🚧

Deprecated endpoint. This has been replaced by Google Threat Intelligence

We are gearing up to the transition into Google Threat Intelligence! The endpoints are documented at Threat Landscape -> Threat Actors, Malware & Tools, Campaigns, IoC Collections section. Note that when upgrading to Google Threat Intelligence you will enjoy a much larger knowledge base of threat actors, malware, toolkits and campaigns.

• For listing threat actors, refer to /collections endpoint documented here.
• Find the new threat actor object definition here.
• Find additional information related to the new endpoints here.

🚧

Special privileges required

Threat actors endpoints are only available to users with the Threat Landscape module.

Returns a list of Threat Actors objects.

Allowed filters:

• Text without modifiers: Threat actor's name or description.
• description: Threat actor's description. You can search for word or expressions (full-text search).
• name: Threat actor's name. Both name or aliases are allowed.
• source_region: Threat actor's source region. You can use ISO 3166-1 alpha-2 country codes, the ISO or the full country name.
• sponsor_region: Threat actor's sponsor region. Same use as source_region.
• targeted_industry: Threat actor's targeted industry.
• targeted_region: Threat actor's targeted region. Same use as source_region.

Allowed orders:

• first_seen_date
• last_modification_date
• last_seen_date
• related_entities_count

Some examples:
GET /api/v3/threat_actors?filter=targeted_region:US&order=last_seen_date-
GET /api/v3/threat_actors?filter=targeted_industry:government&order:related_entities_count-