Deep hash enrichment with VirusTotal
Build a reusable workflow that takes a file hash as input. Query VirusTotal for the file report plus behavior reports, comments, and relationship/graph data. Consolidate the results into a structured enrichment summary highlighting verdict, notable behaviors, and related indicators. Handle unknown hashes, rate limits with backoff, and partial data. Output the combined enrichment for use by an analyst or parent workflow.
What this prompt builds
Pull VirusTotal detections, behaviors, comments, and graph data for a hash in one lookup.
The problem
A bare VirusTotal detection ratio doesn't tell an analyst what a file actually does or how it relates to other indicators. Gathering behaviors, comments, and relationships by hand is slow during triage.
Solution and impact
This workflow enriches a hash with VirusTotal's behaviors, comments, graphs, and more for a complete picture. Analysts get deep context in one step and make faster, better-informed verdicts.