Scans a file and returns the analysis.

If the file is uploaded to a URL, it is preferred that you use the Scan URL action instead.

Note:: If the analysis is taking too long, this action may return it in a queued state. You can use the Get Analysis action to retrieve it’s completed result later or increase the step timeout.

External Documentation

To learn more, visit the VirusTotal documentation.

​
Parameters

ParameterDescription
File DataContents of the file to upload.
File HashThe SHA-256, SHA-1 or MD5 identifying the file.
File IdentifierThe identifier of the file. You can create a file identifier using the Set File Variable action.
Scan TypeThe type of scan you would like to perform.
Time IntervalThe duration (seconds) between analysis checks.

​
Example Output

{
	"data": {
		"id": "<string>",
		"type": "<string>",
		"links": {
			"self": "<string>",
			"item": "<string>"
		},
		"attributes": {
			"stats": {
				"malicious": 0,
				"suspicious": 2,
				"undetected": 2,
				"harmless": 2,
				"timeout": 0,
				"confirmed-timeout": 1,
				"failure": 1,
				"type-unsupported": 0
			},
			"date": 7389557,
			"status": "<string>",
			"results": {}
		}
	},
	"meta": {
		"file_info": {
			"sha256": "<string>",
			"md5": "<string>",
			"sha1": "<string>",
			"size": 43
		}
	}
}

​
Workflow Library Example

Detect and Respond to Gmail Email Phishing

Preview this Workflow on desktop