VirusTotal

Delete an IoC collection via DELETE /collections/{id}. Examples Delete a private IoC collection. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete items from an IoC collection via DELETE /collections/{id}/{relationship}. As explained in /collections, for the urls relationship you either use {"type": "url", "url": <a URL string Examples Delete an element, domain, from an existing IoC collection. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete a comment via DELETE /comments/{id}.

Delete a graph via DELETE /graphs/{id}.

Revoke edit graph permissions from a user or group via DELETE /graphs/{id}/relationships/editors/{user_or_group_id}.

Revoke view permission from a user or group via DELETE /graphs/{id}/relationships/viewers/{user_or_group_id}.

Revoke group admin permissions from a user via DELETE /groups/{id}/relationships/administrators/{user_id}.

Remove a user from a group via DELETE /groups/{id}/relationships/users/{user_id}.

Delete Livehunt notifications via DELETE /intelligence/hunting_notifications. This endpoint deletes Google Threat Intelligence Hunting Livehunt notifications in bulk. If the tag parameter is specified all your notifications with the given tag will be deleted. If the tag parameter is not specified all your notifications will be deleted. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete a Livehunt notification via DELETE /intelligence/hunting_notifications/{id}. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Remove all Livehunt rulesets via DELETE /intelligence/hunting_rulesets. This API call deletes all rulesets owned by the user and removes the user from the list of editors in rules shared with them. This operation is asynchronous: the handler launches a background job and returns immediately. This API endpoint returns a Operation object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. THIS TOOL CANNOT BE CALLED and refuses before any request is sent: VirusTotal requires an `x-confirm-delete` request header set to the connection owner's VirusTotal username as confirmation, in its own words 'since this is a very destructive operation'. The MCP dispatcher has no header channel, and filling the header connector-side would defeat the confirmation rather than satisfy it. Delete Livehunt rulesets one at a time with the Delete a Livehunt ruleset tool (DELETE /intelligence/hunting_rulesets/{id}), which addresses its target in the path and needs no confirmation header.

Delete a Livehunt ruleset via DELETE /intelligence/hunting_rulesets/{id}. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Revoke Livehunt ruleset edit permission from a user or group via DELETE /intelligence/hunting_rulesets/{id}/relationships/editors/{user_or_group_id}. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete a Retrohunt job via DELETE /intelligence/retrohunt_jobs/{id}. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete notifications from the IoC Stream via DELETE /ioc_stream. Uses the same filters than the IoC Stream (GET /ioc_stream) to delete all the matching notifications. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete an IoC Stream notification via DELETE /ioc_stream_notifications/{id}. Deletes an IoC Stream notification. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete a private file report via DELETE /private/files/{id}. This endpoint deletes a private file from storage, as well as all the PrivateFile and PrivateAnalysis associated with it (unless only_from_storage=true is used. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Delete a user via DELETE /users/{id}. This request deletes a given user. A user account can only be deleted by its owner, a 403 error is returned otherwise. An additional x-user-password header is required, which is used as confirmation. THIS TOOL CANNOT BE CALLED and refuses before any request is sent: VirusTotal requires the account holder's own VirusTotal PASSWORD in an `x-user-password` request header as confirmation for this call. A password is a credential Agentic Fabriq does not hold and must never accept as a tool argument -- it would land in this tool's schema and in the transcript of every call -- and the MCP dispatcher has no header channel to carry one in any case. Delete the account from the VirusTotal web UI instead. Note that the account this would delete is the one whose API key this connection stores, so the call would also destroy the connection's own credential.

Get a URL / file analysis via GET /analyses/{id}. Returns an Analysis object.

Get objects related to an analysis via GET /analyses/{id}/{relationship}. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Available relationships are described in the analysis object documentation.

Get object descriptors related to an analysis via GET /analyses/{id}/relationships/{relationship}. This endpoint is the same as /analyses/{id}/{relationship} except it returns just the related object's descriptors (ID and context attributes, if any) instead of returning all attributes.

Get an attack tactic object via GET /attack_tactics/{id}.

Get objects related to an attack tactic via GET /attack_tactics/{id}/{relationship}. Available relationships are described in the Attack Tactic object documentation.

Get object descriptors related to an attack tactic via GET /attack_tactics/{id}/relationships/{relationship}. This endpoint is the same as /attack_tactics/{id}/{relationship} except it returns just the related object's descriptor instead of returning all attributes.

Get an attack technique object via GET /attack_techniques/{id}.

Get objects related to an attack technique via GET /attack_techniques/{id}/{relationship}. Available relationships are described in the Attack Technique object documentation.

Get object descriptors related to an attack technique via GET /attack_techniques/{id}/relationships/{relationship}. This endpoint is the same as /attack_techniques/{id}/{relationship} except it returns just the related object's descriptor instead of returning all attributes.

List threat objects (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections. This endpoint allows us to search and filter Threat Intelligence objects effectively. It returns a list of Threat objects with a collection_type parameter whose value can be one of the followings: - collection: Collections of Indicators of Compromise are grouped together based on their observed usage in the wild in malicious campaigns or their association with specific malware families. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a Threat via GET /collections/{id}. This endpoint returns a Threat Actor, Campaign, Malware Family, Software or Toolkit Actor, IoC Collection, Report or a Vulnerability object. Examples Get a threat actor report. Get a malware or toolkit report. Get a campaign report. Get a IoC collection report. Get a vulnerability report. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Export aggregations / commonalities from a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections/{id}/aggregations/download/{format}. Examples Export commonalities from a threat actor. Export commonalities from a malware or toolkit. Export commonalities from a campaign. Export commonalities from a IoC collection. Export commonalities from a vulnerability. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects related to a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections/{id}/{relationship}. This endpoint returns available relationships that are described in the Threat Actor, Campaign, Malware Family, Software or Toolkit, IoC Collection, Reports and Vulnerability objects documentation. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Export IOCs from a given threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report)'s relationship via GET /collections/{id}/{relationship}/download/{format}. Examples Export files related to a given threat actor. Export files related to a given malware or toolkit. Export files related to a given campaign. Export files related to a given IoC collection. Export files related to a given vulnerability. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get comments from a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections/{id}/comments. Returns a list of Comments objects. Examples Get 3 community comments from a threat actor. Get 3 community comments from a malware or toolkit. Get 3 community comments from a campaign. Get 3 community comments from a IoC collection. Get 3 community comments from a vulnerability. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Export IOCs from a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections/{id}/download/{format}. Examples Export IoCs from a threat actor. Export IoCs from a malware or toolkit. Export IoCs from a campaign. Export IoCs from a IoC collection. Export IoCs from a vulnerability. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get MITRE tactics and techniques associated with a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections/{id}/mitre_tree. Returns a list of MITRE tactics with their correspondent techniques that are associated with the Threat Actor, Campaign,Malware family, Software or Toolkit, IoC Collection, Report or Vulnerability as follows: Example response Examples Get the MITRE tree associated with a threat actor. Get the MITRE tree associated with a malware or toolkit. Get the MITRE tree associated with a campaign. Get the MITRE tree associated with a IoC collection. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get object descriptors related to a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections/{id}/relationships/{relationship}. This endpoint is the same as /collections/{id}/{relationship} for actors, campaigns, malware and IoC collections, reports or vulnerabilities except it returns just the related object's descriptor instead of returning all attributes. Available relationships are described in the Threat Actor, Campaign, Malware Family, Software or Toolkit, IoC Collection, Reports and Vulnerability objects documentation. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Search IoCs inside a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) via GET /collections/{id}/search. Allows to search IoCs inside a threat object (threat actor, campaign,malware & tool, IoC collection, report or vulnerability) using advanced intelligence queries. The expected input is the same as /intelligence/search. By default it searches files, in order to search other entities use entity:domain/ip/url. Examples Search for IoCs related to a threat actor that meet certain conditions. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get latest comments via GET /comments. This endpoint retrieves information about the latest comments added to Google Threat Intelligence. You can do some filtering over those comments, and get only those that contains a certain tag inside (e.g. filter=tag:malware).

Get a comment object via GET /comments/{id}.

Get objects related to a comment via GET /comments/{id}/{relationship}. Comment objects are related to other objects in the Google Threat Intelligence dataset. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationships endpoint. All available relationships are documented in the Comment API object page.

Get object descriptors related to a comment via GET /comments/{id}/relationships/{relationship}. This endpoint is the same as /comments/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

Get a domain report via GET /domains/{domain}. Returns a Domain object.

Get objects related to a domain via GET /domains/{domain}/{relationship}. Domain objects have number of relationships to other Domains and objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. All available relationships are documented in the domain API object page.

Get comments on a domain via GET /domains/{domain}/comments. Returns a list of Comment objects.

Get object descriptors related to a domain via GET /domains/{domain}/relationships/{relationship}. This endpoint is the same as /domains/{domain}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

Get votes on a domain via GET /domains/{domain}/votes. Returns a list of Vote objects.

Get a minutely domain feed batch via GET /feeds/domains/{time}. With this endpoint you can download an individual one-minute batch by providing a time consisting of a string with format YYYYMMDDhhmm. Time 201912010802 will return the batch corresponding to December 1st, 2019 08:02 UTC. You can download batches up to 7 days old, and the most recent batch has always a 60 minutes lag with respect with to the current time. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get an hourly domain feed batch via GET /feeds/domains/hourly/{time}. This endpoint returns a single package containing all minutely packages returned in /feeds/domains/{time} endpoint for a given hour. The returned file is a .tar.bz2 file which contains the 60 minutely feeds for that hour. The provided time argument must be in YYYYMMDDhh format. For example, time 2021012211 returns the batches correspoding to January 21st 2021 11:00 - 11:59 UTC. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a per-minute file behaviour feed batch via GET /feeds/file_behaviours/{time}. With this endpoint you can download an individual one-minute batches by providing a time consisting of a string with format YYYYMMDDhhmm. Time 201912010802 will return the batch corresponding to December 1st, 2019 08:02 UTC. You can download batches up to 7 days old, and the most recent batch has always a 60 minutes lag with respect to the current time. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get the EVTX file generated during a file’s behavior analysis (IoC Feeds) via GET /feeds/file_behaviours/{token}/evtx. Each JSON object contained in the file behaviour feed packages include a link to this API endpoint to download the extracted EVTX from the file's Windows sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link: The link only works during the feed's lifetime. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a file behaviour's detailed HTML report via GET /feeds/file_behaviours/{token}/html. Each JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the the file's sandbox execution HTML report. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link: The link only works during the feed's lifetime. Check /feeds/file_behaviours/{time} for more information. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get the memdump file generated during a file’s behavior analysis (IoC Feeds) via GET /feeds/file_behaviours/{token}/memdump. Each JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the extracted memdump from the file's sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link: The link only works during the feed's lifetime. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get the PCAP file generated during a file’s behavior analysis (IoC Feeds) via GET /feeds/file_behaviours/{token}/pcap. Each JSON object contained in the file behaviour feed packages include a URL to this API endpoint to download the extracted PCAP from the file's sandbox execution. The available in the feed link already includes the download token required by this endpoint. The following snippet represents the JSON structure in the file behaviour feed that takes to the link: The link only works during the feed's lifetime. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get an hourly file behaviour feed batch via GET /feeds/file_behaviours/hourly/{time}. This endpoint returns a single package containing all minutely packages returned in /feeds/file_behaviours/{time} endpoint for a given hour. The returned file is a .tar.bz2 file which contains the 60 minutely feeds for that hour. The provided time argument must be in YYYYMMDDhh format. For example, time 2021012211 returns the batches correspoding to January 21st 2021 11:00 - 11:59 UTC. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a per-minute file feed batch via GET /feeds/files/{time}. With this endpoint you can download an individual one-minute batch by providing a time consisting of a string with format YYYYMMDDhhmm. Time 201912010802 will return the batch corresponding to December 1st, 2019 08:02 UTC. You can download batches up to 7 days old, and the most recent batch has always a 60 minutes lag respecting to the current time. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Download a file published in the file feed via GET /feeds/files/{token}/download. Each JSON object contained in the file feed packages include a URL to this API endpoint to download the corresponding file. The link only works during the feed's lifetime, which is 7 days. Check /feeds/files/{time} for more information. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a hourly file feed batch via GET /feeds/files/hourly/{time}. This endpoint returns a single package containing all minutely packages returned in /feeds/files/{time} endpoint for a given hour. The returned file is a .tar.bz2 file which contains the 60 minutely feeds for that hour. The provided time argument must be in YYYYMMDDhh format. For example, time 2021012211 returns the batches correspoding to January 21st 2021 11:00 - 11:59 UTC. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a minutely IP address feed batch via GET /feeds/ip_addresses/{time}. With this endpoint you can download an individual one-minute batch by providing a time consisting of a string with format YYYYMMDDhhmm. Time 201912010802 will return the batch corresponding to December 1st, 2019 08:02 UTC. You can download batches up to 7 days old, and the most recent batch has always a 60 minutes lag with respect with to the current time. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get an hourly IP address feed batch via GET /feeds/ip_addresses/hourly/{time}. This endpoint returns a single package containing all minutely packages returned in /feeds/ip_addresses/{time} endpoint for a given hour. The returned file is a .tar.bz2 file which contains the 60 minutely feeds for that hour. The provided time argument must be in YYYYMMDDhh format. For example, time 2021012211 returns the batches correspoding to January 21st 2021 11:00 - 11:59 UTC. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a minutely URL feed batch via GET /feeds/urls/{time}. With this endpoint you can download an individual one-minute batch by providing a time consisting of a string with format YYYYMMDDhhmm. Time 201912010802 will return the batch corresponding to December 1st, 2019 08:02 UTC. You can download batches up to 7 days old, and the most recent batch has always a 60 minutes lag with respect with to the current time. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get an hourly URL feed batch via GET /feeds/urls/hourly/{time}. This endpoint returns a single package containing all minutely packages returned in /feeds/urls/{time} endpoint for a given hour. The returned file is a .tar.bz2 file which contains the 60 minutely feeds for that hour. The provided time argument must be in YYYYMMDDhh format. For example, time 2021012211 returns the batches correspoding to January 21st 2021 11:00 - 11:59 UTC. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a file behavior report from a sandbox via GET /file_behaviours/{sandbox_id}. Fetches a File behaviour object by ID. Sandbox Report identifiers A Sandbox report ID has two main components: the analysed file's SHA256 and the sandbox name. These two components are joined by a _ character.

Get objects related to a behaviour report via GET /file_behaviours/{sandbox_id}/{relationship}. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Available relationships are described in the File behaviour object documentation.

Get the EVTX file generated during a file’s behavior analysis (IoC Investigation) via GET /file_behaviours/{sandbox_id}/evtx. Fetch the EVTX file associated with the sandbox execution. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a detailed HTML behaviour report (IoC Investigation) via GET /file_behaviours/{sandbox_id}/html. Returns a File behaviour object as an HTML report. Sandbox Report identifiers A Sandbox report ID has two main components: the analysed file's SHA256 and the sandbox name. These two components are joined by a _ character. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get the memdump file generated during a file’s behavior analysis (IoC Investigation) via GET /file_behaviours/{sandbox_id}/memdump. Fetch the memdump file associated with the sandbox execution. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get the PCAP file generated during a file’s behavior analysis (IoC Investigation) via GET /file_behaviours/{sandbox_id}/pcap. Fetch the PCAP file associated with the sandbox execution. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get object descriptors related to a behaviour report via GET /file_behaviours/{sandbox_id}/relationships/{relationship}. This endpoint is the same as /file_behaviours/{sandbox_id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

Get a file report via GET /files/{id}. Returns a File object.

Get a summary of all MITRE ATT&CK techniques observed in a file (IoC Investigation) via GET /files/{id}/behaviour_mitre_trees. This endpoint returns a summary of MITRE ATT&CK tactics and techniques observed in each of the sandbox reports of a file. The resulting structure is the following one:.

Get a summary of all behavior reports for a file (IoC Investigation) via GET /files/{id}/behaviour_summary. This endpoint returns a summary with behavioural information about the file. The summary consists in merging together the reports produced by the multiple sandboxes we have integrated in VirusTotal. This API call returns all fields contained in the File behaviour object, except the ones that make sense only for individual sandboxes: - analysis_date - behash - has_html_report - has_pcap - last_modification_date - sandbox_name.

Get all behavior reports for a file via GET /files/{id}/behaviours. This endpoint returns behavioural information from each sandbox about the file. This API call returns all fields contained in the File behaviour object. Note some of the entries have - has_html_report if true you may fech the HTML File behaviour. - has_pcap if true you may fech the PCAP File behaviour.

Get objects related to a file via GET /files/{id}/{relationship}. File objects have many relationships to other files and objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Some relationships are accessible only to users who have access to VirusTotal Enterprise package. More common relationships are described in the File object documentation and you can use the metadata endpoint to get the full list of relationships.

Get comments on a file via GET /files/{id}/comments. Returns a list of Comment objects.

Download a file via GET /files/{id}/download. This endpoint is similar to GET /files/{id}/download_url, but it redirects you to the download URL. The download URL you are redirected to can be reused as many times as you want for a period of 1 hour. After that period the URL expires and can't be used anymore. THIS TOOL CANNOT BE CALLED and refuses before any request is sent: This endpoint answers 302 with a signed download URL on a third-party storage host, and this connector never follows a redirect: httpx strips only `Authorization` on a cross-origin hop, so VirusTotal's `x-apikey` header would be sent to that host. Call Get a file's download URL (GET /files/{id}/download_url) instead -- it returns the same signed URL as JSON, reusable for an hour.

Get a file’s download URL via GET /files/{id}/download_url. This endpoint returns a signed URL from where you can download the specified file. Getting the URL counts as a file download in your quota, even if you don't actually download the file, but once you have the URL you can use it to download the file multiple times without consuming any quota at all. The URL expires after 1 hour.

Get object descriptors related to a file (IoC Investigation) via GET /files/{id}/relationships/{relationship}. This endpoint is the same as /files/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

Get votes on a file via GET /files/{id}/votes. Returns a list of Vote objects.

Get a URL for uploading large files (IoC Investigation) via GET /files/upload_url. For uploading files smaller than 32MB you can simply use the POST /files endpoint, but for larger files you need to obtain a special upload URL first, and then send the POST request to the upload URL instead of sending it to /files. The POST request should have the same format expected by the POST /files endpoint. Each upload URL can be used only once.

Search graphs via GET /graphs. Endpoint used to search graphs. There are a set of multiple modifiers that you can use to refine your search results. You can combine all of them together and use them in conjunction with AND, OR and NOT operators. Date and numeric fields support the suffix plus or minus to match values greater or less than the passed value. If not sign has been added to the modifier, you will get exact matches.

Get a graph object via GET /graphs/{id}. Returns a Graph object.

Get objects related to a graph via GET /graphs/{id}/{relationship}. Graph objects have number of relationships to other objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Some relationships are accesible only to users who have access to Google Threat Intelligence. The relationships supported by graph objects are documented in the Graph API object page.

Get comments on a graph via GET /graphs/{id}/comments. This endpoint returns the comments posted in a given graph. Check Graph comments relationship page to know more about the returned object.

Get object descriptors related to a graph via GET /graphs/{id}/relationships/{relationship}. This endpoint is the same as /graphs/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

Get users and groups that can edit a graph via GET /graphs/{id}/relationships/editors. This endpoint returns the users and groups that can edit the graph. The graph needs to be shared with them as Editor to appear here.

Check if a user or group can edit a graph via GET /graphs/{id}/relationships/editors/{user_or_group_id}. This endpoint returns true if the user or group has Editor access to the graph.

Get users and groups that can view a graph via GET /graphs/{id}/relationships/viewers. This endpoint returns the users that can view the graph. The graph needs to be shared with them as Viewer to appear here.

Check if a user or group can view a graph via GET /graphs/{id}/relationships/viewers/{user_or_group_id}. This endpoint returns true if the user has Viewer access to the graph.

Get a group object via GET /groups/{id}.

Get a group’s API usage via GET /groups/{id}/api_usage. This endpoint retrieves information about a the API usage, broken down by endpoint, of a group in a specific range of days (last 30 days by default). The period of time can be delimited by the two query parameters start_date and end_date, being the first and last day when API V3 usage data will be retrieved, respectively. The data available includes only the last 60 natural days.

Get objects related to a group via GET /groups/{id}/{relationship}. Group objects have relationships to other objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. The relationships supported by group objects are described in the Group object section.

Get administrators for a group via GET /groups/{id}/relationships/administrators. Returns a list of User objects.

Check if a user is a group admin via GET /groups/{id}/relationships/administrators/{user_id}.

Get object descriptors related to a group via GET /groups/{id}/relationships/{relationship}. This endpoint is the same as /groups/{id}/{relationship} except it returns just the related object's descriptor (and context attributes, if any) instead of returning all attributes.

Get Service Accounts of a group via GET /groups/{id}/relationships/service_accounts. Get all the Service Accounts belonging to your Google Threat Intelligence group.

Get group users via GET /groups/{id}/relationships/users.

Check if a user is a group member via GET /groups/{id}/relationships/users/{user_id}.

Retrieve file objects for Livehunt notifications via GET /intelligence/hunting_notification_files. Each file object returned, _in addition to all the file details_, has a context_attributes property that contains information about the Google Threat Intelligence Hunting Livehunt notification tied to the file, this is an example: Other than that, the filter parameter allows to filter the matching files according to the Google TI Hunting Livehunt notification properties. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get Livehunt notifications via GET /intelligence/hunting_notifications. This endpoint returns the notifications triggered by your own Livehunt rulesets, or by any other rule owned by somebody else and shared with you. The filter parameter allows to filter the notification according to the values of certain attributes. For example you can get the notifications that are tagged as my_rule with tag:my_rule. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a Livehunt notification object via GET /intelligence/hunting_notifications/{id}. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get Livehunt rulesets via GET /intelligence/hunting_rulesets. This endpoint returns the Google Threat Intelligence Hunting Livehunt rulesets viewable by the user making the request. A ruleset is viewable by a user either if it was created by the user or if it was shared with him by someone else. This endpoint is equivalent to GET /users/{user}/hunting_rulesets, where {user} is the username of the user owning the API key. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a Livehunt ruleset via GET /intelligence/hunting_rulesets/{id}. Returns a Hunting Ruleset object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects related to a Livehunt ruleset via GET /intelligence/hunting_rulesets/{id}/{relationship}. Hunting Rulesets objects have relationships to other objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. The relationships supported by Hunting Rulesets objects are documented in the Hunting Rulesets API object page. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get object descriptors related to a Livehunt ruleset via GET /intelligence/hunting_rulesets/{id}/relationships/{relationship}. Same as /hunting_rulesets/{id}/{relationships} except it returns just the related object's descriptor (and context attributes, if any) instead of returning all attributes. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Check if a user or group is a Livehunt ruleset editor via GET /intelligence/hunting_rulesets/{id}/relationships/editors/{user_or_group_id}. This endpoint returns true if the user has editing access to the Hunting ruleset. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a list of Retrohunt jobs via GET /intelligence/retrohunt_jobs. Returns a list of Retrohunt Job objects. Accepted filters are status:(starting|running|aborting|aborted|finished). LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a Retrohunt job object via GET /intelligence/retrohunt_jobs/{id}. Returns a Retrohunt Job object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Retrieve matches for a Retrohunt job via GET /intelligence/retrohunt_jobs/{id}/matching_files. Retrohunt jobs are related to other objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationships URL. The supported relationships for Retrohunt jobs are described in the Retrohunt Jobs API object page. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Advanced corpus search via GET /intelligence/search. This endpoint allows to search for files in the Google Threat Intelligence's dataset, using the same query syntax that you would use in the Google TI user interface. URL Safe encoding must be used when using this endpoint programatically. The result from this endpoint is a collection of file objects that match the given query. If the descriptors_only parameter is set to true, the resulting collection will contain only the object descriptors. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get file content search snippets via GET /intelligence/search/snippets/{snippet}. This request returns file content snippets that matched a query in the /search endpoint. The response is a list of strings containing both content hexdump and plain text. Matched content is found between * characters, more file content is returned to provide additional context about the match. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Check a ZIP file’s status (IoC Investigation) via GET /intelligence/zip_files/{id}. This endpoint returns information about a ZIP file. The status attribute contains one of the following statuses: - starting - creating - finished - timeout - error-starting - error-creating When the status is finished you may proceed to download the file. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Download a ZIP file (IoC Investigation) via GET /intelligence/zip_files/{id}/download. This endpoint is similar to GET /zip_files/{id}/download_url, but it redirects you to the download URL. The download URL you are redirected to can be reused as many times as you want for a period of 1 hour. After that period the URL expires and can't be used anymore. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. THIS TOOL CANNOT BE CALLED and refuses before any request is sent: This endpoint answers 302 with a signed download URL on a third-party storage host, and this connector never follows a redirect (VirusTotal's `x-apikey` header would be sent to that host; httpx strips only `Authorization`). Call Get a ZIP file's download URL (GET /intelligence/zip_files/{id}/download_url) instead -- it returns the same signed URL as JSON, valid for an hour.

Get a ZIP file’s download URL (IoC Investigation) via GET /intelligence/zip_files/{id}/download_url. This endpoint returns a signed URL from where you can download the specified ZIP file. The URL expires after 1 hour. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects from the IoC Stream via GET /ioc_stream. The IoC stream endpoint returns different types of objects (files, URLs, domains, IP addresses) coming from multiple origins (you can restrict the returned types by using the filters explained below). In addition, depending on the origin of the notification there will be different context attributes added to these objects. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get an IoC Stream notification via GET /ioc_stream_notifications/{id}. Returns an IoC Stream notification. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get an IP address report via GET /ip_addresses/{ip}. Returns an IP address object.

Get objects related to an IP address via GET /ip_addresses/{ip}/{relationship}. IP addresses have number of relationships to other objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. All available relationships are documented in the IP address API object page.

Get comments on an IP address via GET /ip_addresses/{ip}/comments. Returns a list of Comment objects.

Get object descriptors related to an IP address via GET /ip_addresses/{ip}/relationships/{relationship}. This endpoint is the same as /ip_addresses/{ip}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

Get votes on an IP address via GET /ip_addresses/{ip}/votes. Returns a list of Vote objects.

Get Google Threat Intel metadata via GET /metadata. This endpoint returns a dictionary with metadata related to Google Threat Intelligence, which includes a full list of engines in use, a list of existing privileges, etc.

Get an operation object via GET /operations/{id}. Returns an Operation object.

Get a list of popular threat categories via GET /popular_threat_categories.

List private analyses via GET /private/analyses. Returns a list of the last private analyses. The analyses are sorted by most recent first. You can use ?order=date- to reverse the order. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a private analysis via GET /private/analyses/{id}. With this endpoint you can check the status of a private file analysis. It expects the analysis ID returned by the POST /private/files endpoint, and will return a private analysis object with information about the analysis. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects related to a private analysis via GET /private/analyses/{id}/{relationship}. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Available relationships are described in the private analysis object documentation. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get object descriptors related to a private analysis via GET /private/analyses/{id}/relationships/{relationship}. This endpoint is the same as /private/analyses/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a behaviour report from a private file via GET /private/file_behaviours/{sandbox_id}. Fetches a Private File Behaviour object by ID. It expects the sandbox ID returned by the GET /private/files/{id}/behaviours endpoint. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects related to a private file's behaviour report via GET /private/file_behaviours/{sandbox_id}/{relationship}. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Available relationships are described in the private file behaviour object documentation. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get the EVTX file generated during a private file’s behavior analysis via GET /private/file_behaviours/{sandbox_id}/evtx. Fetch the EVTX file associated with the sandbox execution. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get a detailed HTML behaviour report (Private Scanning) via GET /private/file_behaviours/{sandbox_id}/html. Returns a Private File Behaviour object as an HTML report. It expects the sandbox ID returned by the GET /private/files/{id}/behaviours endpoint. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get the memdump file generated during a private file’s behavior analysis via GET /private/file_behaviours/{sandbox_id}/memdump. Fetch the PCAP file associated with the sandbox execution. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get the PCAP file generated during a private file’s behavior analysis via GET /private/file_behaviours/{sandbox_id}/pcap. Fetch the memdump file associated with the sandbox execution. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. REPLY IS A FILE, NOT JSON: this endpoint answers with the file itself, so the result is a bounded descriptor of it (content_type, content_length, and the decoded text only when the body is textual and small). Unbounded bytes are never carried into a tool result; fetch the file from VirusTotal directly if the bytes themselves are needed.

Get object descriptors related to a private file's behaviour report via GET /private/file_behaviours/{sandbox_id}/relationships/{relationship}. This endpoint is the same as /private/file_behaviours/{sandbox_id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get the behaviour reports from a private file via GET /private/file/{id}/behaviours. Fetches all the Private File Behaviour reports available for a private file. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

List private files via GET /private/files. Returns a list of previously analysed private files. The files are always ordered by SHA256. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a private file report via GET /private/files/{id}. This endpoint return information about a file scanned privately. Notice that it only accepts SHA-256 as the file's ID, MD5 and SHA-1 are not supported like in its GET /files/{id} public counterpart. The SHA-256 for the analysed file can be computed by yourself or obtained from the response to the call to GET /analyses/{id}. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a summary of all MITRE ATT&CK techniques observed in a file (Private Scanning) via GET /private/files/{id}/behaviour_mitre_trees. This endpoint returns a summary of MITRE ATT&CK tactics and techniques observed in each of the behaviour reports of a file. The resulting structure is the following one:. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a summary of all behavior reports for a file (Private Scanning) via GET /private/files/{id}/behaviour_summary. This endpoint returns a summary with behavioural information about the private file. The summary consists in merging together the reports produced by the multiple sandboxes we have integrated in VirusTotal. This API call returns all fields contained in the Private File Behaviour object, except the ones that make sense only for individual sandboxes: - behash - has_html_report - has_pcap - last_modification_date - sandbox_name. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects related to a private file via GET /private/files/{id}/{relationship}. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Available relationships are described in the private file object documentation. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get object descriptors related to a file (Private Scanning) via GET /private/files/{id}/relationships/{relationship}. This endpoint is the same as /files/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a URL for uploading large files (Private Scanning) via GET /private/files/upload_url. For uploading files smaller than 32MB you can simply use the POST /files endpoint, but for larger files you need to obtain a special upload URL first, and then send the POST request to the upload URL instead of sending it to /private/files. The POST request should have the same format expected by the POST /files endpoint. Each upload URL can be used only once. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a URL analysis report via GET /private/urls/{id}. Returns a URL object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects related to a private URL via GET /private/urls/{id}/{relationship}. URL objects have number of relationships to other URLs and objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. Some relationships are accessible only to users who have access to VirusTotal Enterprise package. The relationships supported by URL objects are documented in the URL API object page. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get object descriptors related to a private URL via GET /private/urls/{id}/relationships/{relationship}. This endpoint is the same as /private/urls/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Check a ZIP file’s status (Private Scanning) via GET /private/zip_files/{id}. This endpoint returns information about a ZIP file. The status attribute contains one of the following statuses: - starting - creating - finished - timeout - error-starting - error-creating When the status is finished you may proceed to download the file. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Download a ZIP file (Private Scanning) via GET /private/zip_files/{id}/download. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool. THIS TOOL CANNOT BE CALLED and refuses before any request is sent: This endpoint answers 302 with a signed download URL on a third-party storage host, and this connector never follows a redirect (VirusTotal's `x-apikey` header would be sent to that host; httpx strips only `Authorization`). Call Get a ZIP file's download URL (GET /private/zip_files/{id}/download_url) instead -- it returns the same signed URL as JSON, valid for an hour.

Get a ZIP file’s download URL (Private Scanning) via GET /private/zip_files/{id}/download_url. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a DNS resolution object via GET /resolutions/{id}. This endpoint retrieves a Resolution object by its ID. A resolution object ID is made by appending the IP and the domain it resolves to together.

Search for files, URLs, domains, IPs and comments via GET /search. This endpoint searches any of the following: - A file hash - Returns a File object. - A URL - Returns a URL object. - A domain - Returns Domain object. - A IP address - Returns an IP address object. - Comments by tags - Returns a list of Comment objects. The request returns a list of objects matching the query.

Get a Service Account object via GET /service_accounts/{id}. Get the information about a Service Account object.

Get a crowdsourced Sigma rule object via GET /sigma_rules/{id}. Returns a Sigma Rule object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a submission object via GET /submission/{id}. Returns a Submission object.

Get a URL report via GET /urls/{id}. Returns a URL object.

Get objects related to a URL via GET /urls/{id}/{relationship}. URL objects have number of relationships to other URLs and objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. The relationships supported by URL objects are documented in the URL API object page.

Get comments on a URL via GET /urls/{id}/comments. Returns a list of Comment objects. Check comments done in VT Community regarding a specific URL. - data: list of ("comment" objects)[ref:comment-object]. - links: contains "self" with a reference to this group of comments and "next", with a reference to the next group. - cursor: contains the cursor token used to access the next group of comments.

Get object descriptors related to a URL via GET /urls/{id}/relationships/{relationship}. This endpoint is the same as /urls/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

Get votes on a URL via GET /urls/{id}/votes. Returns a list of Vote objects.

Get a user object via GET /users/{id}. This endpoint retrieves information about a user, including the privileges and quotas associated to the user. The user can be retrieved either by user ID or by API key, but the former only works if the requester is the user himself or an administrator of a group the user belongs to. Returns an User object.

Get a user’s API usage via GET /users/{id}/api_usage. This endpoint retrieves information about a the API usage, broken down by endpoint, of an user in a specific range of days (last 30 days by default). The period of time can be delimited by the two query parameters start_date and end_date, being the first and last day when API usage data will be retrieved, respectively. The data available includes only the last 60 natural days.

Get objects related to a user via GET /users/{id}/{relationship}. Users are related to other objects in our dataset. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to this API endpoint. Some relationships are only accessible to their account's owners and their group's admins. The supported relationships are documented in the User API object page.

Get a user’s quota summary via GET /users/{id}/overall_quotas. This endpoint returns a summary of a user's overall quotas including: - allowed: \<_integer_ - inherited_from: \<_string_ - used: \<_integer_ Consumption data based on natural month and UTC.

Get object descriptors related to a user via GET /users/{id}/relationships/{relationship}. This endpoint is the same as /users/{id}/{relationship} except it returns just the related object's IDs (and context attributes, if any) instead of returning all attributes.

List Crowdsourced YARA Rules via GET /yara_rules. This endpoint lists the different Google Threat Intelligence's Crowdsourced YARA rules. The filter parameter allows to filter the rules according to the values of certain attributes. For example you can get only the enabled rules with enabled:true. With name:foo and foo you can search for rules having the word "foo" in their names or in their meta values. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a Crowdsourced YARA rule via GET /yara_rules/{id}. Returns a YARA rule object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects related to a Crowdsourced YARA rule via GET /yara_rules/{id}/{relationship}. YARA rule objects have relationships to other objects. As mentioned in the Relationships section, those related objects can be retrieved by sending GET requests to the relationship URL. The relationships supported by YARA rule objects are documented in the YARA Rules API object page. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get objects descriptors related to a Crowdsourced YARA rule via GET /yara_rules/{id}/relationships/{relationship}. Same as /yara_rules/{id}/{relationships} except it returns just the related object's descriptor (and context attributes, if any) instead of returning all attributes. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Get a crowdsourced YARA ruleset via GET /yara_rulesets/{id}. Returns a YARA Ruleset object used in our crowdsourced YARA results. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Update an IoC collection via PATCH /collections/{id}. This endpoint allows updating an IoC collection's attributes (such as name or description) and adding new elements to the IoC collection by using a raw text. The following request body shows an example of how to update an IoC collection's name and add new IOCs to it by using a raw text: Examples Change the name and description of a private IoC collection. Make public a private IoC collection. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Update a graph object via PATCH /graphs/{id}.

Update a group object via PATCH /groups/{id}. This request accepts a JSON body containing the group attributes to update. Attributes not present in the request body remain the same. It returns the updated Group object.

Update a Livehunt ruleset via PATCH /intelligence/hunting_rulesets/{id}. Returns the updated Hunting Ruleset object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Update a user object via PATCH /users/{id}. This request accepts a JSON body containing the user attributes to update. Attributes not present in the request body remain the same. It returns the updated User object.

Create a new IoC collection via POST /collections. Use this endpoint to create new IoC collections. In the request body, send a collection object containing its name, description and the elements it will contain (for URLs you can either use the URL or its ID). All IOCs must be described as relationships of a newly created Collection object. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Add new items to an IoC collection via POST /collections/{id}/{relationship}. As explained in /collections, for the urls relationship you either use {"type": "url", "url": <a URL string Examples Add new elements, and domains, to an existing IoC collection. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Add a comment to a threat object (Actor, Malware & Tool, Campaign, IoC Collection, Vulnerability, Report) object via POST /collections/{id}/comments. With this endpoint you can post a comment for a given threat object (threat actor, campaign,malware & tool, IoC collection, report or vulnerability). The body for the POST request must be the JSON representation of a comment object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new comments. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Add a vote to a comment via POST /comments/{id}/vote.

Add a comment to a domain via POST /domains/{domain}/comments. With this endpoint you can post a comment for a given domain. The body for the POST request must be the JSON representation of a comment object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new comments. Any word starting with # in your comment's text will be considered a tag, and added to the comment's tag attribute. Returns a Comment object.

Add a vote to a domain via POST /domains/{domain}/votes. With this endpoint you can post a vote for a given domain. The body for the POST request must be the JSON representation of a vote object. Note however that you don't need to provide an ID for the object, as they are automatically generated for new votes. The verdict attribute must have be either harmless or malicious. Returns a votes object.

Request a file rescan (re-analyze) via POST /files/{id}/analyse. Files that have been already uploaded to Google TI can be re-analysed without uploading them again, you can use this endpoint for that purpose. The response is an object descriptor for the new analysis as in the POST /files endpoint. The ID contained in the descriptor can be used with the GET /analyses/{id} endpoint to get information about the analysis.

Add a comment to a file via POST /files/{id}/comments. With this endpoint you can post a comment for a given file. The body for the POST request must be the JSON representation of a comment object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new comments. Any word starting with # in your comment's text will be considered a tag, and added to the comment's tag attribute. Returns a Comment object.

Add a vote on a file via POST /files/{id}/votes. With this endpoint you can post a vote for a given file. The body for the POST request must be the JSON representation of a vote object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new votes. The verdict attribute must have be either harmless or malicious. Returns a Vote object.

Create a graph via POST /graphs. This endpoint can be used to create new graphs. Note that private graphs will increment the usage of the private graphs quota in your Google Threat Intelligence plan.

Add a comment to a graph via POST /graphs/{id}/comments.

Grant users and groups permission to edit a graph via POST /graphs/{id}/relationships/editors. This endpoint adds a user or groups as a graph editor.

Grant users and groups permission to see a graph via POST /graphs/{id}/relationships/viewers. This endpoint adds a user or group as a graph viewer.

Grant group admin permissions to a list of users via POST /groups/{id}/relationships/administrators. Update group administrator list. User emails must be used. If a username is used, a 400 error is returned. No admins are removed by using this endpoint. To revoke admin privileges from a certain user, use DELETE/groups/{id}/relationships/administrators/{user_id}.

Create a new Service Account via POST /groups/{id}/relationships/service_accounts. Create a new Service Account inside your Google Threat Intelligence group by only providing a descriptive identifier which must be unique inside your group.

Add users to a group via POST /groups/{id}/relationships/users. Update the group's user list. User emails must be used, if a username is used a 400 error is returned. No users are removed by using this endpoint. To remove group membership from a certain user, use DELETE/groups/{id}/relationships/users/{user_id}.

Create a new Livehunt ruleset via POST /intelligence/hunting_rulesets. This endpoint creates a new Google Threat Intelligence Hunting Livehunt ruleset. The request's body must have the following structure: Use the match_object_type to specify the expected entity kind to match with this ruleset. Allowed values are file, url, domain and ip. The name and rules attributes are required, the remaining ones are optional. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Grant Livehunt ruleset edit permissions for a user or group via POST /intelligence/hunting_rulesets/{id}/relationships/editors. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Transfer Livehunt ruleset to another user via POST /intelligence/hunting_rulesets/{id}/relationships/owner. Note: The new owner must be a member of the same group the ruleset was created with. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Create a new Retrohunt job via POST /intelligence/retrohunt_jobs. This endpoint creates a new Retrohunt job. The request's body must have the following structure: The rules attribute is required, but notification_email, corpus and time_range are optional. You should provide notification_email if you want to receive an email notification when the job is finished, while corpus allows you to select which dataset you want to scan with your job. There are two different corpuses: "main" and "goodware". LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Abort a Retrohunt job via POST /intelligence/retrohunt_jobs/{id}/abort. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Create a password-protected ZIP with Google Threat Intelligence files (IoC Investigation) via POST /intelligence/zip_files. Creates a ZIP file containing the files specified in the request. Optionally you can provide a password for protecting the ZIP file. The request's body must have the following structure: The response from this endpoint is the object corresponding to the newly created ZIP file. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Add a comment to an IP address via POST /ip_addresses/{ip}/comments. With this endpoint you can post a comment for a given IP address. The body for the POST request must be the JSON representation of a comment object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new comments. Any word starting with # in your comment's text will be considered a tag, and added to the comment's tag attribute. Returns a Comment object.

Add a vote to an IP address via POST /ip_addresses/{ip}/votes. With this endpoint you can post a vote for a given file. The body for the POST request must be the JSON representation of a vote object. Note however that you don't need to provide an ID for the object, as they are automatically generated for new votes. The verdict attribute must have be either harmless or malicious. Returns a Vote object.

Rescan a private file via POST /private/files/{sha256}/analyse. Reanalyses a private file. The same params from /files (other than the file) are accepted. Returns a private analysis. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Private Scan URL via POST /private/urls. This returns an Analysis ID. The analysis can be retrieved by using the Analysis endpoint. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Create a password-protected ZIP with Google Threat Intelligence files (Private Scanning) via POST /private/zip_files. Creates a ZIP file containing the files specified in the request. Optionally you can provide a password for protecting the ZIP file. The request's body must have the following structure: The response from this endpoint is the object corresponding to the newly created ZIP file. LICENCE: this endpoint needs a paid Google Threat Intelligence / VirusTotal Enterprise entitlement (private scanning, intelligence search, hunting, the IoC feeds and the threat-object collections are licensed separately). A free Community key reaches it and is refused with a privilege error -- that is the account's licence, not a broken tool.

Scan URL via POST /urls. This returns an Analysis ID. The analysis can be retrieved by using the Analysis endpoint.

Request a URL rescan (re-analyze) via POST /urls/{id}/analyse. Returns a Analysis object descriptor which can be used in the GET/analyses/{id} API endpoint to get further information about the analysis status.

Add a comment on a URL via POST /urls/{id}/comments. With this endpoint you can post a comment for a given URL. The body for the POST request must be the JSON representation of a comment object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new comments. Any word starting with # in your comment's text will be considered a tag, and added to the comment's tag attribute. Returns a Comment object.

Add a vote on a URL via POST /urls/{id}/votes. With this endpoint you can post a vote for a given URL. The body for the POST request must be the JSON representation of a vote object. Notice however that you don't need to provide an ID for the object, as they are automatically generated for new votes. The verdict attribute must have be either harmless or malicious. Returns a Vote object.