Connecting VirusTotal or AbuseIPDB for threat-intel lookups

VirusTotal and AbuseIPDB are on-demand reputation lookups: given an indicator, they tell you whether other sources consider it malicious. Connect either one with your own API key and Qorionix can look up an indicator's reputation and cache the answer for an hour, so repeated lookups of the same value do not spend your rate limit again.

VirusTotal

1. 1

   Get an API key

   In VirusTotal, open your account icon → API Key and copy it. The free public API key works — it is rate-limited to 4 requests per minute, and the connector respects that limit itself.

2. 2

   Connect it in Qorionix

   Under Integrations → Catalog → VirusTotal, choose Threat-intel lookups, paste the key, and press Test — it looks up a known-benign IP address to prove the key works, then Save.

VirusTotal covers IPv4, IPv6, domains, URLs and file hashes. The score reported is the percentage of security engines that flagged the indicator as malicious in VirusTotal's last analysis. An indicator VirusTotal has never analysed comes back as a clean verdict, not an error — a 404 is treated as "nothing bad known," which is the honest reading of no data rather than a lookup failure.

AbuseIPDB

1. 1

   Get an API key

   In AbuseIPDB, go to Account → API → Create Key.

2. 2

   Connect it in Qorionix

   Under Integrations → Catalog → AbuseIPDB, choose Threat-intel lookups, paste the key, and press Test and save.

AbuseIPDB covers IPv4 and IPv6 addresses only — a domain, URL or hash lookup against it is refused before any request is sent, rather than silently returning nothing. The score is AbuseIPDB's own abuse confidence score (0–100); Qorionix treats 50 or higher as malicious, unless the address is on AbuseIPDB's own whitelist.

How a lookup actually gets used

Connecting and testing the key proves the credential works and that you can run a live lookup by hand from the integration's own test. Whether Qorionix automatically enriches an incident's indicators or an automation rule's enrich action with these providers depends on your tenant's automation configuration — that side is covered separately in the SIEM documentation on automation rules. Connecting the credential here is the first step either way.