Wazuh and VirusTotal Integration: Automated Malware Analysis

To integrate Wazuh with VirusTotal, enable FIM to monitor key directories, add the integration with your VirusTotal API key in ossec.conf, and Wazuh will automatically send the hash of every new or modified file to VirusTotal's 70+ antivirus engines.

How does the Wazuh FIM and VirusTotal integration work?

FIM (File Integrity Monitoring) detects new or modified files, but it doesn't know whether they are malicious. VirusTotal analyzes hashes against more than 70 antivirus engines. By integrating them, Wazuh automatically sends each suspicious file to VirusTotal and you get alerts directly in the dashboard.

What are the limits of the free API?

Before configuring anything, get to know the limits because they determine which directories to watch:

• 4 requests/minute
• 500 requests/day

If you watch too many busy directories, you'll burn through the limit in hours. The fix: be surgical about which directories send files to VirusTotal using the report_changes attribute.

Premium API: Since October 2025, the Lite plan starts at $5,000/year. For labs and mid-sized environments, the free API is enough when properly configured.

Step 1: Get the API key

1. Go to virustotal.com
2. Create a free account if you don't have one
3. Click your avatar → API key
4. Copy the key

Step 2: Configure the integration on the Manager

Edit the Wazuh server configuration file:

nano /var/ossec/etc/ossec.conf

Add this block before the closing </ossec_config> tag:

<integration>
  <name>virustotal</name>
  <api_key>TU_API_KEY_AQUI</api_key>
  <rule_id>550,554</rule_id>
  <alert_format>json</alert_format>
</integration>

Explanation:

• rule_id 550: New file detected by FIM
• rule_id 554: Modified file
• Whenever FIM detects something in a watched directory, it sends the SHA256 hash to VirusTotal

Restart the manager:

systemctl restart wazuh-manager
systemctl status wazuh-manager

Check the integrations log:

tail -f /var/ossec/logs/integrations.log

Step 3: How do you configure FIM on the Agent?

On the agent, edit /var/ossec/etc/ossec.conf and set which directories FIM watches. Only directories with report_changes="yes" will send hashes to VirusTotal:

<syscheck>
  <!-- Full scan once a day -->
  <frequency>86400</frequency>
  <scan_on_start>yes</scan_on_start>

  <!-- HIGH-RISK directories: watched WITH VirusTotal -->
  <directories realtime="yes" check_all="yes" report_changes="yes">/tmp</directories>
  <directories realtime="yes" check_all="yes" report_changes="yes">/root</directories>
</syscheck>

Rationale:

• /tmp, /root: Where malware typically lands → yes, VirusTotal
• /etc, /bin: System changes, not malware → regular FIM, no VirusTotal

Restart the agent:

systemctl restart wazuh-agent

Step 4: How do you test with an EICAR file?

The EICAR test file is a standard for testing antivirus without real malware. Every engine intentionally flags it as malicious.

echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > /tmp/eicar_test.txt

FIM detects the new file → triggers rule 550 → sends the hash to VirusTotal → you get an alert.

Within 30-60 seconds, go to the dashboard: Endpoint Security → Malware Detection

You'll see:

• Rule ID: 87105 (VirusTotal: Alert)
• File: /tmp/eicar_test.txt
• Positives: Number of engines that flagged it
• Permalink: Direct link to the analysis on virustotal.com

Clean up after the test:

rm /tmp/eicar_test.txt

Summary

How do you keep the integration sustainable over time?

The most common mistake is enabling report_changes="yes" across broad directories and exhausting the 500 daily requests before lunchtime. A well-tuned setup typically sends fewer than 50 hashes per day, leaving plenty of headroom inside the free quota. When a real detection fires, the alert reaches the dashboard in roughly 30 to 60 seconds and includes a direct VirusTotal permalink showing how many of the 70+ engines flagged the file, which is invaluable evidence during an incident.

For production environments we recommend pairing this integration with an automated active response, so that a file flagged by multiple engines is quarantined or the agent isolated automatically, rather than waiting for an analyst to react. That turns a passive detection into a containment action measured in seconds instead of hours.

Frequently Asked Questions

How does the Wazuh and VirusTotal integration work?

FIM (File Integrity Monitoring) detects new or modified files in the directories you watch and computes their SHA256 hash. The VirusTotal integration, configured on the Wazuh Manager with your API key, sends that hash to VirusTotal, which checks it against more than 70 antivirus engines. If any engine flags the file as malicious, Wazuh raises rule ID 87105 in the Malware Detection dashboard within 30 to 60 seconds.

What are the limits of the free VirusTotal API?

The free VirusTotal API allows 4 requests per minute and 500 requests per day. Because of this, you should only enable report_changes="yes" on high-risk directories like /tmp and /root, so you don't burn through the daily quota in a few hours. Since October 2025 the paid Lite plan starts at $5,000 per year, but for labs and mid-sized environments the free tier is enough when configured surgically.

Which Wazuh rule IDs trigger the VirusTotal lookup?

Rule ID 550 fires when FIM detects a new file and rule ID 554 fires when it detects a modified file. Both are referenced in the <integration> block with rule_id 550,554, so any change in a watched directory sends the hash to VirusTotal. The resulting VirusTotal alert is rule ID 87105.

What is the EICAR file and why use it to test the integration?

The EICAR test file is an industry-standard string that every antivirus engine intentionally flags as malicious, even though it is completely harmless. It lets you validate the full detection chain (FIM, VirusTotal, dashboard alert) without using real malware. After creating it in /tmp and confirming the alert, you simply delete the file.

Which directories should send files to VirusTotal?

Only directories where malware typically lands, such as /tmp and /root, should use report_changes="yes" and reach VirusTotal. System directories like /etc and /bin change for legitimate reasons (updates, configuration) and would waste your API quota, so they should use regular FIM without the VirusTotal lookup.

Next steps

We cover more integrations like Slack, TheHive, and automated active responses as part of our managed Wazuh service. Discover our Wazuh service.