The "Enrich File Hash with VirusTotal via Observable Enrichment Data" workflow template is designed for efficient threat intelligence management in case management and threat hunting scenarios. It optimizes the use of VirusTotal by caching enrichment data for file hashes, reducing redundant API calls. If cached data is outdated or unavailable, it queries VirusTotal, converts the data into an OCSF-compliant format, and updates or creates observables with the latest enrichment data, ensuring up-to-date threat intelligence.
Optional Triggers
["This workflow is intended to be used as a nested workflow."]
Use Cases
Case Management , Threat Hunting
Workflow Breakdown
Enrich Hash with VirusTotal using observables enrichment data as a cache
If enrichment exists and is within TTL, return cached result
Otherwise query VirusTotal for the hash report
Build an OCSF compliant enrichment
Update or create the observable with the enrichment data
Vendors
Utils, VirusTotal, Torq Cases
Workflow Output
Hash Enrichment Converted into an OCSF-Compliant Form