Context menu actions for Virus Total and Mxtool box

[Anonymous]

Hi There,

I'm trying to create custom menu actions/ external look-up for VirusTotal and Mxtoolbox. Currently the look-up goes to respective websites but does not pass the parameters properly for URL check in Virus total and IP blacklist check in Mxtoolbox.

Has anyone configured this earlier? Any suggestions would be greatly appreciated.

Thanks.

[huanzhou1 · Accepted solution]

can you share you config?

i tested it's working.

{

    "groupName": "externalLookupGroup",

    "openInNewTab": "true",

    "urlFormat": "http://mxtoolbox.com/SuperTool.aspx?action=mx:{0}&run=toolpage",

    "moduleClasses": [

        "UAP.investigation.InvestigationValuesApplication",

        "UAP.investigation.events.view.EventGrid"

    ],

    "type": "UAP.common.contextmenu.actions.URLContextAction",

    "version": "1",

    "id": "mxtoolbox",

    "order": "12",

    "description": "",

    "local": "false",

    "displayName": "mxtoolbox",

    "modules": [

        "investigation"

    ],

    "disabled": "",

    "cssClasses": [

        "ip-src",

        "ip-dst",

        "alias-host",

        "ip.src",

        "ip.dst",

        "alias.host"

    ]

}

[Anonymous]

Hi,

The query worked well. Thanks so much.

I dont have that exact query that I wrote. However, it was similar to one I created for Virus Total as below.

{

    "groupName": "externalLookupGroup",

    "openInNewTab": "true",

    "urlFormat": "https://www.virustotal.com/vtapi/v2/url/scan/{0}",

    "moduleClasses": [

        "UAP.investigation.InvestigationValuesApplication"

    ],

    "type": "UAP.common.contextmenu.actions.URLContextAction",

    "version": "1",

    "id": "VirusTotal",

    "order": "13",

    "description": "",

    "local": "false",

    "displayName": "getVirusTotalLookup",

    "modules": [

        "investigation"

    ],

    "disabled": "",

    "cssClasses": [

        "alias-host"

    ]

}

[huanzhou1]

great you resolved the issue.