How do you integrate VirusTotal enrichment into an investigation?

VirusTotal enrichment is surfaced directly within Google SecOps investigation views, letting an analyst check a file hash, URL, domain, or IP against VirusTotal's reputation database without leaving the platform or manually cross-referencing a separate tool.

Within an alert or case's investigation view, relevant indicators (like a file hash observed in a process execution event) are automatically enriched with VirusTotal context — detection ratios from multiple antivirus engines, known malware family associations, and related file/URL relationships — giving an analyst immediate reputation context without a manual lookup step interrupting their investigation flow.

Beyond automatic enrichment during investigation, VirusTotal data can also be referenced directly within YARA-L detection rule logic and SOAR playbooks — for example, a playbook step that checks a newly observed file hash against VirusTotal and automatically escalates the case if the hash comes back with a high detection ratio — extending VirusTotal's reputation data from a passive investigation aid into an active input for automated response logic.