@@ -0,0 +1,874 @@
+import requests%0A%0Afrom configparser import ConfigParser%0A%0A_VTAPI = 'https://www.virustotal.com/vtapi/v2/'%0A%0A_config = ConfigParser()%0A_config.read('virustotal.conf')%0A%0A_VT_APIKEY = ''%0Atry:%0A%09_VT_APIKEY = _config.get('VirusTotal', 'apikey')%0Aexcept:%0A%09_VT_APIKEY = None%0A%0Adef action(alert, field, kwargs):%0A%09'''Perform a virus total lookup of a hash.%0A%09'''%0A%0A%09if _VT_APIKEY is None:%0A%09%09return 'Your VirusTotal API key has not been configured. Skipping VirusTotal action'%0A%0A%09parameters = %7B%0A%09%09'resource' : field,%0A%09%09'apikey' : _VT_APIKEY%0A%09%7D%0A%0A%09r = requests.post('%25sfile/report' %25 (_VTAPI),%0A%09%09%09%09%09%09data=parameters)%0A%09report = r.json()%0A%09if report.get('response_code') == 1:%0A%09%09return '''%0A%60%60%60%0AVirusTotal%0A%25s%0A%25s/%25s%0A%60%60%60%0AFor more information see: %25s%0A''' %25 (report%5B'scan_date'%5D, %0A%09%09report%5B'positives'%5D, %0A%09%09report%5B'total'%5D,%0A%09%09report%5B'permalink'%5D)%0A%09else:%0A%09%09return '''%0A%60%60%60%0AVirusTotal%0AFile not found.%0A%60%60%60%0A'''

add virustotal action