VirusTotal Integration Enhancements
Table of Contents
AutoElevate’s commercially licensed integration with VirusTotal brings a powerful analysis tool to the fingertips of your Engineers as part of AutoElevate’s core product at no additional charge. VirusTotal inspects items with over 70 antivirus scanners and services, in addition to a myriad of tools to extract signals from the studied content. AutoElevate has summarized this file intelligence with easy to understand color signaling so that engineers can easily see the disposition and reputation of items that are being requested quickly with a glance.
Additionally, as part of the integration changes have been made in separation of the Computer security information and the Application security information. This gives the engineer the ability to make decisions based on the disposition of the machine where the request is taking place and based on what’s being requested.
In The Mobile Apps
-
Computer Security Banner– Summarizes basic security information related to the disposition of the machine. The banner changes color from Green, Yellow, to Red depending on the number of checks failed giving engineers a quick and clear visual indication as to the status. By clicking into the banner additional information be displayed.
-
Application Security Banner – Summarizes application security information related to the disposition of the application/process being requested for elevation. The banner changes color from Green, Yellow, to Red depending on the number of checks failed giving engineers a quick and clear visual indication as to the status. By clicking into the banner additional information be displayed including the VirusTotal summary information.
- VirusTotal Summary Banner– Summarizes the information from VirusTotal as to how many anti-virus software manufacturers or services have record of the MD5 hash and how many have scanned it as either good or malicious. Since false positives can exist from any given anti-virus manufacturer or service either 1 or 2 sources showing the item to be malicious would result in a ‘yellow’ or caution banner which would be good to investigate further, 3 or more would result in a Red banner indicating that extreme caution should be taken along with further research. The VirusTotal Summary can be clicked which will automatically launch a browser taking you to the VirusTotal information for that item so that further research can be done.
In the Admin Portal Elevation Requests Screen:
VirusTotal Summary in Tickets:
- VirusTotal Summary Banner– An additional time entry now is entered into the ticket which summarizes the information from VirusTotal as to how many anti-virus software manufacturers or services have record of the MD5 hash and how many have scanned it as either good or malicious. The VirusTotal Summary can be clicked which will automatically launch a browser taking you to the VirusTotal information for that item so that further research can be done.