search_iocs
Search for indicators of compromise across files, URLs, domains, and IPs in Google Threat Intelligence with customizable queries and ordering.
Instructions
Search Indicators of Compromise (IOC) in the Google Threat Intelligence platform.
You can search by for different IOC types using the entity modifier. Below, the different IOC types and the supported orders:
Entity type | Supported orders | Default order |
file | first_submission_date, last_submission_date, positives, times_submitted, size | last_submission_date- |
url | first_submission_date, last_submission_date, positives, times_submitted, status | last_submission_date- |
domain | creation_date, last_modification_date, last_update_date, positives | last_modification_date- |
ip | ip, last_modification_date, positives | last_modification_date- |
Note: The entity modifier can only be used ONCE per query.
You can find all available modifers at:
Files: https://gtidocs.virustotal.com/docs/file-search-modifiers
URLs: https://gtidocs.virustotal.com/docs/url-search-modifiers
Domains: https://gtidocs.virustotal.com/docs/domain-search-modifiers
IP Addresses: https://gtidocs.virustotal.com/docs/ip-address-search-modifiers
With integer modifers, use the - and + characters to indicate:
Greater than:
p:60+Less than:
p:60-Equal to:
p:60
Args query (required): Search query to find IOCs. limit: Limit the number of IoCs to retrieve. 10 by default. order_by: Order the results. "last_submission_date-" by default.
Returns: List of Indicators of Compromise (IoCs).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| order_by | No | last_submission_date- |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |