> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Collections

List Google Threat Intelligence collections.

**Note**: `Threat actors`, `malware families`, `software and toolkits`, `campaigns`, `vulnerabilities`, `reports`, `country profiles`, and `industry profiles` are only available with a Google Threat Intelligence Enterprise or Enterprise Plus license.

> [!NOTE]
>
> External Documentation
>
> To learn more, visit the [VirusTotal documentation](https://gtidocs.virustotal.com/reference/list-collections).

## Parameters

| Parameter | Description |
| - | - |
| Cursor | A pagination token that indicates which page the next set of results. When included in the response, this cursor means additional items exist in subsequent pages. |
| Filter | The filter to search collections by. Text without a modifier matches the collection's name, description, and tags. Use `collection_type` to get a single type of collection: `collection`, `threat-actor`, `malware-family`, `software-toolkit`, `campaign`, `vulnerability`, `report`, `country-profile` or `industry-profile`. Filters can be combined, and support `AND`, `OR`, `NOT`, quotes for values with spaces, and `*` wildcards. **For example:** \* `collection_type:malware-family operating_system:linux last_modification_date:60d+` \* `collection_type:campaign targeted_region:CN` \* `collection_type:report creation_date:7d+` For more information about the available filters, refer to [Google Threat Intelligence documentation](https://gtidocs.virustotal.com/reference/list-collections#allowed-filters-by-object-collection_type). |
| Limit | The maximum number of collections to get. Values can range from `1` to `40`. |
| Order | Select the field and direction to sort the collections by. **Note**: The `Lookups Trend`, `Submissions Trend`, `Exploitation State` and `Risk Rating` orders are not supported for country and industry profiles. |
| Return All Pages | Automatically fetch all resources, page by page. |

## Example Output

```json theme={"dark"}
{
	"meta": {
		"cursor": "CuABChEKBGRhdGUSCQjA1LC"
	},
	"data": [
		{
			"id": "threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3",
			"type": "collection",
			"links": {
				"self": "https://www.virustotal.com/api/v3/collections/threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
			},
			"attributes": {
				"collection_type": "threat_actor",
				"name": "Kimsuky",
				"description": "Kimsuky is a North Korean cyber espionage group that targets government, academic, and think tank organizations, primarily in South Korea.",
				"alt_names": [
					"APT43",
					"Velvet Chollima",
					"Thallium"
				],
				"origin": "Google Threat Intelligence",
				"status": "COMPUTED",
				"tlp": "CLEAR",
				"private": false,
				"creation_date": 1609192742,
				"last_modification_date": 1610389280,
				"source_region": "KP",
				"targeted_industries": [
					"Government",
					"Education",
					"Defense"
				],
				"targeted_regions": [
					"KR",
					"US",
					"JP"
				],
				"tags": [
					"apt",
					"espionage"
				],
				"counters": {
					"files": 1250,
					"domains": 340,
					"urls": 410,
					"ip_addresses": 95,
					"iocs": 2095,
					"subscribers": 120
				}
			}
		}
	],
	"links": {
		"self": "https://www.virustotal.com/api/v3/collections",
		"next": "https://www.virustotal.com/api/v3/collections?cursor=CuABChEKBGRhdGUSCQjA1LC"
	}
}
```

## Workflow Library Example

[List Collections with Virustotal and Send Results Via Email](https://library.blinkops.com/workflows/list-collections-with-virustotal-and-send-results-via-email)

![Workflow Library](https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max\&auto=format\&n=ojHYuDeYX5FWuN8a\&q=85\&s=b8af968e71438a9499c3223c9bd29fb2)

Preview this Workflow on desktop

[https://library.blinkops.com/workflows/list-collections-with-virustotal-and-send-results-via-email/canvas](https://library.blinkops.com/workflows/list-collections-with-virustotal-and-send-results-via-email/canvas)