get_collection
Retrieve a VirusTotal collection by its ID to access threat actors, malware families, campaigns, or curated IOC sets. Optionally include relationships to fetch related IOCs like files, URLs, and domains.
Instructions
Retrieve a VirusTotal collection by ID. Collections represent threat actors, malware families, campaigns, intel reports, and curated IOC sets — often referenced from the related_threat_actors and collections relationships on other tools. Optionally include relationships (files, urls, domains, ip_addresses, references, threat_actors, related_collections, related_references, comments, owner, autogenerated_graphs) to fetch member IOCs in the same call.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Collection ID (e.g. a threat-actor, malware family, campaign, or report identifier returned from a relationship lookup) | |
| relationships | No | Optional list of relationships to include in the response |