Get objects related to a threat actor

🚧

Special privileges required

Threat actors endpoints are only available to users with Google Threat Intelligence Enterprise or Enterprise plus license.

The order parameter defines the order in which results are returned. They can be followed by a plus (+) or minus (-) sign for indicating ascending or descending order respectively (i.e: <order>+, <order>-). If no ascending/descending order is specified it's assumed to be ascending, so <order> and <order>+ are equivalent. If the order parameter is not provided, items are returned in a default order. The following table shows supported and default orders by relationship:

RelationshipSupported ordersDefault order
collectionscreation_date, last_modification_date, owner, name, subscribers, tlp, sigma_rules, yara_rulesets, domains, files, ip_addresses, references, threat_actors, urls, attack_techniques-
comments-date-
references--
related_domainscreation_date, last_modification_date, last_update_date, positiveslast_modification_date-
related_filesfirst_submission_date, last_submission_date, positives, times_submitted, sizelast_submission_date-
related_ip_addressesip, last_modification_date, positiveslast_modification_date-
related_references--
related_urlsfirst_submission_date, last_submission_date, positives, times_submitted, statuslast_submission_date-

Available relationships are described in the Threat Actor object documentation.

Language
Click Try It! to start a request and see the response here!