Before you start
This integration is only relevant for users of Phish Triage. Enabling the integration does not automatically scan email - scans are manual and must be initiated by an analyst or admin in the triage UI.
What you need before you begin:
A VirusTotal API key (work with your VirusTotal account owner / procurement).
Legal/privacy approval to send email-related artifacts to VirusTotal. Files uploaded to VirusTotal may be stored or shared per VirusTotal’s terms - do not submit private, regulated, or confidential data.
Admin access to the Adaptive admin console and to Phish Triage.
Summary
When configured, the triage UI lets analysts manually submit email links and attachments to VirusTotal for analysis.
URLs: we resolve redirects and scan the final (last) redirect.
Attachments: we compute a SHA256 hash first and only upload the file if the analyst requests a scan and no VirusTotal report exists.
Results surface “Detected by X of Y engines” and a link to the full VirusTotal report.
Timing: URL scans typically complete in ~1 minute; file analyses can take a few minutes depending on size and account tier.
Rate limits: We leverage the Public API to initiate VirusTotal scans. Public/free API keys have defined rate limits. Heavy use of the functionality can lead to per-minute or daily rate limiting.
Connection Steps
Follow these steps to add and configure VirusTotal in the admin console. Screenshots are placeholders — replace them with your product screenshots.
1. Legal & scope
Obtain privacy/legal sign-off for sending email artifacts to VirusTotal.
2. Add API key
Admin console → Integrations → VirusTotal → Connect
Paste the VirusTotal API key into the API key field.
Accept the privacy disclaimer (required). Use this one-line checkbox:
I acknowledge that email links and attachments will be sent to VirusTotal when manually scanned and that files may be stored or shared per VirusTotal’s terms.
Click Save and Connect.
The system verifies the API key, stores an encrypted version of the key, and records the admin acceptance.
Tutorial — How to scan files and attachments
The triage UI provides a Scan with VirusTotal action for links and attachments. Nothing is sent automatically - an analyst must initiate each scan.
Scan a link (step-by-step)
In Triage, open the email and locate the link you want to scan.
Click “Run Scan” for the selected link
The interface shows status: Queued → Scanning → Results.
When complete, view the results
The external link brings you to the full VirusTotal Report
