Use this endpoint to export Indicators of Compromise (IoCs) associated with all Recommendations in a certain Threat Profile when the export exceeds 32MB. Supported formats include JSON, CSV, and STIX.

The endpoint returns a JSON object containing a temporary download URL:


{
    "data":"https://storage.googleapis.com/vtcollectiondumps/exporter/4c584...d825d4.json?..."
}

To retrieve the export, make a subsequent GET request to the URL provided in the data field of the response.

📘
Note that if the /format parameter is omitted, this endpoint defaults to JSON.

Examples

Get all IoCs that are associated with recommendations in my threat profile, in STIX format.

import requests

id = "dc2f47a9baa2460089cdd78f7339b19c"
format = "stix" 

url = f"https://www.virustotal.com/api/v3/threat_profiles/{id}/download_url/{format}"

headers = {"x-apikey": <api-key>,"accept": "application/json"}

response = requests.get(url, headers=headers)
response = requests.get(response.json()["data"], headers=headers)

Examples

400400