VirusTotal has established itself as the favorite search engine for security analysts when it comes to IPs, hashes and URLs.
For that reason, I think that a “Search in VirusToal” link built-in Graylog would be super handy, which would only show up when an IP or a URL is selected :
If you agree, then please upvote the corresponding Feature Request in Github