The Torq workflow template "Cache VirusTotal Threat Intelligence Findings on an IOC" automates threat intelligence processes by checking and caching indicators of compromise (IOC). When triggered, the workflow checks if the IOC has been analyzed within the past 6 hours, utilizing a Global Variable for quick reference. If previously analyzed, it returns the saved data; otherwise, it queries VirusTotal for fresh threat intelligence, then saves and returns the findings. This ensures efficient IOC management and quick access to relevant threat data for security operations.**Use Case**: Threat Intelligence Enrichment **Output**: VirusTotal IOC Information
Optional Triggers
["Webhook"]
Use Cases
Threat Intelligence Enrichment
Workflow Breakdown
Trigger the workflow and provide an IOC
Lookup the Global Variable to see if the IOC has been saved in the past 6 hours
If a Global Variable matches the IOC, return the saved data to the parent workflow
If Global Variable is not found, pull VirusTotal and store the threat intel in the Global Variable
Return the VirusTotal information for the IOC on the exit of the workflow
Vendors
Utils, VirusTotal, Torq
Workflow Output
Result of the IOC information from VirusTotal