VirusTotal Collections- VT Insights

A collection is a live report which contains a title, a group of IoCs (file hashes, URLs, domains and IP addresses) and an optional description. Collections are open to our VirusTotal Community (registered users) and they will be enhanced with VirusTotal analysis metadata providing the latest information we have for the IoCs, along with some aggregated tags. 

Collection creation

Collection report

Own Collection Dashboard

On quota exceeded

API Usage

Collection creation

You can create a collection through the home view by clicking on the "create an IoC collection" link as shown below:

You need to add a name, a list of IoCs (file hashes, URLs, domains and IP addresses) and then click on Create collection.

Collection report

After your collection is created, you'll see a report that looks like this.

We've numbered the elements in the screenshot above for easy reference. They are:

1) You can share the collection permanent link or post it to Twitter.

2) The collection provides exporting capabilities in STIX, JSON and CSV formats.

3) Open the IOCs in an VT Graph.

4) You can more IOCs.

5) Delete the collection.

6) Add a description.

7) Edit IOCs of an specific type: you can add more IOCs or delete selected ones.

8) You can sort the IOCs by Creation date, Last update date or Detections.

9) You can search for IOCs of an specific type to filter the results.

10) You can export IOCs of an specific type in STIX, JSON and CSV formats. You can also copy to clipboard. For files you can Download a selection of them.

11) Different Tools depending on the IOC type: Send to VT Diff, Open in VT Graph or Calculate commonalities.

Own Collection Dashboard

Users can see their created collections in their profile page, as they currently do for graphs and comments.

Collections Visibility

All user generated collections are available in VT under the community section of VirusTotal reports. This way our users benefit from other analysis investigations.

Twitter Integration

Security community is very active using twitter to promote their investigations. The VT Collection report shows the following card on Twitter.

On quota exceeded

Public users will have a quota of 20 Collections per month, if you reach the limit you would find the following message.

API Usage

As usual we have also most of the functionality available using our API v3 , in this case with the exception of the exporting feature that is still only available on our web interface. You can check the API documentation in our API Reference page.