get https://www.virustotal.com/api/v3/collections//
Special privileges required
Threat Actors and Campaigns are only available to users with the Google Threat Intelligence (Google TI) Enterprise or Enterprise Plus licenses.
This endpoint returns available relationships that are described in the Threat Actor, Campaign, Malware Family, Software or Toolkit and IoC Collection objects documentation.
Examples
Get 10 files related to the Kimsuky threat actor threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3
import requests
import urllib
object_id = "threat-actor--bcaaad6f-0597-4b89-b69b-84a6be2b7bc3"
relatinship = "files"
limit = 10
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/{relatinship}?limit={limit}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)
Get the names and descriptions of all the objects associated to the malware family with ID malware--76feb45b-e63a-5a34-8596-da3ce148e776
import requests
import urllib
object_id = "malware--76feb45b-e63a-5a34-8596-da3ce148e776"
relatinship = "associations"
relationship_attributes = "name,description"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}?relationships={relatinship}&relationship_attributes={relationship_attributes}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)