List Collections - BlinkOps Documentation

List Google Threat Intelligence collections. Note: Threat actors, malware families, software and toolkits, campaigns, vulnerabilities, reports, country profiles, and industry profiles are only available with a Google Threat Intelligence Enterprise or Enterprise Plus license.

External DocumentationTo learn more, visit the VirusTotal documentation.

Parameters

Parameter	Description
Cursor	A pagination token that indicates which page the next set of results. When included in the response, this cursor means additional items exist in subsequent pages.
Filter	The filter to search collections by. Text without a modifier matches the collection’s name, description, and tags. Use `collection_type` to get a single type of collection: `collection`, `threat-actor`, `malware-family`, `software-toolkit`, `campaign`, `vulnerability`, `report`, `country-profile` or `industry-profile`. Filters can be combined, and support `AND`, `OR`, `NOT`, quotes for values with spaces, and `` wildcards. For example:* * `collection_type:malware-family operating_system:linux last_modification_date:60d+` * `collection_type:campaign targeted_region:CN` * `collection_type:report creation_date:7d+` For more information about the available filters, refer to Google Threat Intelligence documentation.
Limit	The maximum number of collections to get. Values can range from `1` to `40`.
Order	Select the field and direction to sort the collections by. Note: The `Lookups Trend`, `Submissions Trend`, `Exploitation State` and `Risk Rating` orders are not supported for country and industry profiles.
Return All Pages	Automatically fetch all resources, page by page.

Example Output

{
	"meta": {
		"cursor": "CuABChEKBGRhdGUSCQjA1LC"
	},
	"data": [
		{
			"id": "threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3",
			"type": "collection",
			"links": {
				"self": "https://www.virustotal.com/api/v3/collections/threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
			},
			"attributes": {
				"collection_type": "threat_actor",
				"name": "Kimsuky",
				"description": "Kimsuky is a North Korean cyber espionage group that targets government, academic, and think tank organizations, primarily in South Korea.",
				"alt_names": [
					"APT43",
					"Velvet Chollima",
					"Thallium"
				],
				"origin": "Google Threat Intelligence",
				"status": "COMPUTED",
				"tlp": "CLEAR",
				"private": false,
				"creation_date": 1609192742,
				"last_modification_date": 1610389280,
				"source_region": "KP",
				"targeted_industries": [
					"Government",
					"Education",
					"Defense"
				],
				"targeted_regions": [
					"KR",
					"US",
					"JP"
				],
				"tags": [
					"apt",
					"espionage"
				],
				"counters": {
					"files": 1250,
					"domains": 340,
					"urls": 410,
					"ip_addresses": 95,
					"iocs": 2095,
					"subscribers": 120
				}
			}
		}
	],
	"links": {
		"self": "https://www.virustotal.com/api/v3/collections",
		"next": "https://www.virustotal.com/api/v3/collections?cursor=CuABChEKBGRhdGUSCQjA1LC"
	}
}

Workflow Library Example

List Collections with Virustotal and Send Results Via Email

Preview this Workflow on desktop