--- title: Virustotal Hunting slug: connectors/virustotal-hunting docTags: createdAt: 2026-06-09T16:29:50.839Z --- The Virustotal Hunting connector enables automated threat hunting and intelligence gathering from the extensive Virustotal database. Virustotal Hunting is a powerful threat intelligence and hunting service that allows security professionals to search for and detect malware and other threats within their digital environment. This connector enables Swimlane Turbine users to integrate with Virustotal Hunting's API, providing the ability to create, manage, and analyze Livehunt and Retrohunt jobs, as well as retrieve notifications and file matches. By leveraging this integration, users can automate the threat detection process, streamline incident response, and enhance their overall security posture with up-to-date threat intelligence. ### Limitations None to date ### Supported Version This connector supports the VirusTotal Hunting API v3. ## Configuration ## Prerequisites To effectively utilize the VirusTotal Hunting connector within Swimlane Turbine, ensure you have the following prerequisites: - API Key Authentication: - URL: Endpoint URL for the VirusTotal Hunting API. - API Key: Your personal API key provided by VirusTotal. ## Public Key: 1. In order to get the API key, you must first register with the VirusTotal Community by going [here](https://www.virustotal.com/gui/sign-in). Then click **New? Join the community**. 2. Provide a name, email, username, and password. Once complete, click **Join us**. An activation link will be sent to the email you provided. 3. Click on the activation link to activate your VirusTotal Community membership. 4. Return to the VirusTotal homepage and click the blue message icon on the lower right-hand corner of the homepage. This will bring up the VirusTotal Bot window. Click the option, **I have a feed of new files that I can upload, I want free API quota to do so**. 5. A window opens where you can create a message to VirusTotal. Complete the **Subject** and **Email** fields and then include a simple message stating why you need a free API Key. 6. Once VirusTotal reviews your message, you can sign into your account and find your public API in the corresponding menu item, API key, under your username. ### Premium Key: 1. Login to your account. Click your username and then click **API key**. 2. Click **Request premium API key**. 3. Fill out the request prompt on this page. Required fields include "Company size", "Company country", and "Already paying customer?". 4. Virus Total will respond to your request. ## Asset Setup The asset requires an API key to use. If your organization requires the use of a proxy, then that proxy can be used during the asset setup. The Public API: - is limited to 500 requests per day and a rate of 4 requests per minute - must not be used in commercial products or services - must not be used in business workflows that do not contribute new files ## Capabilities - Abort Retrohunt Job - Create Livehunt Ruleset - Create Retrohunt Job - Delete Livehunt Ruleset - Get Livehunt Notification Files - Get Livehunt Notifications - Get Livehunt Rulesets - Get Retrohunt Job - Get Retrohunt Jobs - Get an IoC Stream notification - Get objects from the IoC Stream - Retrieve matches for a Retrohunt job ## Notes - [VirusTotal Hunting API Documentation](https://docs.virustotal.com/reference/authentication) ## Additional Documentation - [Virustotal Hunting Connector Documentation](https://docs.swimlane.com/connectors/virustotal-hunting) - [Virustotal Hunting API Documentation](https://docs.virustotal.com/reference/authentication) - [Virustotal Hunting Authentication Guide](https://docs.swimlane.com/authentication-guides/virustotal-hunting) # Configurations ## VirusTotal Hunting API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | x-apikey | API key | string | Required | | verify\_ssl | Verify SSL certificate. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Abort Retrohunt Job Aborts a specified Retrohunt job in Virustotal Hunting using the provided job ID. ### Endpoint - **URL:** `/api/v3/intelligence/retrohunt_jobs/{{id}}/abort` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Job identifier | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Create Livehunt Ruleset Create a new Virustotal Hunting Livehunt ruleset using specified data attributes provided in the JSON body. ### Endpoint - **URL:** `/api/v3/intelligence/hunting_rulesets` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | -------------------------------------------- | | `data` | object | Optional | Malware Hunting ruleset definition | | `data.type` | string | Required | Must be 'hunting\_ruleset' | | `data.attributes` | object | Required | Response data | | `data.attributes.name` | string | Required | Name of the ruleset | | `data.attributes.rules` | string | Required | YARA rules for the ruleset | | `data.attributes.enabled` | boolean | Optional | Whether the ruleset is enabled | | `data.attributes.limit` | number | Optional | Maximum number of notifications | | `data.attributes.notification_emails` | array | Optional | List of emails to notify | | `data.attributes.match_object_type` | string | Optional | Entity kind to match (file, url, domain, ip) | ### Input Example `{"data":{"type":"hunting_ruleset","attributes":{"name":"Example Name","rules":"string","enabled":true,"limit":123,"notification_emails":["string"],"match_object_type":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `type` | string | Type of the resource | | `id` | string | Unique identifier | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | object | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.enabled` | boolean | Response data | | `data.attributes.limit` | number | Response data | | `data.attributes.creation_date` | number | Response data | | `data.attributes.modification_date` | number | Response data | | `data.attributes.number_of_rules` | number | Response data | | `data.attributes.rules` | string | Response data | | `data.attributes.notification_emails` | array | Response data | | `data.attributes.match_object_type` | string | Response data | ### Output Example `{"type":"hunting_ruleset","id":"{id}","links":{"self":"https://www.virustotal.com/api/v3/intelligence/hunting_ruleset/{id}"},"data":{"attributes":{"name":"foobar","enabled":true,"limit":100,"creation_date":1521016318,"modification_date":1521016318,"number_of_rules":1,"rules":"rule foobar { strings: $ = \"foobar\" condition: all of them }","notification_emails":[],"match_object_type":"file"}}}` ## Create Retrohunt Job Initiates a new Retrohunt job in Virustotal using YARA rules, requiring specific data parameters. ### Endpoint - **URL:** `/api/v3/intelligence/retrohunt_jobs` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ----------------------------------------- | | `data` | object | Optional | Retrohunt job definition | | `data.type` | string | Required | Must be 'retrohunt\_job' | | `data.attributes` | object | Required | Response data | | `data.attributes.rules` | string | Required | YARA rules for the Retrohunt job | | `data.attributes.notification_email` | string | Optional | Email to notify when the job is finished | | `data.attributes.corpus` | string | Optional | Dataset to scan (main or goodware) | | `data.attributes.time_range` | object | Optional | Time range for scanning (UNIX timestamps) | | `data.attributes.time_range.start` | number | Optional | Start timestamp (UTC) | | `data.attributes.time_range.end` | number | Optional | End timestamp (UTC) | ### Input Example `{"data":{"type":"retrohunt_job","attributes":{"rules":"string","notification_email":"string","corpus":"string","time_range":{"start":123,"end":123}}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | ------------------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `type` | string | Type of the resource | | `id` | string | Unique identifier | | `attributes` | object | Output field: attributes | | `attributes.status` | string | Status value | | `attributes.creation_date` | number | Date value | | `attributes.finished_date` | \['number', 'null'] | Date value | | `attributes.ruleset_id` | string | Unique identifier | | `attributes.ruleset_name` | string | Name of the resource | | `attributes.yara_rule` | string | Output field: attributes.yara\_rule | ### Output Example `{"type":"retrohunt_job","id":"1234567890abcdef","attributes":{"status":"running","creation_date":1626960086,"finished_date":null,"ruleset_id":"{ruleset_id}","ruleset_name":"my_ruleset","yara_rule":"rule foobar { strings: $ = \"foobar\" condition: all of them }"}}` ## Delete Livehunt Ruleset Removes a specified Virustotal Hunting Livehunt ruleset using its unique identifier. ### Endpoint - **URL:** `/api/v3/intelligence/hunting_rulesets/{{id}}` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------- | | `path_parameters.id` | string | Required | Ruleset Identifier. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Get an IoC Stream notification Retrieve a specific Indicator of Compromise (IoC) Stream notification by its ID from Virustotal Hunting. ### Endpoint - **URL:** `/api/v3/ioc_stream_notifications/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------- | | `path_parameters.id` | string | Required | The ID of the IoC Stream notification | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | ------------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `type` | string | Type of the resource | | `id` | string | Unique identifier | | `attributes` | object | Output field: attributes | | `attributes.notification_date` | number | Date value | | `attributes.origin` | string | Output field: attributes.origin | | `attributes.sources` | array | Output field: attributes.sources | | `attributes.sources.type` | string | Type of the resource | | `attributes.sources.id` | string | Unique identifier | | `attributes.tags` | array | Output field: attributes.tags | | `attributes.hunting_info` | object | Output field: attributes.hunting\_info | | `attributes.hunting_info.rule_name` | string | Name of the resource | | `attributes.hunting_info.rule_tags` | array | Output field: attributes.hunting\_info.rule\_tags | | `attributes.hunting_info.snippet` | string | Output field: attributes.hunting\_info.snippet | | `attributes.hunting_info.source_country` | string | Output field: attributes.hunting\_info.source\_country | | `attributes.hunting_info.source_key` | string | Output field: attributes.hunting\_info.source\_key | ### Output Example `{"type":"ioc_stream_notification","id":"961092289288866-4582222113734656-3c7f77cc43338e14824c111671beef30","attributes":{"notification_date":1543301214,"origin":"hunting","sources":[{}],"tags":["rats","Bozok"],"hunting_info":{"rule_name":"Bozok","rule_tags":[],"snippet":"00 61 64 64 41 75 64 69 6F [...]","source_country":"US","source_key":"b3190c38"}}}` ## Get objects from the IoC Stream Retrieve filtered objects from the Virustotal Hunting IOC Stream endpoint with support for ordering and pagination. ### Endpoint - **URL:** `/api/v3/ioc_stream` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ----------------------------------------------------------------- | | `parameters.limit` | integer | Optional | Number of objects to retrieve (max 40). | | `parameters.descriptors_only` | boolean | Optional | Return only object descriptors instead of full VT objects. | | `parameters.filter` | string | Optional | Filter string for IoC Stream objects. | | `parameters.cursor` | string | Optional | Continuation cursor for pagination. | | `parameters.order` | string | Optional | Sort order (date- for most recent first, date+ for oldest first). | ### Input Example `{"parameters":{"limit":123,"descriptors_only":true,"filter":"string","cursor":"string","order":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.notification_id` | string | Response data | | `data.attributes.notification_date` | number | Response data | | `data.attributes.origin` | string | Response data | | `data.attributes.sources` | array | Response data | | `data.attributes.sources.type` | string | Response data | | `data.attributes.sources.id` | string | Response data | | `data.attributes.tags` | array | Response data | | `data.attributes.hunting_info` | object | Response data | | `data.attributes.hunting_info.rule_name` | string | Response data | | `data.attributes.hunting_info.rule_tags` | array | Response data | | `data.attributes.hunting_info.snippet` | string | Response data | | `data.attributes.hunting_info.source_country` | string | Response data | | `data.attributes.hunting_info.source_key` | string | Response data | | `meta` | object | Output field: meta | | `meta.cursor` | string | Output field: meta.cursor | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `links.next` | string | Output field: links.next | ### Output Example `{"data":[{"type":"file","id":"{sha256}","attributes":{}}],"meta":{"cursor":"Cu0FCsACCpIC9xuRl9v..."},"links":{"self":"https://www.virustotal.com/api/v3/ioc_stream","next":"https://www.virustotal.com/api/v3/ioc_stream?cursor=Cu0FCsACCpIC9xuRl9v..."}}` ## Get Livehunt Notification Files Retrieve file objects and context attributes related to Virustotal Hunting Livehunt notification matches. ### Endpoint - **URL:** `/api/v3/intelligence/hunting_notification_files` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------- | | `parameters.limit` | integer | Optional | Maximum number of notification files to retrieve. | | `parameters.filter` | string | Optional | Filter files by notification properties (e.g., rule name, ruleset, file hash). | | `parameters.cursor` | string | Optional | Continuation cursor for pagination. | | `parameters.count_limit` | integer | Optional | Maximum number of notification files counted (meta.count in the response) 10,000 Maximum. | ### Input Example `{"parameters":{"limit":123,"filter":"string","cursor":"string","count_limit":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.size` | number | Response data | | `data.attributes.type_description` | string | Response data | | `data.attributes.context_attributes` | object | Response data | | `data.attributes.context_attributes.match_in_subfile` | boolean | Response data | | `data.attributes.context_attributes.notification_date` | number | Response data | | `data.attributes.context_attributes.notification_id` | string | Response data | | `data.attributes.context_attributes.notification_snippet` | string | Response data | | `data.attributes.context_attributes.notification_source_key` | string | Response data | | `data.attributes.context_attributes.notification_tags` | array | Response data | | `data.attributes.context_attributes.ruleset_id` | string | Response data | | `data.attributes.context_attributes.ruleset_name` | string | Response data | | `data.attributes.context_attributes.rule_name` | string | Response data | | `data.attributes.context_attributes.rule_tags` | array | Response data | | `meta` | object | Output field: meta | | `meta.count` | number | Count value | | `meta.cursor` | string | Output field: meta.cursor | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `links.next` | string | Output field: links.next | ### Output Example `{"data":[{"type":"file","id":"{sha256}","attributes":{}}],"meta":{"count":1,"cursor":"Cu0FCsACCpIC9xuRl9v..."},"links":{"self":"https://www.virustotal.com/api/v3/intelligence/hunting_notification_files","next":"https://www.virustotal.com/api/v3/intelligence/hunting_notification_files?cursor..."}}` ## Get Livehunt Notifications Retrieve notifications from Virustotal Hunting Livehunt triggered by user-defined or shared rulesets. ### Endpoint - **URL:** `/api/v3/intelligence/hunting_notifications` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------------------------------------- | | `parameters.limit` | number | Optional | Maximum number of notifications to retrieve. | | `parameters.filter` | string | Optional | Filter notifications by attribute (e.g., tag, owner, date). | | `parameters.cursor` | string | Optional | Continuation cursor for pagination. | | `parameters.count_limit` | number | Optional | Maximum number of notifications counted (meta.count in the response). | ### Input Example `{"parameters":{"limit":10,"filter":"string","cursor":"string","count_limit":200}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.date` | number | Response data | | `data.attributes.ruleset_name` | string | Response data | | `data.attributes.file_sha256` | string | Response data | | `data.attributes.tags` | array | Response data | | `data.attributes.owner` | string | Response data | | `meta` | object | Output field: meta | | `meta.count` | number | Count value | | `meta.cursor` | string | Output field: meta.cursor | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `links.next` | string | Output field: links.next | ### Output Example `{"data":[{"type":"hunting_notification","id":"{notification_id}","attributes":{}}],"meta":{"count":10,"cursor":"Cu0FCsACCpIC9xuRl9v..."},"links":{"self":"https://www.virustotal.com/api/v3/intelligence/hunting_notifications","next":"https://www.virustotal.com/api/v3/intelligence/hunting_notifications?cursor=Cu0F..."}}` ## Get Livehunt Rulesets Obtain Virustotal Hunting Livehunt rulesets with details and sharing information accessible to the user. ### Endpoint - **URL:** `/api/v3/intelligence/hunting_rulesets` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------- | | `parameters.limit` | number | Optional | Maximum number of rulesets to retrieve. | | `parameters.filter` | string | Optional | Filter rulesets by attribute. | | `parameters.order` | string | Optional | Sort order. | | `parameters.cursor` | string | Optional | Continuation cursor. | ### Input Example `{"parameters":{"limit":10,"filter":"string","order":"string","cursor":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.links` | object | Response data | | `data.links.self` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.creation_date` | number | Response data | | `data.attributes.enabled` | boolean | Response data | | `data.attributes.limit` | number | Response data | | `data.attributes.modification_date` | number | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.notification_emails` | array | Response data | | `data.attributes.notification_emails.file_name` | string | Response data | | `data.attributes.notification_emails.file` | string | Response data | | `data.attributes.rules` | string | Response data | | `meta` | object | Output field: meta | | `meta.cursor` | string | Output field: meta.cursor | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `links.next` | string | Output field: links.next | ### Output Example `{"data":[{"type":"hunting_ruleset","id":"{id}","links":{},"attributes":{}}],"meta":{"cursor":"Cu0FCsACCpIC9xuRl9v..."},"links":{"self":"https://www.virustotal.com/api/v3/users/{user}/hunting_rulesets","next":"https://www.virustotal.com/api/v3/users/{user}/hunting_rulesets?cursor=Cu0FCsACC..."}}` ## Get Retrohunt Job Retrieve details of a specific Retrohunt Job in Virustotal Hunting using the provided job ID. ### Endpoint - **URL:** `/api/v3/intelligence/retrohunt_jobs/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------- | | `path_parameters.id` | string | Required | Job identifier | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | ------------------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `type` | string | Type of the resource | | `id` | string | Unique identifier | | `attributes` | object | Output field: attributes | | `attributes.status` | string | Status value | | `attributes.creation_date` | number | Date value | | `attributes.finished_date` | \['number', 'null'] | Date value | | `attributes.ruleset_id` | string | Unique identifier | | `attributes.ruleset_name` | string | Name of the resource | | `attributes.yara_rule` | string | Output field: attributes.yara\_rule | ### Output Example `{"type":"retrohunt_job","id":"1234567890abcdef","attributes":{"status":"running","creation_date":1626960086,"finished_date":null,"ruleset_id":"{ruleset_id}","ruleset_name":"my_ruleset","yara_rule":"rule my_rule { condition: true }"}}` ## Retrieve matches for a Retrohunt job Retrieve files matching a specific Virustotal Hunting Retrohunt job using the provided job ID, with pagination. ### Endpoint - **URL:** `/api/v3/intelligence/retrohunt_jobs/{{id}}/matching_files` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------- | | `path_parameters.id` | string | Required | Job identifier | | `parameters.limit` | integer | Optional | Maximum number of matching files to retrieve. | | `parameters.cursor` | string | Optional | Continuation cursor for pagination. | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"limit":123,"cursor":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.size` | number | Response data | | `data.attributes.type_description` | string | Response data | | `meta` | object | Output field: meta | | `meta.cursor` | string | Output field: meta.cursor | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `links.next` | string | Output field: links.next | ### Output Example `{"data":[{"type":"file","id":"{sha256}","attributes":{}}],"meta":{"cursor":"Cu0FCsACCpIC9xuRl9v..."},"links":{"self":"https://www.virustotal.com/api/v3/intelligence/retrohunt_jobs/1234567890abcdef/m...","next":"https://www.virustotal.com/api/v3/intelligence/retrohunt_jobs/1234567890abcdef/m..."}}` ## Get Retrohunt Jobs Retrieve a list of Retrohunt Job objects from VirusTotal, optionally filtered by job status. ### Endpoint - **URL:** `/api/v3/intelligence/retrohunt_jobs` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.limit` | integer | Optional | Maximum number of jobs to retrieve. | | `parameters.filter` | string | Optional | Filter jobs by status (e.g., status\:running). | | `parameters.cursor` | string | Optional | Continuation cursor for pagination. | ### Input Example `{"parameters":{"limit":123,"filter":"string","cursor":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | ------------------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.status` | string | Response data | | `data.attributes.creation_date` | number | Response data | | `data.attributes.finished_date` | \['number', 'null'] | Response data | | `data.attributes.ruleset_id` | string | Response data | | `data.attributes.ruleset_name` | string | Response data | | `data.attributes.yara_rule` | string | Response data | | `meta` | object | Output field: meta | | `meta.cursor` | string | Output field: meta.cursor | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `links.next` | string | Output field: links.next | ### Output Example `{"data":[{"type":"retrohunt_job","id":"{job_id}","attributes":{}}],"meta":{"cursor":"Cu0FCsACCpIC9xuRl9v..."},"links":{"self":"https://www.virustotal.com/api/v3/intelligence/retrohunt_jobs","next":"https://www.virustotal.com/api/v3/intelligence/retrohunt_jobs?cursor=Cu0FCsACCpI..."}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |