The VirusTotal integration sends the hash of every file picked up by Wazuh FIM to the VirusTotal API. If 1+ engines flag it, Wazuh raises a high-severity alert and (optionally) deletes the file via Active Response.
1. Get a VirusTotal API key
Sign up at virustotal.com -> Profile -> API Key. The free tier allows 4 lookups/min.
2. Enable the integration on the manager
<integration>
<name>virustotal</name>
<api_key>YOUR_VT_API_KEY</api_key>
<group>syscheck</group>
<alert_format>json</alert_format>
</integration>3. Ensure FIM watches the target directories
<syscheck>
<directories check_all="yes" realtime="yes">/root,/home,/tmp</directories>
</syscheck>4. Restart the manager
systemctl restart wazuh-manager5. Test with the EICAR file
curl -o /root/eicar.com https://secure.eicar.org/eicar.comNote: Look for rule 87105 (VirusTotal: Alert, Source file is malicious) in the dashboard.
We build SOC playbooks around VT, MISP and AbuseIPDB enrichments, reach out via contact.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhVirusTotalThreat Intel