|
| 1 | +# Check virustotal-scan-url |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +Analyses URLs to detect malware and other breaches using [VirusTotal](https://www.virustotal.com/). |
| 6 | + |
| 7 | +Hints: |
| 8 | + |
| 9 | +* In order to use this plugin, you will need to create a VirusTotal account. |
| 10 | +* This plugin uses the [VirusTotal API v3](https://docs.virustotal.com/reference/overview). See the [documentation](https://docs.virustotal.com/reference/public-vs-premium-api) on any constraints and restrictions, especially for commercial use. |
| 11 | + |
| 12 | + |
| 13 | +## Fact Sheet |
| 14 | + |
| 15 | +| Fact | Value | |
| 16 | +|----|----| |
| 17 | +| Check Plugin Download | <https://github.com/Linuxfabrik/monitoring-plugins/tree/main/check-plugins/virustotal-scan-url> | |
| 18 | +| Check Interval Recommendation | Once an hour | |
| 19 | +| Can be called without parameters | No | |
| 20 | +| Requirements | VirusTotal account, VirusTotal API key and Premium API if this plugin is used in business workflows that do not contribute new files or in commercial products/services. | |
| 21 | + |
| 22 | + |
| 23 | +## Help |
| 24 | + |
| 25 | +```text |
| 26 | +usage: virustotal-scan-url [-h] [-V] [--always-ok] [--insecure] [--no-proxy] |
| 27 | + [--severity {warn,crit}] [--test TEST] |
| 28 | + [--timeout TIMEOUT] --token TOKEN --url URL |
| 29 | +
|
| 30 | +Analyses URLs to detect malware and other breaches using VirusTotal. |
| 31 | +
|
| 32 | +options: |
| 33 | + -h, --help show this help message and exit |
| 34 | + -V, --version show program's version number and exit |
| 35 | + --always-ok Always returns OK. |
| 36 | + --insecure This option explicitly allows to perform "insecure" |
| 37 | + SSL connections. Default: False |
| 38 | + --no-proxy Do not use a proxy. Default: False |
| 39 | + --severity {warn,crit} |
| 40 | + Severity for alerting. Default: warn |
| 41 | + --test TEST For unit tests. Needs "path-to-stdout-file,path-to- |
| 42 | + stderr-file,expected-retc". |
| 43 | + --timeout TIMEOUT Network timeout in seconds. Default: 8 (seconds) |
| 44 | + --token TOKEN VirusTotal API token |
| 45 | + --url URL URL to scan. |
| 46 | +``` |
| 47 | + |
| 48 | + |
| 49 | +## Usage Examples |
| 50 | + |
| 51 | +```bash |
| 52 | +./virustotal-scan-url --token b480bd43 --url https://secure.eicar.org/eicar.com |
| 53 | +``` |
| 54 | + |
| 55 | +Output: |
| 56 | + |
| 57 | +```text |
| 58 | +9/97 security vendors flagged https://secure.eicar.org/eicar.com as malicious. |
| 59 | +
|
| 60 | +Engine ! Result ! Method ! Category |
| 61 | +------------+------------+-----------+-------------------- |
| 62 | +Antiy-AVL ! malicious ! blacklist ! malicious [WARNING] |
| 63 | +AutoShun ! malicious ! blacklist ! malicious [WARNING] |
| 64 | +BitDefender ! malware ! blacklist ! malicious [WARNING] |
| 65 | +CRDF ! malicious ! blacklist ! malicious [WARNING] |
| 66 | +Fortinet ! malware ! blacklist ! malicious [WARNING] |
| 67 | +G-Data ! malware ! blacklist ! malicious [WARNING] |
| 68 | +Lionic ! malware ! blacklist ! malicious [WARNING] |
| 69 | +Sophos ! malware ! blacklist ! malicious [WARNING] |
| 70 | +URLQuery ! suspicious ! blacklist ! suspicious |
| 71 | +VIPRE ! malware ! blacklist ! malicious [WARNING] |
| 72 | +``` |
| 73 | + |
| 74 | + |
| 75 | +## States |
| 76 | + |
| 77 | +* Alerts according to the given severity level (default: WARN due to the many false positives on VT) if the scanner's result falls into the "malicious" category. |
| 78 | + |
| 79 | + |
| 80 | +## Perfdata / Metrics |
| 81 | + |
| 82 | +According to <https://docs.virustotal.com/reference/analyses-object>: |
| 83 | + |
| 84 | +| Name | Type | Description | |
| 85 | +|----|----|----| |
| 86 | +| harmless | Number | Number of reports saying that is harmless. | |
| 87 | +| malicious | Number | Number of reports saying that is malicious. | |
| 88 | +| suspicious | Number | Number of reports saying that is suspicious. | |
| 89 | +| timeout | Number | Number of timeouts when analysing this URL. | |
| 90 | +| undetected | Number | Number of reports saying that is undetected. | |
| 91 | +| vendors | Number | Number of scan vendors used. | |
| 92 | + |
| 93 | + |
| 94 | +## Credits, License |
| 95 | + |
| 96 | +* Authors: [Linuxfabrik GmbH, Zurich](https://www.linuxfabrik.ch) |
| 97 | +* License: The Unlicense, see [LICENSE file](https://unlicense.org/). |
0 commit comments