Method: iocAssociations.fetchRelatedIocAssociations

Full name: projects.locations.instances.iocAssociations.fetchRelatedIocAssociations

List related Ioc Associations for a given Ioc Association.

HTTP request


Path parameters

Parameters
name

string

Required. The name of the ioc association resource to get the related ioc associations for. Format: projects/{project}/locations/{location}/instances/{instance}/iocAssociations/{iocAssociation}

Query parameters

Parameters
associationType

enum (AssociationType)

Required. The type of related IocAssociations to get.
pageSize

integer

Optional. The maximum number of IocAssociations to return. The default is 10, and the maximum value is 40.
pageToken

string

Optional. A page token, received from a previous iocAssociations.fetchRelatedIocAssociations call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to iocAssociations.fetchRelatedIocAssociations must match the call that provided the page token.
filter

string

Optional. A filter that can be used to retrieve specific ioc associations. Supported filters for Threat Actor Associtation Type: - Text without modifiers: Threat actor's name or description. - description: Threat actor's description. You can search for word or expressions (full-text search). - name: Threat actor's name. Both name or aliases are Supported. - source_region: Threat actor's source region. You can use ISO 3166-1 alpha-2 country codes, the ISO or the full country name. - sponsorRegion: Threat actor's sponsor region. Same use as source_region. targeted_industry: Threat actor's targeted industry. - targeted_region: Threat actor's targeted region. Same use as source_region.

Supported filters for Malware Associtation Type: - Text without modifiers: Collection's name, description or tag. - creation_date: Collection's creation date. - description: Collection's description. You can search for word or expressions (full-text search). - name: Collection's name. - owner: Collection's owner. - source_region: Collections's source region. You can use ISO 3166-1 alpha-2 country codes, the ISO or the full country name. - tag: Collection's tag. - targeted_industry: Collections's targeted industry. - targeted_region: Collections's targeted region. Same use as source_region. - threat_category: Collection's threat category.
orderBy

string

Optional. The order to sort the returned ioc associations by. Default is descending last_modification_date. The supported order syntax matches the fields defined in the GTI API docs here: https://gtidocs.virustotal.com/reference/list-threats#allowed-orders

Supported orders: - name: sorts objects alphabetically by name, ascending + or descending -. Name in this context refers to the threatDisplayName for an IOC association. - last_modification_date: sorts objects descending - by most recently modified objects first, or ascending + by firstly modified objects first. This refers to the lastReferenceTime field for an IOC association.

Request body

The request body must be empty.

Response body

Response message for listing Ioc associations for a given IocAssociation.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "iocAssociations": [
    {
      object (IocAssociation)
    }
  ],
  "nextPageToken": string,
  "totalSize": integer
}
Fields
iocAssociations[]

object (IocAssociation)

Output only. The list of related IocAssociations.
nextPageToken

string

Output only. A token that can be sent as pageToken to retrieve the next page. If this field is omitted, there are no subsequent pages.
totalSize

integer

Output only. The total number of IocAssociations that match the request. The count of iocAssociations returned by pagination may be less than the totalSize that matches.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

  • chronicle.iocAssociations.fetchRelatedIocAssociations

For more information, see the IAM documentation.