoint returns VirusTotal information about one internet domain name from your VirusTotal account, including security analysis, threat intelligence, reputation data, and other domain metadata.
For detailed information about domain information, API response structures, and available domain data, see the VirusTotal API documentation.
Get Domain Information from Lookup
This endpoint template retrieves VirusTotal information about internet domain names stored in a Nexla lookup table. Use this template when you need to batch fetch domain security information for multiple domains from a lookup table for analysis, reporting, or integration purposes.
Select the Lookup for fetching Domain Names from the Lookup for fetching Domain Names pulldown menu. This should be the Nexla Lookup that contains Domain Names to iterate over. The Lookup determines which domain names will be used to fetch information.
Enter the Domain Name column name in Lookup in the Domain Name column name in Lookup field. This should be the column name in the lookup table that contains the domain names. The Domain Name column name determines which column will be used to extract domain names from the lookup table.
This endpoint retrieves VirusTotal information about internet domain names stored in a Nexla lookup table, allowing you to batch fetch domain security information for multiple domains efficiently. The endpoint iterates over the lookup table and fetches information for each domain name in the specified column.
For detailed information about domain information, API response structures, and available domain data, see the VirusTotal API documentation.
Get URL Information
This endpoint template retrieves VirusTotal information about one URL from your VirusTotal account. URL must be a VirusTotal URL identifier or base64 representation of URL to scan (without padding). Use this template when you need to access URL security information, threat intelligence, or URL metadata for analysis, reporting, or integration purposes.
Enter the URL Identifier in the URL Identifier field. This should be a VirusTotal URL identifier or base64 representation of URL to scan (without padding). The URL Identifier determines which URL's information will be retrieved.
This endpoint returns VirusTotal information about one URL from your VirusTotal account, including security analysis, threat intelligence, reputation data, and other URL metadata. The URL must be a VirusTotal URL identifier or base64 representation of URL to scan (without padding).
For detailed information about URL information, API response structures, and available URL data, see the VirusTotal API documentation.
Get URL Information from Lookup
This endpoint template retrieves VirusTotal information about URLs stored in a Nexla lookup table. URLs must be VirusTotal URL identifiers or base64 representation of URLs to scan (without padding). Use this template when you need to batch fetch URL security information for multiple URLs from a lookup table for analysis, reporting, or integration purposes.
Select the Lookup for fetching URL Identifiers from the Lookup for fetching URL Identifiers pulldown menu. This should be the Nexla Lookup that contains URL Identifiers to iterate over. The Lookup determines which URL identifiers will be used to fetch information.
Enter the URL Identifier column name in Lookup in the URL Identifier column name in Lookup field. This should be the column name in the lookup table that contains the URL identifiers. The URL Identifier column name determines which column will be used to extract URL identifiers from the lookup table.
This endpoint retrieves VirusTotal information about URLs stored in a Nexla lookup table, allowing you to batch fetch URL security information for multiple URLs efficiently. URLs must be VirusTotal URL identifiers or base64 representation of URLs to scan (without padding). The endpoint iterates over the lookup table and fetches information for each URL identifier in the specified column.
For detailed information about URL information, API response structures, and available URL data, see the VirusTotal API documentation.
Get IP Address Information
This endpoint template retrieves VirusTotal information about an IP address from your VirusTotal account. Use this template when you need to access IP address security information, threat intelligence, or IP address metadata for analysis, reporting, or integration purposes.
Enter the IP Address in the IP Address field. This should be the IP address for which you want VirusTotal information. The IP Address determines which IP address's information will be retrieved.
This endpoint returns VirusTotal information about an IP address from your VirusTotal account, including security analysis, threat intelligence, reputation data, and other IP address metadata.
For detailed information about IP address information, API response structures, and available IP address data, see the VirusTotal API documentation.
Get IP Address Information from Lookup
This endpoint template retrieves VirusTotal information about IP addresses stored in a Nexla lookup table. Use this template when you need to batch fetch IP address security information for multiple IP addresses from a lookup table for analysis, reporting, or integration purposes.
Select the Lookup for fetching IP Addresses from the Lookup for fetching IP Addresses pulldown menu. This should be the Nexla Lookup that contains IP Addresses to iterate over. The Lookup determines which IP addresses will be used to fetch information.
Enter the IP Address column name in Lookup in the IP Address column name in Lookup field. This should be the column name in the lookup table that contains the IP addresses. The IP Address column name determines which column will be used to extract IP addresses from the lookup table.
This endpoint retrieves VirusTotal information about IP addresses stored in a Nexla lookup table, allowing you to batch fetch IP address security information for multiple IP addresses efficiently. The endpoint iterates over the lookup table and fetches information for each IP address in the specified column.
For detailed information about IP address information, API response structures, and available IP address data, see the VirusTotal API documentation.
Once the selected endpoint template has been configured, click the Test button to the right of the endpoint selection menu to retrieve a sample of the data that will be fetched. Sample data will be displayed in the Endpoint Test Result panel on the right, allowing you to verify that the source is configured correctly before saving.
VirusTotal data sources can also be manually configured to ingest data from any valid VirusTotal API endpoint, including endpoints not covered by the pre-built templates or custom request parameters. Select the Advanced tab at the top of the configuration screen, and follow the instructions in Connect to Any API to configure the API method, endpoint URL, and path to data.
Once all of the relevant settings have been configured, click the Create button in the upper right corner of the screen to save and create the new VirusTotal data source. Nexla will now begin ingesting data from the configured endpoint and will organize any data that it finds into one or more Nexsets.
