{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "HTTP_Request": {
                "type": "Request",
                "kind": "Http",
                "inputs": {
                    "schema": {
                        "type": "object",
                        "properties": {
                            "urls": {
                                "type": "array"
                            },
                            "ips": {
                                "type": "array"
                            },
                            "fileHashes": {
                                "type": "array"
                            }
                        }
                    }
                }
            }
        },
        "actions": {
            "Initialize_VTResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_VTIPResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTIPResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_VTHashResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTHashResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_VTURLTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTURLTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_VTIPTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTIPTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_VTHashTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTHashTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_VTScanQueue": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTScanQueue",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_VTQueueIndex": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTQueueIndex",
                            "type": "integer",
                            "value": 0
                        }
                    ]
                }
            },
            "Initialize_VTLastScanTime": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTLastScanTime",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_VTScansCompleted": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "VTScansCompleted",
                            "type": "integer",
                            "value": 0
                        }
                    ]
                }
            },
            "Condition_ValidateKey": {
                "actions": {
                    "Compose_Excluded_Domains": {
                        "runAfter": {},
                        "type": "Compose",
                        "inputs": "@parameters('ExcludedDomains')"
                    },
                    "For_each_URL_Filter": {
                        "foreach": "@coalesce(triggerBody()?['urls'], json('[]'))",
                        "actions": {
                            "Compose_URL_Host": {
                                "type": "Compose",
                                "inputs": "@toLower(if(contains(item()?['Url'], '://'), split(split(item()?['Url'], '://')[1], '/')[0], split(item()?['Url'], '/')[0]))"
                            },
                            "Compose_URL_IsExcluded": {
                                "runAfter": {
                                    "Compose_URL_Host": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@or(contains(outputs('Compose_Excluded_Domains'), toLower(outputs('Compose_URL_Host'))), contains(outputs('Compose_Excluded_Domains'), concat('*.', last(skip(split(outputs('Compose_URL_Host'), '.'), sub(length(split(outputs('Compose_URL_Host'), '.')), 2))))), contains(outputs('Compose_Excluded_Domains'), concat('*.', join(skip(split(outputs('Compose_URL_Host'), '.'), 1), '.'))))"
                            },
                            "Condition_URL_Not_Excluded": {
                                "actions": {
                                    "Append_FilteredURL": {
                                        "type": "AppendToArrayVariable",
                                        "inputs": {
                                            "name": "FilteredURLs",
                                            "value": "@item()"
                                        }
                                    }
                                },
                                "runAfter": {
                                    "Compose_URL_IsExcluded": [
                                        "Succeeded"
                                    ]
                                },
                                "else": {
                                    "actions": {
                                        "Append_URL_Excluded_HTML": {
                                            "type": "AppendToStringVariable",
                                            "inputs": {
                                                "name": "VTURLTableHTML",
                                                "value": "@concat('<tr style=\"background:#f0f0f0\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:300px;color:#888\">', item()?['Url'], '</td><td colspan=\"6\" style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;color:#888\"><em>⊘ Excluded (trusted domain)</em></td></tr>')"
                                            }
                                        }
                                    }
                                },
                                "expression": {
                                    "and": [
                                        {
                                            "equals": [
                                                "@outputs('Compose_URL_IsExcluded')",
                                                false
                                            ]
                                        }
                                    ]
                                },
                                "type": "If"
                            }
                        },
                        "runAfter": {
                            "Compose_Excluded_Domains": [
                                "Succeeded"
                            ]
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_IP_Filter": {
                        "foreach": "@coalesce(triggerBody()?['ips'], json('[]'))",
                        "actions": {
                            "Compose_IP_IsPrivate": {
                                "type": "Compose",
                                "inputs": "@or(startsWith(item()?['Address'], '10.'), startsWith(item()?['Address'], '192.168.'), startsWith(item()?['Address'], '172.16.'), startsWith(item()?['Address'], '172.17.'), startsWith(item()?['Address'], '172.18.'), startsWith(item()?['Address'], '172.19.'), startsWith(item()?['Address'], '172.20.'), startsWith(item()?['Address'], '172.21.'), startsWith(item()?['Address'], '172.22.'), startsWith(item()?['Address'], '172.23.'), startsWith(item()?['Address'], '172.24.'), startsWith(item()?['Address'], '172.25.'), startsWith(item()?['Address'], '172.26.'), startsWith(item()?['Address'], '172.27.'), startsWith(item()?['Address'], '172.28.'), startsWith(item()?['Address'], '172.29.'), startsWith(item()?['Address'], '172.30.'), startsWith(item()?['Address'], '172.31.'), startsWith(item()?['Address'], '127.'), equals(item()?['Address'], '::1'))"
                            },
                            "Condition_IP_Not_Private": {
                                "actions": {
                                    "Append_FilteredIP": {
                                        "type": "AppendToArrayVariable",
                                        "inputs": {
                                            "name": "FilteredIPs",
                                            "value": "@item()"
                                        }
                                    }
                                },
                                "runAfter": {
                                    "Compose_IP_IsPrivate": [
                                        "Succeeded"
                                    ]
                                },
                                "else": {
                                    "actions": {
                                        "Append_IP_Private_HTML": {
                                            "type": "AppendToStringVariable",
                                            "inputs": {
                                                "name": "VTIPTableHTML",
                                                "value": "@concat('<tr style=\"background:#f0f0f0\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;color:#888\">', item()?['Address'], '</td><td colspan=\"7\" style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;color:#888\"><em>⊘ Excluded (private/loopback IP)</em></td></tr>')"
                                            }
                                        }
                                    }
                                },
                                "expression": {
                                    "and": [
                                        {
                                            "equals": [
                                                "@outputs('Compose_IP_IsPrivate')",
                                                false
                                            ]
                                        }
                                    ]
                                },
                                "type": "If"
                            }
                        },
                        "runAfter": {
                            "Compose_Excluded_Domains": [
                                "Succeeded"
                            ]
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_URL_EnqueueFiltered": {
                        "foreach": "@variables('FilteredURLs')",
                        "actions": {
                            "Append_URL_To_Queue": {
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "VTScanQueue",
                                    "value": {
                                        "type": "url",
                                        "value": "@item()?['Url']",
                                        "item": "@item()"
                                    }
                                }
                            }
                        },
                        "runAfter": {
                            "For_each_URL_Filter": [
                                "Succeeded",
                                "Failed",
                                "TimedOut"
                            ]
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_IP_EnqueueFiltered": {
                        "foreach": "@variables('FilteredIPs')",
                        "actions": {
                            "Append_IP_To_Queue": {
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "VTScanQueue",
                                    "value": {
                                        "type": "ip",
                                        "value": "@item()?['Address']",
                                        "item": "@item()"
                                    }
                                }
                            }
                        },
                        "runAfter": {
                            "For_each_IP_Filter": [
                                "Succeeded",
                                "Failed",
                                "TimedOut"
                            ]
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "For_each_Hash_Enqueue": {
                        "foreach": "@coalesce(triggerBody()?['fileHashes'], json('[]'))",
                        "actions": {
                            "Append_Hash_To_Queue": {
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "VTScanQueue",
                                    "value": {
                                        "type": "hash",
                                        "value": "@item()?['Value']",
                                        "item": "@item()"
                                    }
                                }
                            }
                        },
                        "runAfter": {},
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "Compose_Queue_Length": {
                        "runAfter": {
                            "For_each_URL_EnqueueFiltered": [
                                "Succeeded",
                                "Failed",
                                "TimedOut"
                            ],
                            "For_each_IP_EnqueueFiltered": [
                                "Succeeded",
                                "Failed",
                                "TimedOut"
                            ],
                            "For_each_Hash_Enqueue": [
                                "Succeeded",
                                "Failed",
                                "TimedOut"
                            ]
                        },
                        "type": "Compose",
                        "inputs": "@length(variables('VTScanQueue'))"
                    },
                    "Compose_Max_Scans": {
                        "runAfter": {
                            "Compose_Queue_Length": [
                                "Succeeded"
                            ]
                        },
                        "type": "Compose",
                        "inputs": "@min(outputs('Compose_Queue_Length'), 5)"
                    },
                    "Until_VT_Queue_Complete": {
                        "actions": {
                            "Compose_Current_Item": {
                                "type": "Compose",
                                "inputs": "@variables('VTScanQueue')[variables('VTQueueIndex')]"
                            },
                            "Compose_Item_Type": {
                                "runAfter": {
                                    "Compose_Current_Item": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@outputs('Compose_Current_Item')?['type']"
                            },
                            "Switch_Scan_Type": {
                                "runAfter": {
                                    "Compose_Item_Type": [
                                        "Succeeded"
                                    ]
                                },
                                "cases": {
                                    "Case_URL": {
                                        "case": "url",
                                        "actions": {
                                            "Scan_URL": {
                                                "type": "Http",
                                                "inputs": {
                                                    "uri": "https://www.virustotal.com/api/v3/urls",
                                                    "method": "POST",
                                                    "headers": {
                                                        "x-apikey": "@parameters('VTApiKey')",
                                                        "Content-Type": "application/x-www-form-urlencoded",
                                                        "Accept": "application/json"
                                                    },
                                                    "body": "@concat('url=',encodeUriComponent(outputs('Compose_Current_Item')?['value']))",
                                                    "retryPolicy": {
                                                        "type": "fixed",
                                                        "count": 2,
                                                        "interval": "PT20S"
                                                    }
                                                }
                                            },
                                            "Delay_URL_Analysis": {
                                                "runAfter": {
                                                    "Scan_URL": [
                                                        "Succeeded"
                                                    ]
                                                },
                                                "type": "Wait",
                                                "inputs": {
                                                    "interval": {
                                                        "count": 15,
                                                        "unit": "Second"
                                                    }
                                                }
                                            },
                                            "Get_URL_Report": {
                                                "runAfter": {
                                                    "Delay_URL_Analysis": [
                                                        "Succeeded"
                                                    ]
                                                },
                                                "type": "Http",
                                                "inputs": {
                                                    "uri": "https://www.virustotal.com/api/v3/analyses/@{body('Scan_URL')?['data']?['id']}",
                                                    "method": "GET",
                                                    "headers": {
                                                        "x-apikey": "@parameters('VTApiKey')",
                                                        "Accept": "application/json"
                                                    },
                                                    "retryPolicy": {
                                                        "type": "fixed",
                                                        "count": 2,
                                                        "interval": "PT20S"
                                                    }
                                                }
                                            },
                                            "Append_VT_URL_Result": {
                                                "runAfter": {
                                                    "Get_URL_Report": [
                                                        "Succeeded",
                                                        "Failed",
                                                        "TimedOut"
                                                    ]
                                                },
                                                "type": "AppendToArrayVariable",
                                                "inputs": {
                                                    "name": "VTResults",
                                                    "value": {
                                                        "url": "@outputs('Compose_Current_Item')?['value']",
                                                        "analysisId": "@body('Scan_URL')?['data']?['id']",
                                                        "status": "@body('Get_URL_Report')?['data']?['attributes']?['status']",
                                                        "malicious": "@body('Get_URL_Report')?['data']?['attributes']?['stats']?['malicious']",
                                                        "suspicious": "@body('Get_URL_Report')?['data']?['attributes']?['stats']?['suspicious']",
                                                        "harmless": "@body('Get_URL_Report')?['data']?['attributes']?['stats']?['harmless']",
                                                        "undetected": "@body('Get_URL_Report')?['data']?['attributes']?['stats']?['undetected']",
                                                        "vtLink": "@concat('https://www.virustotal.com/gui/url/', body('Scan_URL')?['data']?['id'])"
                                                    }
                                                }
                                            },
                                            "Append_VT_URL_HTML_Row": {
                                                "runAfter": {
                                                    "Append_VT_URL_Result": [
                                                        "Succeeded"
                                                    ]
                                                },
                                                "type": "AppendToStringVariable",
                                                "inputs": {
                                                    "name": "VTURLTableHTML",
                                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;word-break:break-all;max-width:300px\">', outputs('Compose_Current_Item')?['value'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('Get_URL_Report')?['data']?['attributes']?['status'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(int(string(coalesce(body('Get_URL_Report')?['data']?['attributes']?['stats']?['malicious'], 0))), 0), 'red', 'green'), '\">', string(coalesce(body('Get_URL_Report')?['data']?['attributes']?['stats']?['malicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;color:', if(greater(int(string(coalesce(body('Get_URL_Report')?['data']?['attributes']?['stats']?['suspicious'], 0))), 0), 'orange', 'green'), '\">', string(coalesce(body('Get_URL_Report')?['data']?['attributes']?['stats']?['suspicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(body('Get_URL_Report')?['data']?['attributes']?['stats']?['harmless'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(body('Get_URL_Report')?['data']?['attributes']?['stats']?['undetected'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://www.virustotal.com/gui/url/', body('Scan_URL')?['data']?['id']), '\" target=\"_blank\">View</a></td></tr>')"
                                                }
                                            }
                                        }
                                    },
                                    "Case_IP": {
                                        "case": "ip",
                                        "actions": {
                                            "Rate_Limit_Delay_IP": {
                                                "type": "Wait",
                                                "inputs": {
                                                    "interval": {
                                                        "count": 15,
                                                        "unit": "Second"
                                                    }
                                                }
                                            },
                                            "Get_IP_Report": {
                                                "runAfter": {
                                                    "Rate_Limit_Delay_IP": [
                                                        "Succeeded"
                                                    ]
                                                },
                                                "type": "Http",
                                                "inputs": {
                                                    "uri": "https://www.virustotal.com/api/v3/ip_addresses/@{outputs('Compose_Current_Item')?['value']}",
                                                    "method": "GET",
                                                    "headers": {
                                                        "x-apikey": "@parameters('VTApiKey')",
                                                        "Accept": "application/json"
                                                    },
                                                    "retryPolicy": {
                                                        "type": "fixed",
                                                        "count": 2,
                                                        "interval": "PT20S"
                                                    }
                                                }
                                            },
                                            "Append_VT_IP_Result": {
                                                "runAfter": {
                                                    "Get_IP_Report": [
                                                        "Succeeded",
                                                        "Failed",
                                                        "TimedOut"
                                                    ]
                                                },
                                                "type": "AppendToArrayVariable",
                                                "inputs": {
                                                    "name": "VTIPResults",
                                                    "value": {
                                                        "ipAddress": "@outputs('Compose_Current_Item')?['value']",
                                                        "asn": "@body('Get_IP_Report')?['data']?['attributes']?['asn']",
                                                        "asOwner": "@body('Get_IP_Report')?['data']?['attributes']?['as_owner']",
                                                        "country": "@body('Get_IP_Report')?['data']?['attributes']?['country']",
                                                        "network": "@body('Get_IP_Report')?['data']?['attributes']?['network']",
                                                        "reputation": "@body('Get_IP_Report')?['data']?['attributes']?['reputation']",
                                                        "malicious": "@body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['malicious']",
                                                        "suspicious": "@body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['suspicious']",
                                                        "harmless": "@body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['harmless']",
                                                        "undetected": "@body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['undetected']",
                                                        "vtLink": "@concat('https://www.virustotal.com/gui/ip-address/', outputs('Compose_Current_Item')?['value'])"
                                                    }
                                                }
                                            },
                                            "Append_VT_IP_HTML_Row": {
                                                "runAfter": {
                                                    "Append_VT_IP_Result": [
                                                        "Succeeded"
                                                    ]
                                                },
                                                "type": "AppendToStringVariable",
                                                "inputs": {
                                                    "name": "VTIPTableHTML",
                                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace\">', outputs('Compose_Current_Item')?['value'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['asn'], 'Unknown')), '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['as_owner'], 'Unknown')), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['country'], '?')), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(less(coalesce(body('Get_IP_Report')?['data']?['attributes']?['reputation'], 0), 0), 'red', 'green'), '\">', string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['reputation'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(int(string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['malicious'], 0))), 0), 'red', 'green'), '\">', string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['malicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;color:', if(greater(int(string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['suspicious'], 0))), 0), 'orange', 'green'), '\">', string(coalesce(body('Get_IP_Report')?['data']?['attributes']?['last_analysis_stats']?['suspicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://www.virustotal.com/gui/ip-address/', outputs('Compose_Current_Item')?['value']), '\" target=\"_blank\">View</a></td></tr>')"
                                                }
                                            }
                                        }
                                    },
                                    "Case_Hash": {
                                        "case": "hash",
                                        "actions": {
                                            "Rate_Limit_Delay_Hash": {
                                                "type": "Wait",
                                                "inputs": {
                                                    "interval": {
                                                        "count": 15,
                                                        "unit": "Second"
                                                    }
                                                }
                                            },
                                            "Get_FileHash_Report": {
                                                "runAfter": {
                                                    "Rate_Limit_Delay_Hash": [
                                                        "Succeeded"
                                                    ]
                                                },
                                                "type": "Http",
                                                "inputs": {
                                                    "uri": "https://www.virustotal.com/api/v3/files/@{outputs('Compose_Current_Item')?['value']}",
                                                    "method": "GET",
                                                    "headers": {
                                                        "x-apikey": "@parameters('VTApiKey')",
                                                        "Accept": "application/json"
                                                    },
                                                    "retryPolicy": {
                                                        "type": "fixed",
                                                        "count": 2,
                                                        "interval": "PT20S"
                                                    }
                                                }
                                            },
                                            "Append_VT_Hash_Result": {
                                                "runAfter": {
                                                    "Get_FileHash_Report": [
                                                        "Succeeded",
                                                        "Failed",
                                                        "TimedOut"
                                                    ]
                                                },
                                                "type": "AppendToArrayVariable",
                                                "inputs": {
                                                    "name": "VTHashResults",
                                                    "value": {
                                                        "hashValue": "@outputs('Compose_Current_Item')?['value']",
                                                        "hashAlgorithm": "@outputs('Compose_Current_Item')?['item']?['Algorithm']",
                                                        "fileName": "@body('Get_FileHash_Report')?['data']?['attributes']?['meaningful_name']",
                                                        "fileType": "@body('Get_FileHash_Report')?['data']?['attributes']?['type_description']",
                                                        "fileSize": "@body('Get_FileHash_Report')?['data']?['attributes']?['size']",
                                                        "reputation": "@body('Get_FileHash_Report')?['data']?['attributes']?['reputation']",
                                                        "malicious": "@body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['malicious']",
                                                        "suspicious": "@body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['suspicious']",
                                                        "harmless": "@body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['harmless']",
                                                        "undetected": "@body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['undetected']",
                                                        "sha256": "@body('Get_FileHash_Report')?['data']?['attributes']?['sha256']",
                                                        "vtLink": "@concat('https://www.virustotal.com/gui/file/', outputs('Compose_Current_Item')?['value'])"
                                                    }
                                                }
                                            },
                                            "Append_VT_Hash_HTML_Row": {
                                                "runAfter": {
                                                    "Append_VT_Hash_Result": [
                                                        "Succeeded"
                                                    ]
                                                },
                                                "type": "AppendToStringVariable",
                                                "inputs": {
                                                    "name": "VTHashTableHTML",
                                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-size:11px;word-break:break-all;max-width:200px\">', outputs('Compose_Current_Item')?['value'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', outputs('Compose_Current_Item')?['item']?['Algorithm'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['meaningful_name'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['type_description'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(less(coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['reputation'], 0), 0), 'red', 'green'), '\">', string(coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['reputation'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(int(string(coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['malicious'], 0))), 0), 'red', 'green'), '\">', string(coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['malicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;color:', if(greater(int(string(coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['suspicious'], 0))), 0), 'orange', 'green'), '\">', string(coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['suspicious'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(body('Get_FileHash_Report')?['data']?['attributes']?['last_analysis_stats']?['undetected'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://www.virustotal.com/gui/file/', outputs('Compose_Current_Item')?['value']), '\" target=\"_blank\">View</a></td></tr>')"
                                                }
                                            }
                                        }
                                    }
                                },
                                "default": {
                                    "actions": {}
                                },
                                "expression": "@outputs('Compose_Item_Type')",
                                "type": "Switch"
                            },
                            "Increment_QueueIndex": {
                                "runAfter": {
                                    "Switch_Scan_Type": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut",
                                        "Skipped"
                                    ]
                                },
                                "type": "IncrementVariable",
                                "inputs": {
                                    "name": "VTQueueIndex",
                                    "value": 1
                                }
                            },
                            "Increment_ScansCompleted": {
                                "runAfter": {
                                    "Increment_QueueIndex": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "IncrementVariable",
                                "inputs": {
                                    "name": "VTScansCompleted",
                                    "value": 1
                                }
                            }
                        },
                        "runAfter": {
                            "Compose_Max_Scans": [
                                "Succeeded"
                            ]
                        },
                        "expression": "@or(greaterOrEquals(variables('VTQueueIndex'), outputs('Compose_Max_Scans')), greaterOrEquals(variables('VTScansCompleted'), outputs('Compose_Max_Scans')))",
                        "limit": {
                            "count": 10,
                            "timeout": "PT1M15S"
                        },
                        "type": "Until"
                    },
                    "Compose_Skipped_Count": {
                        "runAfter": {
                            "Until_VT_Queue_Complete": [
                                "Succeeded",
                                "Failed",
                                "TimedOut"
                            ]
                        },
                        "type": "Compose",
                        "inputs": "@sub(outputs('Compose_Queue_Length'), variables('VTScansCompleted'))"
                    },
                    "Condition_Items_Skipped": {
                        "actions": {
                            "Append_Skipped_Note_URL": {
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "VTURLTableHTML",
                                    "value": "@concat('<tr style=\"background:#fff3cd\"><td colspan=\"7\" style=\"padding:8px 10px;border:1px solid #ddd;text-align:center;color:#856404\"><strong>⚠ ', string(outputs('Compose_Skipped_Count')), ' item(s) not scanned — VT free tier rate limit (4/min) reached within 90s timeout. Re-trigger or upgrade to VT Premium.</strong></td></tr>')"
                                }
                            }
                        },
                        "runAfter": {
                            "Compose_Skipped_Count": [
                                "Succeeded"
                            ]
                        },
                        "else": {
                            "actions": {}
                        },
                        "expression": {
                            "and": [
                                {
                                    "greater": [
                                        "@outputs('Compose_Skipped_Count')",
                                        0
                                    ]
                                }
                            ]
                        },
                        "type": "If"
                    },
                    "Response_Success": {
                        "runAfter": {
                            "Condition_Items_Skipped": [
                                "Succeeded",
                                "Failed"
                            ]
                        },
                        "type": "Response",
                        "kind": "Http",
                        "inputs": {
                            "statusCode": 200,
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "body": {
                                "vtURLTableHTML": "@variables('VTURLTableHTML')",
                                "vtIPTableHTML": "@variables('VTIPTableHTML')",
                                "vtHashTableHTML": "@variables('VTHashTableHTML')",
                                "vtURLResults": "@variables('VTResults')",
                                "vtIPResults": "@variables('VTIPResults')",
                                "vtHashResults": "@variables('VTHashResults')",
                                "scansCompleted": "@variables('VTScansCompleted')",
                                "scansSkipped": "@outputs('Compose_Skipped_Count')",
                                "queueTotal": "@outputs('Compose_Queue_Length')"
                            }
                        }
                    }
                },
                "runAfter": {
                    "Initialize_VTResults": [
                        "Succeeded"
                    ],
                    "Initialize_VTIPResults": [
                        "Succeeded"
                    ],
                    "Initialize_VTHashResults": [
                        "Succeeded"
                    ],
                    "Initialize_VTURLTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_VTIPTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_VTHashTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_VTScanQueue": [
                        "Succeeded"
                    ],
                    "Initialize_VTQueueIndex": [
                        "Succeeded"
                    ],
                    "Initialize_VTLastScanTime": [
                        "Succeeded"
                    ],
                    "Initialize_VTScansCompleted": [
                        "Succeeded"
                    ],
                    "Initialize_FilteredURLs": [
                        "Succeeded"
                    ],
                    "Initialize_FilteredIPs": [
                        "Succeeded"
                    ]
                },
                "else": {
                    "actions": {
                        "Response_Unauthorized": {
                            "type": "Response",
                            "kind": "Http",
                            "inputs": {
                                "statusCode": 401,
                                "body": {
                                    "error": "Unauthorized - invalid worker key"
                                }
                            }
                        }
                    }
                },
                "expression": {
                    "and": [
                        {
                            "equals": [
                                "@triggerOutputs()?['headers']?['x-worker-key']",
                                "@parameters('WorkerSharedKey')"
                            ]
                        }
                    ]
                },
                "type": "If"
            },
            "Initialize_FilteredURLs": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "FilteredURLs",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_FilteredIPs": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "FilteredIPs",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            }
        },
        "outputs": {},
        "parameters": {
            "VTApiKey": {
                "defaultValue": "<VIRUSTOTAL-API-KEY>",
                "type": "String"
            },
            "WorkerSharedKey": {
                "defaultValue": "<WORKER-SHARED-KEY>",
                "type": "String"
            },
            "ExcludedDomains": {
                "defaultValue": [
                    "*.microsoft.com",
                    "*.windows.com",
                    "*.office.com",
                    "*.office365.com",
                    "*.live.com",
                    "*.azure.com",
                    "*.microsoftonline.com",
                    "*.windowsupdate.com",
                    "*.bing.com"
                ],
                "type": "Array"
            },
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {}
        }
    }
}