Phishing analysis
Keepnet + VirusTotal integration
Check URLs, files and IPs against many antivirus and reputation engines.
Keepnet integrates with VirusTotal to check URLs, files and IPs against many antivirus and reputation engines.
What you get
- A verdict added to incidents automatically
- Usable as a condition in playbook rules
- Shown next to the other engines’ results
How it works
- An employee reports an email
- Keepnet sends its URLs, file hashes and IPs to VirusTotal
- The verdict joins the incident and can trigger a playbook
Data and permissions
| Data | Direction | Detail |
|---|---|---|
| URLs, file hashes and IPs from reported emails | Out | Only what this engine checks |
| Verdict | In | Stored with the incident |
| Attachments | Not sent | Hashes only, by default |
What you need
- Your own VirusTotal API key
- Incident Responder
Set up
Company settings, Integrations: paste your API key.
Related integrations
- Works with
- Incident Responder
- Built by
- Keepnet
- Last updated
- October 2026
