get_entities_related_to_a_collection
Retrieve related entities for a collection ID, including associations, attack techniques, domains, files, IPs, URLs, threat actors, and malware families.
Instructions
Retrieve entities related to the the given collection ID.
The following table shows a summary of available relationships for collection objects.
Relationship | Description | Return type |
associations | List of associated threats | collection |
attack_techniques | List of attack techniques | attack_technique |
domains | List of Domains | domain |
files | List of Files | file |
ip_addresses | List of IP addresses | ip_address |
urls | List of URLs | url |
threat_actors | List of related threat actors | collection |
malware_families | List of related malware families | collection |
software_toolkits | List of related tools | collection |
campaigns | List of related campaigns | collection |
vulnerabilities | List of related vulnerabilities | collection |
reports | List of reports | collection |
suspected_threat_actors | List of related suspected threat actors | collection |
hunting_rulesets | Google Threat Intelligence Yara rules that identify the given collection | hunting_ruleset |
Note on descriptors_only: When True, returns basic descriptors. When False, returns
detailed attributes.
IMPORTANT: descriptors_only must be False for the 'attack_techniques' relationship.
Args: id (required): Collection identifier. relationship_name (required): Relationship name. limit (optional): Limit the number of collections to retrieve. 10 by default. descriptors_only (optional)): Bool. Default True. Must be False when the target object type is 'attack_techniques'. Returns: List of objects related to the collection.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| limit | No | ||
| descriptors_only | No | ||
| relationship_name | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |