get
https://www.virustotal.com/api/v3/collections//relationships/
Special privileges requiredThreat Actors and Campaigns are only available to users with the Google Threat Intelligence (Google TI) Enterprise or Enterprise Plus licenses.
This endpoint is the same as /collections/{id}/{relationship} except it returns just the related object's descriptor instead of returning all attributes.
Available relationships are described in the Threat Actor, Campaign, Malware Family, Software or Toolkit and IoC Collection objects documentation.
Examples
Get 10 files descriptors related to the Kimsuky threat actor threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3
import requests
import urllib
object_id = "threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
relationship = "files"
limit = 10
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)Get 4 domains descriptors related to a given malware or toolkit`
import requests
import urllib
object_id = "malware--350aa703-7750-5e07-997b-476375955828"
relationship = "files"
limit = 4
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)Get 9 URL descriptors related to a given campaign.
import requests
import urllib
object_id = "campaign--24f96f40-b2fa-512c-b1da-2f22a949d12d"
relationship = "urls"
limit = 9
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)