- Home
- Malware Analysis Sandboxes
- VirusTotal Intelligence
On the recordRead 9 Oct 202612 facts
VirusTotal Intelligence
Plans and prices
Standard tiers
Priced on request
Advanced searches: 90 days · Retrohunt: 90 days, up to 10K matches per job · Content search (VTGrep): 90 days
Read 9 Oct 2026 · docs.virustotal.com
Threat Hunter PRO
Priced on request
Advanced searches: 1 year · Retrohunt: 1 year, up to 10K matches per job · Content search (VTGrep): 1 year
Read 9 Oct 2026 · docs.virustotal.com
On the record
- API search limit
- The maker says public API search is limited to hash queries, while private API supports combined property-based queries.docs.virustotal.com · read 9 Oct 2026
- Commercial use
- The maker describes the private API as available for commercial or government use and says pricing depends on usage and requires a quote.docs.virustotal.com · read 9 Oct 2026
- Integrations
- VirusTotal documents third-party integrations for security workflows including alert triage, event enrichment, false-positive discarding, detection, and response.docs.virustotal.com · read 9 Oct 2026
- Intended users
- The maker describes premium services as tools for qualified customers and antivirus partners to search for and access harmful file samples for further study.docs.virustotal.com · read 9 Oct 2026
- Premium data
- The private API can include integrated-tool file and URL information, sandbox behavioral data, and goodware signals.docs.virustotal.com · read 9 Oct 2026
- Product
- VirusTotal Intelligence searches its dataset for files matching criteria such as hashes, antivirus detections, metadata, filenames, structural properties, and file size.docs.virustotal.com · read 9 Oct 2026
- Results
- Search results can be sorted by first seen, last seen, detection ratio, submissions, or size, and users can copy hashes or download selected results.docs.virustotal.com · read 9 Oct 2026
- Retrohunt
- The listed Standard tiers allow Retrohunt searches over 90 days and Threat Hunter PRO over one year, with up to 10K matches per job for both.docs.virustotal.com · read 9 Oct 2026
- Search scope
- Its documentation lists file, URL, domain, and IP search modifiers, content search (VTGrep), and file similarity search.docs.virustotal.com · read 9 Oct 2026
- Sensitive indicators
- The Intelligence documentation warns that indicators submitted or queried through the web interface are scanned and added to the dataset for community access, and advises against using sensitive, confidential, or personally identifiable information.docs.virustotal.com · read 9 Oct 2026
- Splunk
- VirusTotal lists VT4Splunk as its official Splunk app for automatically enriching Splunk events with VirusTotal threat intelligence.docs.virustotal.com · read 9 Oct 2026
- Support
- The maker directs users seeking pricing information to contact VirusTotal with their use case and usage estimates for a quote.docs.virustotal.com · read 9 Oct 2026
