Groups of users in Google Threat Intelligence
The Group objects describes groups of users in Google Threat Intelligence. Groups are used to share API privileges between a set of users, for example, users belonging to the same company.
Object Attributes
A Group object contains the following attributes:
auto_add_users: <list of strings> contains a list of emails that will be automatically added to this group when they create a Google Threat Intelligence account. Patterns can be used too. Only visible for the group's admins.country: <string> group's country. Only visible for the group's members and admins.country_iso: <string> group's country ISO code. Only visible for the group's members and admins.domain_name: <string> group's domain name. Only visible for the group's members and admins.industry: <string> group's industry. Only visible for the group's members and admins.agreement_signed_date: <integer> agreement signed date as UTC timestamp. Only visible for the group's members and admins.organization: <string> company name.organization_legal_name: <string> company legal name.preferences: <dictionary> Google Threat Intelligence group's preferences. Only visibile for the group's members and admins. Every subitem is a dictionary having a string as key.privileges: <dictionary> group's granted privileges. Only visibile for the group's members and admins. Each dictionary key is a string representing the privilege's name and each value is a dictionary having the following fields:expiration_date: <integer> privilege's expiration date as UTC timestamp.granted: <boolean> whether that privilege is granted or not.
quotas: <dictionary> group's quota details. Only visible for the group's members and admins. Each dictionary key is a string representing quota name and each value is a dictionary containing the following fields:allowed: <integer> maximum allowed quota.used: <integer> consumed quota.
{
"data": {
"attributes": {
"auto_add_users": ["<string>"],
"contact_emails": [
"<string>"
],
"country": "<string>",
"country_iso": "<string>",
"domain_name": "<string>",
"organization": "<string>",
"organization_legal_name": "<string>",
"preferences": {
"<string>": {}
},
"privileges": {
"<string>": {
"expiration_date": <integer>,
"granted": <boolean>
}
},
"quotas": {
"<string>": {
"allowed": <integer>,
"used": <integer>
}
}
},
"id": "<string>",
"links": {
"self": "https://www.virustotal.com/api/v3/groups/<id>"
},
"type": "group"
}
}
{
"data": {
"attributes": {
"auto_add_users": [
"*@blabla.com"
],
"country": "United States",
"country_iso": "US",
"domain_name": "blablabla.com",
"organization": "Company Inc.",
"preferences": {},
"privileges": {
"admin": {
"granted": false
},
"allinfo": {
"granted": false
},
"big-files": {
"expiration_date": 1601510400,
"granted": true
},
"cases": {
"granted": false
},
"click_to_accept": {
"granted": false
}
},
"quotas": {
"api_requests_daily": {
"allowed": 1000,
"used": 0
},
"api_requests_hourly": {
"allowed": 60000,
"used": 0
},
"api_requests_monthly": {
"allowed": 30000,
"used": 68
},
"cases_creation_monthly": {
"allowed": 20,
"used": 0
}
}
},
"id": "company",
"links": {
"self": "https://www.virustotal.com/api/v3/groups/company"
},
"type": "group"
}
}
Relationships
In addition to the previously described attributes, Group objects contain relationships with other objects in our dataset that can be retrieved as explained in the Relationships section.
The following table shows a summary of available relationships for group objects.
| Relationship | Description | Accessibility | Return object type |
|---|---|---|---|
| administrators | Group administrators | Group Members | List of Users |
| graphs | Graphs created by group members | Group Members | List of Graphs |
| users | Group members | Group Members | List of Users |
| service_accounts | Group service accounts | Group Members | List of Service Accounts |
These relationships are detailed in the subsections below.