Get objects related to a threat actor


Special privileges required

Threat actors endpoints are only available to users with the Threat Landscape module.

The order parameter defines the order in which results are returned. They can be followed by a plus (+) or minus (-) sign for indicating ascending or descending order respectively (i.e: <order>+, <order>-). If no ascending/descending order is specified it's assumed to be ascending, so <order> and <order>+ are equivalent. If the order parameter is not provided, items are returned in a default order. The following table shows supported and default orders by relationship:

RelationshipSupported ordersDefault order
collectionscreation_date, last_modification_date, owner, name, subscribers, tlp, sigma_rules, yara_rulesets, domains, files, ip_addresses, references, threat_actors, urls, attack_techniques-
related_domainscreation_date, last_modification_date, last_update_date, positiveslast_modification_date-
related_filesfirst_submission_date, last_submission_date, positives, times_submitted, sizelast_submission_date-
related_ip_addressesip, last_modification_date, positiveslast_modification_date-
related_urlsfirst_submission_date, last_submission_date, positives, times_submitted, statuslast_submission_date-

Available relationships are described in the Threat Actor object documentation.

Click Try It! to start a request and see the response here!