get_file_relationship

Analyze and retrieve specific relationships for a file, such as behaviors, network connections, or threat actors, with pagination support. Supports detailed investigations across 41 relationship types via VirusTotal MCP Server.

Instructions

Query a specific relationship type for a file with pagination support. Choose from 41 relationship types including behaviors, network connections, dropped files, embedded content, execution chains, and threat actors. Useful for detailed investigation of specific relationship types.

Input Schema

Name	Required	Description
`cursor`	No
`hash`	Yes	MD5, SHA-1 or SHA-256 hash of the file
`limit`	No
`relationship`	Yes	Type of relationship to query

Input Schema (JSON Schema)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "additionalProperties": false,
  "properties": {
    "cursor": {
      "type": "string"
    },
    "hash": {
      "description": "MD5, SHA-1 or SHA-256 hash of the file",
      "pattern": "^[a-fA-F0-9]{32,64}$",
      "type": "string"
    },
    "limit": {
      "default": 10,
      "maximum": 40,
      "minimum": 1,
      "type": "number"
    },
    "relationship": {
      "description": "Type of relationship to query",
      "enum": [
        "analyses",
        "behaviours",
        "bundled_files",
        "carbonblack_children",
        "carbonblack_parents",
        "ciphered_bundled_files",
        "ciphered_parents",
        "clues",
        "collections",
        "comments",
        "compressed_parents",
        "contacted_domains",
        "contacted_ips",
        "contacted_urls",
        "dropped_files",
        "email_attachments",
        "email_parents",
        "embedded_domains",
        "embedded_ips",
        "embedded_urls",
        "execution_parents",
        "graphs",
        "itw_domains",
        "itw_ips",
        "itw_urls",
        "memory_pattern_domains",
        "memory_pattern_ips",
        "memory_pattern_urls",
        "overlay_children",
        "overlay_parents",
        "pcap_children",
        "pcap_parents",
        "pe_resource_children",
        "pe_resource_parents",
        "related_references",
        "related_threat_actors",
        "similar_files",
        "submissions",
        "screenshots",
        "urls_for_embedded_js",
        "votes"
      ],
      "type": "string"
    }
  },
  "required": [
    "hash",
    "relationship"
  ],
  "type": "object"
}

VirusTotal MCP Server