🐞 Issue: Invalid Create/Update/Delete Action on VirusTotal App

[jenilv-icpl]

There is an issue when trying to perform Create, Update, or Delete actions for IOCs using the VirusTotal v3 app. The request fails with a 500 status error, stating that the action is not found.

📤 Request Sent:

{
  "skip_workflow": true,
  "action": "create_ioc",
  "fields": [
    {"key": "hash", "value": "19ca14e7ea6328a42e0eb13d585e4c22"}
  ],
  "app": "virustotal V3",
  "category": "intel"
}

❌ Response:

{
  "success": false,
  "app_id": "7ea4a8ac1dbc114c3f67e1e47dd87cc4",
  "reason": "Failed finding action 'create_ioc' labeled in app 'Virustotal v3'. If this is wrong, please suggest a label by finding the app in Shuffle (https://shuffler.io/apis/7ea4a8ac1dbc114c3f67e1e47dd87cc4), OR contact [email protected] and we can help with labeling."
}

🛑 Root Cause:

VirusTotal API does not support create, update, or delete operations for IOCs.
It only allows search/scan (read-only) actions. Therefore, calling create_ioc or similar actions on this app is invalid and should be blocked or return a permission error.

✅ Expected Behavior:

If the VirusTotal v3 app is selected, the system should return a clear response such as:

❗️ You do not have permission to create, update, or delete IOCs using VirusTotal. This app only supports fetching/searching IOCs.

✅ Suggested Fix:

• Add validation to block unsupported actions (create_ioc, update_ioc, delete_ioc) for VirusTotal.
• Show a user-friendly error message instead of a 500 server error.