🚧
Special privileges required
Threat Actors and Campaigns are only available to users with the Google Threat Intelligence (Google TI) Enterprise or Enterprise Plus licenses.

This endpoint returns available relationships that are described in the Threat Actor, Campaign, Malware Family, Software or Toolkit and IoC Collection objects documentation.

Examples

Get 10 files related to the Kimsuky threat actor threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3

import requests
import urllib

object_id = "threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
relationship = "files"
limit = 10
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/{relationship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)

Get the names and descriptions of all the objects associated to the malware family with ID malware--76feb45b-e63a-5a34-8596-da3ce148e776

import requests
import urllib

object_id = "malware--76feb45b-e63a-5a34-8596-da3ce148e776"
relationship = "associations"
relationship_attributes = "name,description"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}?relationships={relationship}&relationship_attributes={relationship_attributes}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)