specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
provider: VirusTotal
providerId: virustotal
created: '2026-05-29'
modified: '2026-05-29'
reconciled: true
tags:
  - FinOps
  - FOCUS
  - Threat Intelligence
  - Anti-Malware
  - Security
description: >-
  FOCUS-aligned FinOps for VirusTotal / Google Threat Intelligence: per-tenant
  Enterprise subscriptions billed through Google Cloud, layered with metered
  Premium features (Livehunt rulesets, Retrohunt scans, Feed bytes, Private
  Scanning submissions). The Public API is free and produces no FinOps signal.

sources:
  - https://docs.virustotal.com/reference/public-vs-premium-api
  - https://www.virustotal.com/gui/contact-us/premium-services
  - https://gtidocs.virustotal.com/reference/openapi-specs
  - https://cloud.google.com/security/products/threat-intelligence

alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/

publisherName: Google LLC
serviceCategory: Threat Intelligence

billingModel:
  pricingCategory: Subscription + Metered Usage
  billingFrequency: Monthly
  billingCurrency: USD
  chargeCategories:
    - Usage
    - Purchase
    - Adjustment
    - Credit

focusColumns:
  ServiceName: VirusTotal
  ServiceCategory: Security
  ServiceSubcategory: Threat Intelligence
  ProviderName: Google
  PublisherName: Google LLC
  InvoiceIssuerName: Google LLC
  BillingCurrency: USD
  ChargeCategory: Usage

meters:
  - name: api_requests
    unit: request
    aggregation: sum
    dimensions:
      - api_key
      - endpoint_family
      - tier
  - name: livehunt_rulesets_active
    unit: ruleset
    aggregation: max
    dimensions:
      - ruleset_id
      - match_object_type
  - name: livehunt_notifications
    unit: notification
    aggregation: sum
    dimensions:
      - ruleset_id
  - name: retrohunt_jobs
    unit: job
    aggregation: count
    dimensions:
      - corpus
      - status
  - name: retrohunt_bytes_scanned
    unit: byte
    aggregation: sum
    dimensions:
      - job_id
      - corpus
  - name: feed_downloads
    unit: byte
    aggregation: sum
    dimensions:
      - feed_type
      - granularity
  - name: private_scanning_submissions
    unit: submission
    aggregation: sum
    dimensions:
      - submission_type
      - sandbox
  - name: zip_downloads
    unit: file
    aggregation: sum
    dimensions:
      - sample_count
  - name: seats
    unit: seat
    aggregation: max
    dimensions:
      - group_id
      - role

principles:
  - name: Visibility
    description: >-
      Read live usage via GET /users/{id}/api_usage and GET
      /users/{id}/overall_quotas (and the /groups/{id} equivalents).
      Cross-check against the Google Cloud Billing Report — VirusTotal /
      GTI line items are emitted under ServiceName "VirusTotal".

  - name: Allocation
    description: >-
      Provision one API key per team / integration; the api_usage endpoint
      breaks down by key. For multi-team tenants, use Groups + Service
      Accounts and attribute spend via group_id. Tag Livehunt rulesets and
      Retrohunt jobs with team identifiers in the notification_emails /
      description fields.

  - name: Optimization
    description: >-
      Cache file / URL / domain / IP reports by content hash before
      re-querying — the same hash is content-addressed and re-submission
      is wasteful. Right-size Livehunt ruleset `limit` values to suppress
      noisy notifications. Schedule Retrohunt jobs against narrow time
      ranges. Prefer the hourly feed over the per-minute feed when latency
      tolerates it.

  - name: Accountability
    description: >-
      Owner sits with the SOC / Threat Intel lead. Monthly reconciliation
      against the Google Cloud invoice; alert on api_usage exceeding 80%
      of the SLA allowance. Retire stale Livehunt rulesets and abort
      runaway Retrohunt jobs via POST /intelligence/retrohunt_jobs/{id}/abort.