None that come to mind. In this context, VT is mainly as an external reference point providing information, if available, on a given hash or hostname. There may be more enrichment opportunities based on API access to VT, but I think the volume of data they get might be overwhelming.
