VirusTotal, on your own key
VirusTotal lookups on scan findings now run on a key you connect under Integrations, count against your own quota, and stay in your tenant. The shared key they used to run on was a free public key, which VirusTotal does not license for a commercial service.
When a scan matches a rule on a file, the finding is more useful if it can also say whether that exact file is known malware. Until today, Wegweiser asked VirusTotal about every flagged file in every tenant, on one shared key. From today, VirusTotal is an integration: it runs on a key you connect, or not at all.
Why it changed
The shared key was a free public VirusTotal key. VirusTotal's terms say a public key must not be used in commercial products or services, and a service an MSP runs for its clients is one. It was also too small: the fleet flags around 590 distinct files a day, and a public key allows 500 lookups. On Saturday night it ran out, and every lookup after that came back refused.
A platform licence that covered every tenant would have to be paid for by every tenant, including the ones who already hold a VirusTotal licence of their own. So it is yours to connect instead.
Connecting it
Under Integrations > VirusTotal, paste a VirusTotal premium or Google Threat Intelligence API key and confirm it is licensed for commercial use. That statement is recorded with your name and the time, because VirusTotal does not say which kind of key a key is. A key whose allowance looks like the free tier's is named as such on the page.
From then on:
- Findings carry VirusTotal's verdict: how many of its antivirus engines flag the file.
- Only the file's SHA-256 hash is sent. The file never leaves the machine.
- Lookups count against your quota, capped at a daily limit you set, which starts at what VirusTotal says your key allows. Each file is asked about at most once a week, and a flagged file is remembered for a month.
- If the quota runs out anyway, lookups pause until VirusTotal resets it, rather than asking again with every scan.
- The answers are shown to your tenant and nobody else's. Disconnecting removes the key and every answer it paid for.
If you do not connect it
Nothing else about scanning changes. The same rules run on the same schedule, findings say which rule matched and on which file, and the analysis reads them the same way. Findings just no longer carry a VirusTotal verdict.