VirusTotal playbook – URL enrichment
In our second hands-on example, we will go through the process of creating a playbook that will utilize incident triggers, and we will run it on an incident that has an URL as an entity. This will help SOC analysts quickly get URL enrichment information and make faster decisions about how to proceed further with the investigation.
Before we begin, you will need the following:
- You need to have access to Microsoft Sentinel with appropriate permissions (Microsoft Sentinel Contributor, Logic App Contributor, and permission to assign RBAC controls – Owner or User Access Administrator).
- You need to have an authenticated VirusTotal Logic App connector (the one we created in the VirusTotal playbook – IP enrichment section). If you didn’t perform the previous hands-on example, return to it for instructions on how to get the API key from VirusTotal.