---
updatedAt: 2026-02-27T11:32:45.000Z
agentTools:
  projectIndex: https://gtidocs.readme.io/llms.txt
---

# Search IoCs inside a vulnerability

Allows to search IoCs inside a vulnerability using advanced intelligence queries.

The expected input is the same as [/intelligence/search](https://gtidocs.readme.io/reference/intelligence-search). By default it searches files, in order to search other entities use `entity:domain/ip/url`.

## Examples

Search for IoCs related to a vulnerability that meet certain conditions.

```python
import requests
import urllib

object_id = "vulnerability--cve-2022-30190"
query = "tag%3Acve-2022-30190"
attributes = "name
limit = "2"
relationships = "files"
url = f"https://www.virustotal.com/api/v3/collections/{object_id}/search?query={query}&limit={limit}&attributes={attributes}&relationships={relationships}"
headers = {"accept": "application/json","x-apikey": <api-key>}
response = requests.get(url, headers=headers)
```

# OpenAPI definition

```json
{
  "info": {
    "title": "Vulnerability Intelligence",
    "version": "3.0"
  },
  "openapi": "3.1.0",
  "tags": [
    {
      "name": "Vulnerabilities"
    }
  ],
  "paths": {
    "/collections/{id}/search": {
      "get": {
        "tags": [
          "Vulnerabilities"
        ],
        "deprecated": false,
        "description": "",
        "operationId": "search-iocs-inside-a-vulnerability",
        "parameters": [
          {
            "description": "Your API key",
            "in": "header",
            "name": "x-apikey",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Vulnerability's ID",
            "in": "path",
            "name": "id",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Intelligence query",
            "in": "query",
            "name": "query",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Maximum number of IoCs to retrieve (max 40)",
            "in": "query",
            "name": "limit",
            "schema": {
              "default": 10,
              "format": "int32",
              "type": "integer",
              "maximum": 40,
              "minimum": 0
            }
          },
          {
            "description": "Continuation cursor",
            "in": "query",
            "name": "cursor",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Sorting order",
            "in": "query",
            "name": "order",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Comma-separated attributes to return from the resulting IoCs",
            "in": "query",
            "name": "attributes",
            "schema": {
              "type": "string"
            }
          },
          {
            "description": "Comma-separated name of relationships descriptors to return from the IoCs",
            "in": "query",
            "name": "relationships",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "content": {
              "application/json": {
                "examples": {
                  "Result": {
                    "value": "{\n\"meta\": {\n  \"cursor\": <string>,\n  \"total_hits\": <int>,\n  \"allowed_orders\": [<string>, ...]\n},\n\"data\": [\n  <IOC>,\n  <IOC>,\n  ...\n],\n\"links\": {\n  \"self\": <string>,\n  \"next\": <string>\n}"
                  }
                }
              },
              "text/plain": {
                "examples": {
                  "Example": {
                    "value": "{\n\t\"data\":\n\t[\n\t\t{\n\t\t\t\"id\": \"1e6fcfadaacd23678c4708d3b006f9760feebdaff7f0903c012758a0c2dbecc8\",\n\t\t\t\"type\": \"file\",\n\t\t\t\"links\":\n\t\t\t{\n\t\t\t\t\"self\": \"https://www.virustotal.com/api/v3/files/1e6fcfadaacd23678c4708d3b006f9760feebdaff7f0903c012758a0c2dbecc8\"\n\t\t\t},\n\t\t\t\"attributes\":\n\t\t\t{\n\t\t\t\t\"names\":\n\t\t\t\t[\n\t\t\t\t\t\"D:\\Downloads\\msdt-follina-main.zip\",\n\t\t\t\t\t\"msdt-follina-main (1).zip\",\n\t\t\t\t\t\"msdt-follina-main.zip\"\n\t\t\t\t]\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"id\": \"f4156284935d45fdc0c5b1f1a2f5992e52250dfa5f903cc2068ba007bd280f92\",\n\t\t\t\"type\": \"file\",\n\t\t\t\"links\":\n\t\t\t{\n\t\t\t\t\"self\": \"https://www.virustotal.com/api/v3/files/f4156284935d45fdc0c5b1f1a2f5992e52250dfa5f903cc2068ba007bd280f92\"\n\t\t\t},\n\t\t\t\"attributes\":\n\t\t\t{\n\t\t\t\t\"names\":\n\t\t\t\t[]\n\t\t\t}\n\t\t}\n\t],\n\t\"meta\":\n\t{\n\t\t\"cursor\": \"eJwVjlFvgyAYRf8S0rmsj-sKbWzAQT9AecPqZgsaurkozX783OPJvffk_toqnNoQJzNGZyiNgOPugsKPGMOVZXE2vjWdCvcGh7P0hTqbsHGGpbIKXiCP9SZS5vNnCUXZeZSgiuO6nwzsuKYqgYkjI1sFQJ2kZDFDdnY-O65snbcT6JZ2Ot416HdN4jcEWXQqV2KYXKPU2o9fLVq9Q-TOkwSoPTmSEQHcNprmgORbo7b_v2qzf91-HBfMNssLg8uD3S6JQZ149c-2Z3uC-EFkFshSQuitsaGE_sYf8soHveatZwfrrRF5eaif2GqqsQ0Mi8SHorfwObN9PVuQw-rC9fwH-K1szw==\",\n\t\t\"total_hits\": 14,\n\t\t\"allowed_orders\":\n\t\t[\n\t\t\t\"first_submission_date\",\n\t\t\t\"last_submission_date\",\n\t\t\t\"positives\",\n\t\t\t\"times_submitted\",\n\t\t\t\"size\",\n\t\t\t\"unique_sources\",\n\t\t\t\"gti_score\"\n\t\t]\n\t},\n\t\"links\":\n\t{\n\t\t\"self\": \"https://www.virustotal.com/api/v3/collections/vulnerability--cve-2022-30190/search?query=tag:cve-2022-30190&attributes=names&limit=2\",\n\t\t\"next\": \"https://www.virustotal.com/api/v3/collections/vulnerability--cve-2022-30190/search?query=tag%3Acve-2022-30190&attributes=names&limit=2&cursor=eJwVjlFvgyAYRf8S0rmsj-sKbWzAQT9AecPqZgsaurkozX783OPJvffk_toqnNoQJzNGZyiNgOPugsKPGMOVZXE2vjWdCvcGh7P0hTqbsHGGpbIKXiCP9SZS5vNnCUXZeZSgiuO6nwzsuKYqgYkjI1sFQJ2kZDFDdnY-O65snbcT6JZ2Ot416HdN4jcEWXQqV2KYXKPU2o9fLVq9Q-TOkwSoPTmSEQHcNprmgORbo7b_v2qzf91-HBfMNssLg8uD3S6JQZ149c-2Z3uC-EFkFshSQuitsaGE_sYf8soHveatZwfrrRF5eaif2GqqsQ0Mi8SHorfwObN9PVuQw-rC9fwH-K1szw%3D%3D\"\n\t}\n}"
                  }
                },
                "schema": {
                  "properties": {
                    "data": {
                      "items": {
                        "properties": {
                          "attributes": {
                            "properties": {
                              "names": {
                                "items": {
                                  "type": "string"
                                },
                                "type": "array"
                              }
                            },
                            "type": "object"
                          },
                          "id": {
                            "type": "string"
                          },
                          "links": {
                            "properties": {
                              "self": {
                                "type": "string"
                              }
                            },
                            "type": "object"
                          },
                          "type": {
                            "type": "string"
                          }
                        },
                        "type": "object"
                      },
                      "type": "array"
                    },
                    "links": {
                      "properties": {
                        "next": {
                          "type": "string"
                        },
                        "self": {
                          "type": "string"
                        }
                      },
                      "type": "object"
                    },
                    "meta": {
                      "properties": {
                        "allowed_orders": {
                          "items": {
                            "type": "string"
                          },
                          "type": "array"
                        },
                        "cursor": {
                          "type": "string"
                        },
                        "total_hits": {
                          "default": 0,
                          "type": "integer"
                        }
                      },
                      "type": "object"
                    }
                  },
                  "type": "object"
                }
              }
            },
            "description": "200"
          }
        },
        "summary": "Search IoCs inside a vulnerability"
      }
    }
  },
  "security": [],
  "servers": [
    {
      "url": "https://www.virustotal.com/api/v3"
    }
  ],
  "x-readme": {
    "explorer-enabled": true,
    "headers": [],
    "proxy-enabled": false,
    "samples-enabled": true
  }
}
```