- [Resource: ThreatCollection](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections#ThreatCollection)
  - [JSON representation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections#ThreatCollection.SCHEMA_REPRESENTATION)
- [ThreatCollectionType](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections#ThreatCollectionType)
- [Methods](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections#METHODS_SUMMARY)

## Resource: ThreatCollection

A threat collection from Google Threat Intelligence which represents either a threat campaign or a threat report.

| JSON representation |
|---|
| ``` { "name": string, "displayName": string, "description": string, "threatCollectionType": enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections#ThreatCollectionType`), "createTime": string, "updateTime": string, "altNames": [ string ], "associations": [ string ], "iocs": [ string ], "targetedIndustries": [ string ], "targetedRegions": [ string ], "content": string, "executiveSummary": string } ``` |

| Fields ||
|---|---|
| `name` | `string` Output only. Identifier. The resource name of this ThreatCollection. |
| `displayName` | `string` Output only. Display name of the threat collection. |
| `description` | `string` Output only. Description of the threat collection. For campaigns, this is the description/context about the campaign. For reports, this is the ML-autogenerated summary of the report's content, generated by GTI. |
| `threatCollectionType` | ``enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections#ThreatCollectionType`)`` Output only. Type of the threat collection. |
| `createTime` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` Output only. Time when the threat collection was created. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`. |
| `updateTime` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` Output only. Time when the threat collection was last modified. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`. |
| `altNames[]` | `string` Output only. Alternative display names of the threat collection. For example, 'CAMP.22.007' for an individual campaign threat collection. |
| `associations[]` | `string` Output only. The resource names of the threat actors or malware related to this ThreatCollection. Format: projects/{project}/locations/{location}/instances/{instance}/iocAssociations/{iocAssociation} |
| `iocs[]` | `string` Output only. The resource names of the Iocs that are related to this ThreatCollection. Format: projects/{project}/locations/{location}/instances/{instance}/iocs/{ioc} |
| `targetedIndustries[]` | `string` Output only. The industries that are targeted by the threat collection. |
| `targetedRegions[]` | `string` Output only. The regions that are targeted by the threat collection, represented as ISO-3166-2 country codes. |
| `content` | `string` Output only. The full Report content. Only available for ThreatCollectionType.REPORT. |
| `executiveSummary` | `string` Output only. The summary of the content of the report. Only available for ThreatCollectionType.REPORT. |

## ThreatCollectionType

Types of threat collections currently supported.

| Enums ||
|---|---|
| `THREAT_COLLECTION_TYPE_UNSPECIFIED` | Threat collection type is unspecified. |
| `CAMPAIGN` | Threat collection type is campaign. |
| `REPORT` | Threat collection type is report. |
| `OPERATION` | Threat collection type is operation. |

| ## Methods ||
|---|---|
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections/fetchEntityMetadata` | Gets a list of entity metadata for a threat collection. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections/fetchIocMatchMetadata` | Gets a batch (list) of ioc match metadata for a list of threat collections. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections/fetchRelated` | List related threat collections for a threat artifact. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections/get` | Gets a threat collection by resource name. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1beta/projects.locations.instances.threatCollections/list` | Lists threat collections, which contain reports and tracked threat campaigns from Google Threat Intelligence. |