Get Collection Related Objects - BlinkOps Documentation

Get the objects related to a collection, such as its threat actors, campaigns, malware families, files, domains, URLs, IP addresses, or MITRE ATT&CK techniques. Note: Threat actors, malware families, software and toolkits, campaigns, vulnerabilities, and reports are only available with a Google Threat Intelligence Enterprise or Enterprise Plus license.

External DocumentationTo learn more, visit the VirusTotal documentation.

Parameters

Parameter	Description
Cursor	A pagination token that indicates which page the next set of results. When included in the response, this cursor means additional items exist in subsequent pages.
Limit	The maximum number of related objects to get. Values can range from `1` to `40`.
Relationship	The name of the relationship to get the related objects for. For more information about the available relationships, refer to Google Threat Intelligence documentation.
Return All Pages	Automatically fetch all resources, page by page.
Threat ID	The ID of the threat. For example: `threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3`, `malware--76feb45b-e63a-5a34-8596-da3ce148e776` or `report--25-10000400`.

Example Output

{
	"data": [
		{
			"id": "threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3",
			"type": "collection",
			"links": {
				"self": "https://www.virustotal.com/api/v3/collections/threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
			},
			"attributes": {
				"collection_type": "threat_actor",
				"name": "Kimsuky",
				"description": "Kimsuky is a North Korean cyber espionage group that targets government, academic, and think tank organizations, primarily in South Korea.",
				"alt_names": [
					"APT43",
					"Velvet Chollima",
					"Thallium"
				],
				"origin": "Google Threat Intelligence",
				"status": "COMPUTED",
				"tlp": "CLEAR",
				"private": false,
				"creation_date": 1609192742,
				"last_modification_date": 1610389280,
				"source_region": "KP",
				"targeted_industries": [
					"Government",
					"Education",
					"Defense"
				],
				"targeted_regions": [
					"KR",
					"US",
					"JP"
				],
				"tags": [
					"apt",
					"espionage"
				]
			}
		}
	],
	"meta": {
		"cursor": "CuABChEKBGRhdGUSCQjA1LC"
	},
	"links": {
		"self": "https://www.virustotal.com/api/v3/collections/malware--76feb45b-e63a-5a34-8596-da3ce148e776/threat_actors",
		"next": "https://www.virustotal.com/api/v3/collections/malware--76feb45b-e63a-5a34-8596-da3ce148e776/threat_actors?cursor=CuABChEKBGRhdGUSCQjA1LC"
	}
}

Workflow Library Example

Get Collection Related Objects with Virustotal and Send Results Via Email

Preview this Workflow on desktop

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example