Did you know you can join @virustotal data in a #KQL query? One obscure feature of KQL opens up a world of data available from APIs. The evaluate http_request plugin is your gateway. ▶️👇👇👇 let apikey = '<apikey>'; let D = datatable(sha256:string)['40de2ba8e912102435c12fe96a59c749ccb18ccdb8956ada3914fc071b6fd75b','62814ad9e250366402d5e2f76b523f7d1f2cb9a9fcd33e5f46b85454cf51c1b1']; // let Enrich_Sha256_VirusTotal_ScanResults = (T:(sha256:string), apikey:string) { let file_ids = toscalar( T | summarize make_list(sha256) | extend hash_list = strcat_array(list_sha256, ",") | project hash_list ); let uri='virustotal.com/vtapi/v2/file…?'; let url= strcat(uri, "resource=",url_encode_component(file_ids), "&apikey=", url_encode_component(apikey)); evaluate http_request(url) | mv-expand answer = ResponseBody | project answer | evaluate bag_unpack(answer) | project md5, permalink, positives, resource, response_code, scan_date, scan_id, scans, sha1, sha256, total, verbose_msg }; D | invoke Enrich_Sha256_VirusTotal_ScanResults(apikey) | project sha256, md5, positives, scan_date, scans, permalink You need to adjust cluster callout policy to enable this (see next comment)