Export Collection IoCs - BlinkOps Documentation

Export the indicators of compromise (IoCs) of a collection in JSON or CSV format. Note: Threat actors and campaigns are only available with a Google Threat Intelligence Enterprise or Enterprise Plus license.

External DocumentationTo learn more, visit the VirusTotal documentation.

Parameters

Parameter	Description
Format	Select the format to export the IoCs in.
Threat ID	The ID of the threat. For example: `threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3`, `malware--76feb45b-e63a-5a34-8596-da3ce148e776` or `report--25-10000400`.

Example Output

{
	"files": [
		"009cc0f34f60467552ef79c3892c501043c972be55fe936efb30584975d45ec0",
		"153117aa54492ca955b540ac0a8c21c1be98e9f7dd8636a36d73581ec1ddcf58",
		"18479a93fc2d5acd7d71d596f27a5834b2b236b44219bb08f6ca06cf760b74f6"
	],
	"threat_actors": [
		"muddywater"
	],
	"references": [
		"153590cf5677a6ab5b5103382d41d4d8868a878a04104e86e936db63e4d186b8"
	],
	"urls": [
		"http://abrahamseed.co.za/db_template.php",
		"http://absfinancialplanning.co.za/images/db_template.php"
	]
}

Workflow Library Example

Export Collection Iocs with Virustotal and Send Results Via Email

Preview this Workflow on desktop