QVTI Virus Total Integration for Hash Checking

QVTI Virus Total Integration for IBM Security QRadar SIEM (aka QVTI) is an application for checking software process hashes against VirusTotal database using VirusTotal public API.

QVTI checks file hashes against VirusTotal DB and generates offenses for malicious ones.

QVTI relies on the Sysmon log data collected with WinCollect agents.

Automatic Sysmon/WinCollect installation and configuration are possible with the QWAD WinCollect Assisted Deployment application.

QVTI VirusTotal Integration

QRadar Native Alternatives

There is no such native functionality in QRadar. Users have to manually extract hashes from the payload and upload them to VirusTotal.

License

QVTI is a free application by ScienceSoft. Open Source / Apache 2.

Paid VirusTotal subscription is optional and cannot be purchased through ScienceSoft.

IBM App Exchange

QVTI VirusTotal Integration for Hash Checking is officially available at IBM Security App Exchange. Please, follow the link to download it now.