Threat Lookup - VirusTotal workflow

---
title: Threat Lookup - VirusTotal workflow
description: The Threat Lookup - VirusTotal workflow performs a lookup on selected observables. If the observables are of a type recognized by VirusTotal, the observables are scanned for malware, and the results are returned.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-lookup-virustotal-wf.html
release: australia
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [VirusTotal integration, Threat Intelligence integrations, Threat Intelligence, Enterprise security case management applications, Security Operations]
---

# Threat Lookup - VirusTotal workflow

The Threat Lookup - VirusTotal workflow performs a lookup on selected observables. If the observables are of a type recognized by VirusTotal, the observables are scanned for malware, and the results are returned.

## Before you begin

Role required: admin

## About this task

This workflow is triggered by the [Security Operations Integration - Threat Lookup capability](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sec-ops-threat-lookups-capability.md) when you perform a threat lookup on one or more observables, and the VirusTotal implementation is selected. For more information, see [Perform lookups on observables](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/perform-lookups-on-observables.md).

\[Omitted image "hreat-lookup-virustotal-wf.png"\] Alt text: Threat Lookup - VirusTotal workflow

For information on the activities used by this workflow, see [Common Security Operations integration flows and orchestration activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/common-wf-activities.md).