TA-VirusTotal-app saved searches fail due to API key error

Applicability

Description

Saved searches configured with the TA-VirusTotal add-on fail to execute in Splunk. The failure is observed when running searches that rely on VirusTotal data.

The following error message is returned: 

AuthenticationRequiredError: VirusTotal API key is not set.

Use the below SPL to check the Saved search activity:

index=_internal *AuthenticationRequiredError* app="TA-virustotal-app"

As a result, no data is retrieved from VirusTotal, and the saved searches do not return expected results.

Investigation

The following investigation steps were performed to identify the root cause:  

1. Saved Search Validation

• Multiple saved searches using VirusTotal enrichment were executed. 
• All searches failed with the error:   

  AuthenticationRequiredError: VirusTotal API key is not set.

2. Application UI Verification 

• The VT4Splunk app landing page was accessed to verify app health. 
• The same authentication error was observed directly on the landing page.

• This confirmed that the issue is not limited to saved searches but affects the overall app configuration.

3. Configuration Review

• The VT4Splunk configuration was reviewed under: Configuration → Configuration → General Settings 
• The VirusTotal API key field was found to be empty or not configured.

4. Account Verification

• The associated VirusTotal account status was checked.  
• It was identified that deletion or deactivation of the account could result in the API key becoming invalid or removed from the app configuration.

Resolution

The issue occurs because the VirusTotal API key is not configured or is no longer valid in the VT4Splunk app, causing saved searches and app components to fail authentication.
To resolve the issue, configure a valid VirusTotal API key.

Steps to resolve:

• Open the VT4Splunk app.
• Navigate to: Configuration → Configuration (dropdown)
• Under General Settings, locate the VirusTotal API key field.
• Enter a valid VirusTotal API key.
• Save the configuration.

Post-Resolution Validation:

• Re-run the affected saved searches and confirm they execute successfully.
• Refresh the VT4Splunk landing page and verify that the error message is no longer displayed.
• Ensure VirusTotal data is being returned as expected.

Additional Notes:

• If the VirusTotal account was deleted, generate a new API key and update it in the app.
• Ensure the API key remains active and properly configured to avoid recurrence.

Related Links

Reference: Official VirusTotal app for Splunk