A collection is a live report which contains a title, a group of IoCs (file hashes, URLs, domains and IP addresses) and an optional description. Collections are open to our VirusTotal Community (registered users) and they will be enhanced with VirusTotal analysis metadata providing the latest information we have for the IoCs, along with some aggregated tags.
You can create a collection through the home view by clicking on the "create an IoC collection" link as shown below:
You need to add a name, a list of IoCs (file hashes, URLs, domains and IP addresses) and then click on Create collection.
After your collection is created, you'll see a report that looks like this.
We've numbered the elements in the screenshot above for easy reference. They are:
1) You can share the collection permanent link or post it to Twitter.
2) The collection provides exporting capabilities in STIX, JSON and CSV formats.
3) Open the IOCs in an VT Graph.
4) Delete the collection.
5) Add a description.
6) Open the IOCs of an specific type in a VirusTotal Intelligence multisearch. (Only available to VirusTotal Intelligence customers)
7) Add more IOCs of the specific type.
8) Download the files included in the collection. (Only available to VirusTotal Intelligence customers)
Own Collection Dashboard
Users can see their created collections in their profile page, as they currently do for graphs and comments.
All user generated collections are available in VT under the community section of VirusTotal reports. This way our users benefit from other analysis investigations.
Security community is very active using twitter to promote their investigations. The VT Collection report shows the following card on Twitter.
On quota exceeded
Public users will have a quota of 20 Collections per month, if you reach the limit you would find the following message.
As usual we have also most of the functionality available using our API v3 , in this case with the exception of the exporting feature that is still only available on our web interface. You can check the API documentation in our API Reference page.