🚧
Special privileges required
Threat Actors and Campaigns are only available to users with the Google Threat Intelligence (Google TI) Enterprise or Enterprise Plus licenses.

This endpoint is the same as /collections/{id}/{relationship} except it returns just the related object's descriptor instead of returning all attributes.

Available relationships are described in the Threat Actor, Campaign, Malware Family, Software or Toolkit and IoC Collection objects documentation.

Examples

Get 10 files descriptors related to the Kimsuky threat actor threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3

import requests
import urllib

object_id = "threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
relationship = "files"
limit = 10
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)

Get 4 domains descriptors related to a given malware or toolkit`

import requests
import urllib

object_id = "malware--350aa703-7750-5e07-997b-476375955828"
relationship = "files"
limit = 4
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)

Get 9 URL descriptors related to a given campaign.

import requests
import urllib

object_id = "campaign--24f96f40-b2fa-512c-b1da-2f22a949d12d"
relationship = "urls"
limit = 9
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/relationships/{relationship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)