Reporting false positive for ArcSight Threat Intelligence on

Our pastebin,, is listed as "suspicious" on VirusTotal. ArcSight is the only engine that thinks this, while the rest agree we are clean.
How can we figure out what ArcSight is reacting to so we can regain an all "Clean" status?

All uploads to the pastebin are scanned using multiple AV engines, and re-scanned whenever updates are released for those engines.
That said, something can slip through the cracks, just as on DropBox,, or MegaUpload.

How can we fix this? How do we get in touch with the ArcSight Threat Intelligence team?
OpenText support close our cases without comment as we're not a customer.

  • Hii Oyvind,

    i see those topics rising at the moment and i can only apologize. It seems something in the process between VT and OT is broken. We are investigating this and meanwhile i provided the URL from your post above to my research team.

    Hang on with me while the team is looking at it.

    I will post any updates here.


    Sr. Product Line Manager |  ArcSight Threat Intelligence
    OpenText Cybersecurity