Get objects related to a threat actor

The order parameter defines the order in which results are returned. They can be followed by a plus (+) or minus (-) sign for indicating ascending or descending order respectively (i.e: <order>+, <order>-). If no ascending/descending order is specified it's assumed to be ascending, so <order> and <order>+ are equivalent. If the order parameter is not provided, items are returned in a default order. The following table shows supported and default orders by relationship:

RelationshipSupported ordersDefault order
collectionscreation_date, last_modification_date, owner, name, subscribers, tlp, sigma_rules, yara_rulesets, domains, files, ip_addresses, references, threat_actors, urls, attack_techniques-
related_domainscreation_date, last_modification_date, last_update_date, positiveslast_modification_date-
related_filesfirst_submission_date, last_submission_date, positives, times_submitted, sizelast_submission_date-
related_ip_addressesip, last_modification_date, positiveslast_modification_date-
related_urlsfirst_submission_date, last_submission_date, positives, times_submitted, statuslast_submission_date-

⚠️ Threat actors endpoints are only available to users with the vtinsights privilege.

Available relationships are described in the Threat Actor object documentation.

Click Try It! to start a request and see the response here!