> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Threat Intelligence

> Connect Google Threat Intelligence (VirusTotal) to Myrmex — add your API key to enrich indicators live across 70+ engines.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect **Google Threat Intelligence** (formerly VirusTotal) so Myrmex can look up indicators of compromise — files, hashes, URLs, domains, and IPs — against 70+ antivirus engines and blocklists. Myrmex queries the API in real time through a [Collector](/documentation/agent-endpoint-security/collector-mode).

<Note>
  Myrmex looks up indicators on demand and reads results in real time — nothing is stored on the Myrmex side.
</Note>

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="IOC lookups" icon="magnifying-glass">
    Check files, URLs, domains, and IPs on demand in [Threat Intelligence](/documentation/detection-response/threat-intelligence).
  </Card>

  <Card title="Multi-engine verdicts" icon="layer-group">
    See detections across 70+ AV scanners and URL/domain blocklists.
  </Card>

  <Card title="Enrich investigations" icon="robot">
    Let [Orion](/documentation/multi-agent-system/orion) use Google Threat Intelligence to enrich indicators during recon.
  </Card>

  <Card title="Reputation context" icon="shield-halved">
    Add reputation and relationship context to your alerts and cases.
  </Card>
</CardGroup>

## Before You Start

* A VirusTotal / Google Threat Intelligence account. Enterprise features require a subscription; the community key is rate-limited.
* A [Collector](/documentation/agent-endpoint-security/collector-mode) that can reach `virustotal.com` over outbound HTTPS.

## Step 1 — Create the Credential in Google Threat Intelligence

<Steps>
  <Step title="Sign in">
    Sign in to your VirusTotal / Google Threat Intelligence account.
  </Step>

  <Step title="Open your API key">
    From your profile menu, open the **API key** page.
  </Step>

  <Step title="Copy the key">
    Copy the API key — it's sent in the `x-apikey` header. Paste it into Myrmex.
  </Step>
</Steps>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Google Threat Intelligence**, then fill in:

| Field           | Description                                                                                      |
| --------------- | ------------------------------------------------------------------------------------------------ |
| **Name**        | A unique name for this instance.                                                                 |
| **Description** | Optional note to identify the account.                                                           |
| **Collector**   | The [Collector](/documentation/agent-endpoint-security/collector-mode) that connects to the API. |
| **API URL**     | The API host (default `virustotal.com`).                                                         |
| **Port**        | API port (default `443`).                                                                        |
| **API Key**     | Your Google Threat Intelligence / VirusTotal API key.                                            |

## Connect

Click **Connect** to validate the API key. The integration then appears under **Environment → Integrations**, and you can look up indicators — live — in [Threat Intelligence](/documentation/detection-response/threat-intelligence).