PhishER - Spiking VirusTotal Quota
This is a feature request to be able to enumerate API calls to VirusTotal. There seems to be several discrepancies from the data available in the PhishER platform regarding the number of times a file is scanned in PhishER vs. VirusTotal consumption quotas. There have been several occurrences where we've been notified that the daily VirusTotal API quota has been consumed yet the volume of submitted emails does not align with the reported utilization
Thank you for posting! If you navigate to an email within PhishER and expand its history in the sub-tabs you should be able to see the exact times the calls to VirusTotal were made.
My apologies to hear about the discrepancy between the information shown in PhishER vs VirusTotal. I see you also have a Tech Support ticket open which is what I was going to recommend as well to help troubleshoot.
I will make sure to reach out to the assigned tech to share this post with them and additional advice.
Thanks for reaching out to the Community Board. It takes a minimum of two api calls to get the result of any given item from VT and could potentially be multiple ones if we have to wait for a result. This process will take place for each link and each attachment on the email which could add up pretty quickly.
My apologies that you are having this issue and if this continues I would certainly recommend you submit a ticket to us so we can further investigate.
We have also been hitting our VT API quota pretty much daily for the past 2-3 months. And our volume is pretty low. We probably average 30 emails reported to the PhishER a day. The most we've had reported in a single day in the last 3 months is 60. Today we reached our VT API quota by mid-day with just 13 emails reported. Seems like something may be broken with the VT integration.
Por favor, entrar para comentar.