IoC collections are sets of IoCs (files, URLs, IPs and domains) related to threat campaigns or malware families provided by the community, users, researchers, investigators and our Google TI experts. ## Object Attributes A IoC collection object contains the following attributes: * `aggregations`: \<_dictionary_> dictionary of commonalities between the different IoCs associated with the IoC collection, grouped by IoC type (files, URLs, domains, IP addresses). * `domains`: \<_dictionary_> technical commonalities among all domains tied to the collection. * `files`: \<_dictionary_> technical commonalities among all files tied to the collection. * `ip_addresses`: \<_dictionary_> technical commonalities among all IP addresses tied to the collection. * `urls`: \<_dictionary_> technical commonalities among all URLs tied to the collection. * `alt_names`: \<_list of strings_> list of alternative names / aliases for the IoC collection. * `capabilities`: \<_list of dictionaries_> list of capabilities associated with the IoC collection. * `confidence`: \<_string_> the confidence of the IoC collection's associated capability. * `description`: \<_string_> description of the capability. * `first_seen`: \<_integer_> the first time when the capability was associated with the IoC collection (UTC timestamp). * `last_seen`: \<_integer_> the first time when the capability was associated with the IoC collection (UTC timestamp). * `value`: \<_string_> capability associated with the IoC collection. * `collection_type`: \<_string_> identifies the type of the object. For IoC collections the value of this attribute is `collection`. * `counters`: \<_dictionary_> dictionary of counters of related objects. * `attack_techniques`: \<_integer_> number of MITRE ATT&CK techniques associated with the collection. * `domains`: \<_integer_> number of domains related to the collection. * `files`: \<_integer_> number of files related to the collection. * `iocs`: \<_integer_> number of IoCs (files + URLs + domains + IP addresses) related to the collection. * `ip_addresses`: \<_integer_> number of IP addresses related to the collection. * `subscribers`: \<_integer_> number of users subscribed to the collection. * `urls`: \<_integer_> number of URLs related to the collection. * `creation_date`: \<_integer_> collection object creation date (UTC timestamp). * `description`: \<_string_> description / context about the collection. * `detection_names`: \<_list of dictionaries_> list of detection names and extra context. * `confidence`: \<_string_> the confidence of the detection. * `description`: \<_string_> descriptive information related to the detection. * `first_seen`: \<_integer_> the first time when the detection was associated with the IoC collection (UTC timestamp). * `last_seen`: \<_integer_> the last time when the detection was associated with the IoC collection (UTC timestamp). * `value`: \<_string_> the detection name. * `first_seen_details`: \<_list of dictionaries_> dictionaries with additional information related to the first activity among the IoCs of the collection, differentiating between confirmed and suspected activity. * `confidence`: \<_string_> confidence on the information of the first activity seen among the IoCs associated with the collection. * `description`: \<_string_> description / additional information about the first activity seen among the IoCs associated with the collection. * `first_seen`: \<_integer_> the first time this first activity date has been attributed to the collection (UTC timestamp). * `last_seen`: \<_integer_> the last time this first activity date has been attributed to the collection (UTC timestamp). * `value`: \<_string_> date when the first observation about that collection was made ("YYYY-MM-DDTHH:mm:ssZ" format). * `last_modification_date`: \<_integer_> last time when the collection's information was updated (UTC timestamp). * `last_seen_details`: \ dictionaries with additional information related to the last activity among the IoCs of the collection, differentiating between confirmed and unconfirmed activity. * `confidence`: \<_string_> confidence on the information or the last activity seen among the IoCs associated with the collection. * `description`: \<_string_> description / additional information about the last activity seen among the IoCs associated with the collection. * `first_seen`: \<_integer_> the first time this last activity date has been attributed to the collection (UTC timestamp). * `last_seen`: \<_integer_> the last time this last activity date has been attributed to the collection (UTC timestamp). * `value`: \<_string_> date when the last observation about that collection was made ("YYYY-MM-DDTHH:mm:ssZ" format). * `link`: \<_string_> URL to extra resources. * `malware_roles`: \<_list of dictionaries_> the list of malware roles associated with the threat represented by the IoC collection. * `confidence`: \<_string_> the confidence of the associated malware role. * `description`: \<_string_> descriptive information related to the associated malware role. * `first_seen`: \<_integer_> the first time when the malware role was associated with the IoC collection (UTC timestamp). * `last_seen`: \<_integer_> the last time when the malware role was associated with the IoC collection (UTC timestamp). * `value`: \<_string_> the malware role name. * `motivations`: \<_list of dictionaries_> motivations of the threat represented by the IoC collection such as espionage, financial gain, etc. * `confidence`: \<_string_> confidence on the associated motivation. * `description`: \<_string_> description / additional information about the associated motivation. * `first_seen`: \<_integer_> the first time this motivation was associated with the IoC collection (UTC timestamp). * `last_seen`: \<_integer_> the last time this motivation was associated with the IoC collection (UTC timestamp). * `value`: \<_string_> motivation name. * `name`: \<_string_> IoC collection's name. * `operating_systems`: \<_list of dictionaries_> operating systems targeted by the threat represented by the IoC collection. Possible values: Android, BSD, FreeBSD, Linux, Mac, Unix, VMkernel, Windows, iOS. * `confidence`: \<_string_> the confidence that the operating system is affected by the represented threat. * `description`: \<_string_> descriptive information related to the targeted operating system. * `first_seen`: \<_integer_> the first time when the operating system was targeted by the represented threat (UTC timestamp). * `last_seen`: \<_integer_> the last time when the operating system was targeted by the represented threat (UTC timestamp). * `value`: \<_string_> operating system name. * `origin`: \<_string_> identifies the source of the information. **Partner** for curated objects from trusted partners and security researchers, **Google Threat Intelligence** for curated objects from our Google TI experts and **Crowdsourced** for OSINT objects from the community. * `private`: \<_boolean_> whether the collection object is private or not. * `recent_activity_relative_change`: \<_float_> ratio of change between the last two "recent activity" periods. Note: "recent activity" refers to a period of 14 days. * `recent_activity_summary`: \<_list of integers_> time series representing the activity of the IoCs that belong to the collection. (2 weeks) * `sponsor_region`: \<_string_> the main country or region suspected to sponsor the threat represented by the IoC collection. * `source_region`: \<_string_> the main country or region from which the malicious activity represented by the IoC collection is known to originate. * `source_regions_hierarchy`: \<_list of dictionaries_> country or region from which the malicious activity is known to originate. * `confidence`: \<_string_> confidence on the information related to the source region of the malicious activity. * `country`: \<_string_> country from which malicious activity is known to originate. * `country_iso2`: \<_string_> source country in ISO 3166 Alpha2 - code format. * `description`: \<_string_> description / additional information about the source region of the malicious activity. * `first_seen`: \<_integer_> the first time this source region was attributed to the collection (UTC timestamp). * `last_seen`:\<_integer_> the last time this source region was attributed to the collection (UTC timestamp). * `region`: \<_string_> region from which the malicious activity is known to originate. * `source`: \<_string_> information's supplier. * `sub_region`: \<_string_> subregion from which the malicious activity is known to originate. * `status`: \<_string_> indicates if the object has attributes pending to be computed again (e.g. top_icon_md5 after making changes). The possible values are `PENDING_RECOMPUTE` and `COMPUTED`. * `summary_stats`: \<_list of dictionaries_> stats associated with the collection. * `first_submission_date`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the first_submission_date of all the IoCs included on the collection. * `last_submission_date`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the last_submission_date of all the IoCs included on the collection. * `files_detections`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the files_detections of all the IoCs included on the collection. * `urls_detections`: \<_dictionaries_> the minimun (`min`), maximun (`max`) and average (`avg`) values of the urls_detections of all the IoCs included on the collection. * `tags`: \<_list of string_> tags associated with the collection. * `targeted_industries`: \<_list of strings_> list of industries known to be targeted by the threat represented by the IoC collection. * `targeted_industries_tree`: \<_list of dictionaries_> list of industries and industry groups known to be targeted by the collection's associated campaign or malicious activity. * `confidence`: \<_string_> confidence on the information related to the industry targeted by the malicious activity. * `description`: \<_string_> description / additional information about the industry targeted by the malicious activity. * `first_seen`: \<_integer_> the first time this targeted industry was associated with the collection (UTC timestamp). * `last_seen`: \<_integer_> the last time this targeted industry was associated with the collection (UTC timestamp). * `industry`: \<_string_> sub-industry targeted by the malicious activity. * `industry_group`: \<_string_> industry group targeted by the malicious activity. * `source`: \<_string_> information's supplier. * `targeted_regions`: \<_list of strings_> list of regions and countries known to be targeted by the threat represented by the IoC collection. * `targeted_regions_hierarchy`: \<_list of dictionaries_> list of regions and countries known to be targeted by collection's associated campaign or malicious activity. * `confidence`: \<_string_> confidence on the information related to the region targeted by the malicious activity. * `country`: \<_string_> country targeted by the malicious activity. * `country_iso2`: \<_string_> targeted country in ISO 3166 Alpha2 - code format. * `description`: \<_string_> description / additional information about the region targeted by the malicious activity. * `first_seen`: \<_integer_> the first time this targeted region was associated with the collection (UTC timestamp). * `last_seen`:\<_integer_> : the last time this targeted region was associated with the collection (UTC timestamp). * `region`: \<_string_> region targeted by the malicious activity. * `sub_region`: \<_string_> sub-region targeted by the malicious activity. * `source`: \<_string_> information's supplier. * `tlp`: \<_string_> it indicates the sensitivity of the information and defines the boundaries for how and with whom the data can be shared. Available values are: `RED`, `AMBER`, `GREEN`, `CLEAR` . * `top_icon_md5`: \<_list of strings_> list of the 3 most frequent icons among the collection's associated IoCs (file's icons, URLs and domain's favicons). Favicons are represented by their MD5 hash. ## Relationships In addition to the previously described attributes, IoC collection objects contain relationships with other objects in our dataset that can be retrieved as explained in the [Relationships](ref:introduction-relationships) section. The following table shows a summary of available relationships. | Relationship | Return object type | Allowed Methods | | :------------------ | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------- | | associations | List of all objects ([Campaigns](ref:campaign-object), [IoC collections](ref:ioc-collection-object), [Malware families](ref:malware-family-object), [Software and Toolkits](ref:software-toolkit-object), [Vulnerabilities](ref:vulnerability-object), [Threat Actors](ref:threat-actor-object)) associated with the current IoC collection, without filtering by the object type. | GET | | attack_techniques | List of MITRE ATT&CK [techniques](ref:object-attack-techniques). | GET | | campaigns | List of associated collections of type [Campaign](ref:campaign-object) objects. | GET | | collections | List of associated collections of type [IoC collection](ref:ioc-collection-object) objects. | GET | | comments | List of [Comments](ref:comment-object). | GET | | domains | List of [Domains](ref:domains-object) associated with the IoC collection. | GET | | editors | List of [users](ref:user-object), [groups](ref:group-object) and data connectors that can edit this threat actor _(only available to the owner or editor of the entity)._ | GET , POST | | files | List of [Files](ref:file-object) associated with the IoC collection. | GET | | hunting_rulesets | List of curated [YARA rulesets](ref:yara-rulesets-object) assigned by the entity owner. | GET | | ip_addresses | List of [IP addresses](ref:ip-object) associated with the IoC collection. | GET | | malware_families | List of associated collections of type [Malware family](ref:malware-family-object) objects. | GET | | owner | [User](ref:user-object) who created the object. | GET | | related_collections | List of objects ([Campaigns](ref:campaign-object), [IoC collections](ref:ioc-collection-object), [Malware families](ref:malware-family-object), [Software and Toolkits](ref:software-toolkit-object), [Vulnerabilities](ref:vulnerability-object), [Threat Actors](ref:threat-actor-object)) containing IoCs associated with this entity. | GET | | reports | List of associated collections of type [Report](ref:report-object) objects. | GET | | software_toolkits | List of associated collections of type [Software or Toolkit](ref:software-toolkit-object) objects. | GET | | threat_actors | List of other collections of type [threat actors](ref:threat-actor-object) associated to the current IoC collection. | GET | | urls | List of [URLs](ref:url-object) associated with the IoC collection. | GET | | viewers | List of [users](ref:user-object), [groups](ref:group-object) and data connectors that can view the entity _(only available to the owner or editor of the entity)._ | GET , POST | | vulnerabilities | List of associated collections of type [Vulnerability](ref:vulnerability-object) objects. | GET | | yara_rulesets | List of crowdsourced [YARA rulesets](ref:yara-rulesets-object) matching at least one file associated with this IoC collection. | GET |