get https://www.virustotal.com/api/v3/threat_actors//
Special privileges required
Threat actors endpoints are only available to users with Google Threat Intelligence Enterprise or Enterprise plus license.
The order parameter defines the order in which results are returned. They can be followed by a plus (+) or minus (-) sign for indicating ascending or descending order respectively (i.e: <order>+, <order>-). If no ascending/descending order is specified it's assumed to be ascending, so <order> and <order>+ are equivalent. If the order parameter is not provided, items are returned in a default order. The following table shows supported and default orders by relationship:
| Relationship | Supported orders | Default order |
|---|---|---|
| collections | creation_date, last_modification_date, owner, name, subscribers, tlp, sigma_rules, yara_rulesets, domains, files, ip_addresses, references, threat_actors, urls, attack_techniques | - |
| comments | - | date- |
| references | - | - |
| related_domains | creation_date, last_modification_date, last_update_date, positives | last_modification_date- |
| related_files | first_submission_date, last_submission_date, positives, times_submitted, size | last_submission_date- |
| related_ip_addresses | ip, last_modification_date, positives | last_modification_date- |
| related_references | - | - |
| related_urls | first_submission_date, last_submission_date, positives, times_submitted, status | last_submission_date- |
Available relationships are described in the Threat Actor object documentation.