In a SOAR playbook using VirusTotal v3 to set alert severity, which practice best informs severity?

• A. Create a widget that translates the JSON output to a severity score.
• B. Pass the response back to SIEM.
• C. Use a conditional statement to treat the URL as suspicious or benign.
• D. Use the number of detections from the JSON response in a conditional to set severity.

Answer: (D)

The key idea is to base alert severity on concrete, countable evidence returned by VirusTotal rather than a binary or indirect method. In VirusTotal v3, the JSON response includes analysis statistics that quantify how many scanners flagged the item and how many detections there are overall. By reading this count and applying thresholds in the SOAR playbook, you can map the evidence to a graded severity level (for example, more detections or a higher malicious count → higher severity). This makes severity consistent, data-driven, and scalable across different indicators.

Using a widget to translate JSON into a severity score adds an extra layer but doesn’t provide the direct, action-ready decision logic the playbook needs; it delays or obscures how severity is actually determined. Passing the response to SIEM doesn’t assign or encode severity within the SOAR workflow. Treating the URL as simply suspicious or benign is too binary and ignores how strong the evidence is, which is exactly what the detections count captures. Therefore, using the number of detections from the JSON response in a conditional to set severity best leverages the available data to produce meaningful, consistent alert levels.