I'm working on a playbook in my SOAR platform and I'm using VirusTotal enrichment for analyzing URLs. I would like to extract the final redirect URL (if any) from a submitted URL, similar to how VirusTotal shows URL redirection chains in its web interface.
So far, I’ve integrated the VirusTotal API and can enrich the URL, but I’m not sure how to get the actual redirect URL(s) from the enrichment result.
Has anyone done this before?
-
Is this information available in the VirusTotal API response?
-
If yes, which field or section contains the redirect/final destination URL?
-
If not, is there another way to capture this within SOAR (e.g., using another integration or a custom script)?
Any pointers, playbook examples, or JSON snippets would be appreciated.