IoC scanning and dataset inclusionAny IoC submitted or queried via the API will be scanned and added to the VirusTotal dataset, making it accessible to the community. Do not submit or query indicators containing sensitive, confidential, or personally identifiable information (PII).
Use this endpoint to create new collections. In the request body, send a collection object containing its name, description and the elements it will contain (for URLs you can either use the URL or its ID). All IOCs must be described as relationships of a newly created Collection object. This is an example request body:
{
"data": {
"attributes": {
"name": "Test collection",
"description": "This is how to create a new collection via API."
},
"relationships": {
"domains": {
"data": [
{
"type": "domain",
"id": "www.virustotal.com"
},
{
"type": "domain",
"id": "www.hooli.com"
}
]
},
"urls": {
"data": [
{
"type": "url",
"url": "https://www.virustotal.com/"
},
{
"type": "url",
"id": "f11f7cc900638fae209f68498a90158fbfb067fc4191549ddb657e39cc4428c2"
}
]
},
"ip_addresses": {
"data": [
{
"type": "ip_address",
"id": "8.8.8.8"
}
]
},
"files": {
"data": [
{
"type": "file",
"id": "ecc0f2aa29b102bf8d67b7d7173e8698c0341ddfdf9757be17595460fbf1791a"
}
]
}
},
"type": "collection"
}
}{
"data": {
"attributes": {
"name": "Test collection",
"description": "This is how to create a new collection via API."
},
"raw_items": "This is a text containing an IoC, www.virustotal.com",
"type": "collection"
}
}To modify the collection's attributes or add more elements to a collection using a raw text, refer to the PATCH/collections/{id} endpoint.
To add new elements to the collection refer to the POST /collections/{id}/{relationship} endpoint.
To remove elements from the collection refer to the DELETE /collections/{id}/{relationship} endpoint.