PhishER - Spiking VirusTotal Quota

Tevin Ray

2022. augusztus 25. 19:17

This is a feature request to be able to enumerate API calls to VirusTotal. There seems to be several discrepancies from the data available in the PhishER platform regarding the number of times a file is scanned in PhishER vs. VirusTotal consumption quotas. There have been several occurrences where we've been notified that the daily VirusTotal API quota has been consumed yet the volume of submitted emails does not align with the reported utilization

0

• 

  Kelsey Leonard 2022. augusztus 26. 13:04

  Hello Tevin,

  Thank you for posting! If you navigate to an email within PhishER and expand its history in the sub-tabs you should be able to see the exact times the calls to VirusTotal were made.

  My apologies to hear about the discrepancy between the information shown in PhishER vs VirusTotal. I see you also have a Tech Support ticket open which is what I was going to recommend as well to help troubleshoot.

  I will make sure to reach out to the assigned tech to share this post with them and additional advice.

  Kindest regards,

  Kelsey Leonard

  KnowBe4

  0

  Hozzászólás-műveletek Permalink
• 

  Matthew Bates 2022. december 1. 18:19

  We are having this problem too. 60 scans within the PhishER platform, somehow turns into 1000 API calls according to VirusTotal.

  0

  Hozzászólás-műveletek Permalink
• 

  Christian Nostrom 2022. december 2. 22:51

  Hello Matthew,

  Thanks for reaching out to the Community Board.  It takes a minimum of two api calls to get the result of any given item from VT and could potentially be multiple ones if we have to wait for a result.  This process will take place for each link and each attachment on the email which could add up pretty quickly.  

  My apologies that you are having this issue and if this continues I would certainly recommend you submit a ticket to us so we can further investigate.  

   Thank you,

  0

  Hozzászólás-műveletek Permalink
• 

  Russell DeHennis 2022. december 7. 21:52

  We have also been hitting our VT API quota pretty much daily for the past 2-3 months. And our volume is pretty low. We probably average 30 emails reported to the PhishER a day. The most we've had reported in a single day in the last 3 months is 60. Today we reached our VT API quota by mid-day with just 13 emails reported. Seems like something may be broken with the VT integration. 

  0

  Hozzászólás-műveletek Permalink
• 

  Jaclyn Turko 2022. december 8. 15:01

  Hello Russell,

  Thank you for your post! We would love to work with you on looking into your VT API circumstances. I have created a ticket with you for your convenience and a support member will be reaching out to you.

   

  Best,

  0

  Hozzászólás-műveletek Permalink

Hozzászólások írásához jelentkezzen be.