Every IP/domain is being enriched for VIrus Total using Enrich IP or Enrich Domain action in VirusTotalV3 integration

So we have a couple ways you can further refine enrichment while using the VT integration:

1. Define “networks” within the SOAR. This will differentiate internal vs external IPs/hostnames. You often don’t want to enrich internal IPs and hosts as they’re hopefuly not malicious :)  https://cloud.google.com/chronicle/docs/soar/admin-tasks/configuration/manage-networks
2. If that doesn’t refine it enough, you’re going to  want to use the “Enrich IOC” action. This will allow you to choose provide indicators for enrichment, rather than using entities. https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/virustotal-v3#enrich_ioc

-mike

Adding a third option: entity selection action allows you to define your own logic for a group or specific entity. This action creates an entity scope in the dropdown for you to use in future actions.