Deprecated endpoint. This has been replaced by Google Threat Intelligence
We are gearing up to the transition into Google Threat Intelligence! The endpoints are documented at Threat Landscape -> Threat Actors, Malware & Tools, Campaigns, IoC Collections section. Note that when upgrading to Google Threat Intelligence you will enjoy a much larger knowledge base of threat actors, malware, toolkits and campaigns.
- For getting a threat actor's related objects, refer to
/collections/{id}/{relationship}endpoint documented here.- Find the new threat actor object definition here.
- Find additional information related to the new endpoints here.
Special privileges required
Threat actors endpoints are only available to users with the Threat Landscape module.
The order parameter defines the order in which results are returned. They can be followed by a plus (+) or minus (-) sign for indicating ascending or descending order respectively (i.e: <order>+, <order>-). If no ascending/descending order is specified it's assumed to be ascending, so <order> and <order>+ are equivalent. If the order parameter is not provided, items are returned in a default order. The following table shows supported and default orders by relationship:
| Relationship | Supported orders | Default order |
|---|---|---|
| collections | creation_date, last_modification_date, owner, name, subscribers, tlp, sigma_rules, yara_rulesets, domains, files, ip_addresses, references, threat_actors, urls, attack_techniques | - |
| comments | - | date- |
| references | - | - |
| related_domains | creation_date, last_modification_date, last_update_date, positives | last_modification_date- |
| related_files | first_submission_date, last_submission_date, positives, times_submitted, size | last_submission_date- |
| related_ip_addresses | ip, last_modification_date, positives | last_modification_date- |
| related_references | - | - |
| related_urls | first_submission_date, last_submission_date, positives, times_submitted, status | last_submission_date- |
Available relationships are described in the Threat Actor object documentation.