---
title: "VirusTotal"
description: "Reference for the Tracecat VirusTotal integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## List threats

Action ID: `tools.virustotal.list_threats`

List threats from VirusTotal.

Reference: [https://docs.virustotal.com/reference/overview](https://docs.virustotal.com/reference/overview)

### Secrets

Required secrets:

- `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="filter" type="string" required>

Filter to apply to the list of threats.

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of threats to return.

Default: `10`.

</ParamField>

## Lookup domain

Action ID: `tools.virustotal.lookup_domain`

Get VirusTotal report for a domain.

Reference: [https://docs.virustotal.com/reference/domain-info](https://docs.virustotal.com/reference/domain-info)

### Secrets

Required secrets:

- `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="domain" type="string" required>

Domain to lookup.

</ParamField>

## Lookup file hash

Action ID: `tools.virustotal.lookup_file_hash`

Get VirusTotal report for a file hash.

Reference: [https://docs.virustotal.com/reference/file-info](https://docs.virustotal.com/reference/file-info)

### Secrets

Required secrets:

- `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="file_hash" type="string" required>

File hash to lookup.

</ParamField>

## Lookup IP address

Action ID: `tools.virustotal.lookup_ip_address`

Get VirusTotal report for an IP address.

Reference: [https://docs.virustotal.com/reference/ip-info](https://docs.virustotal.com/reference/ip-info)

### Secrets

Required secrets:

- `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="ip_address" type="string" required>

IP address to lookup.

</ParamField>

## Lookup URL

Action ID: `tools.virustotal.lookup_url`

Get VirusTotal report for a URL.

Reference: [https://docs.virustotal.com/reference/url-info](https://docs.virustotal.com/reference/url-info)

### Secrets

Required secrets:

- `virustotal`: required values `VIRUSTOTAL_API_KEY`.

### Input fields

<ParamField path="url" type="string" required>

URL to lookup.

</ParamField>
