Groups represent a collection of related behavior and intelligence.
Endpoint: /api/v3/groups
Note
When working with Groups using the ThreatConnect v3 API, you can target a specific Group by its ID or, if one has been assigned to it, XID. While you can use the API to retrieve a Group's ID, you can also find it in the URL of each Group. If you navigate to the new Details screen, the URL should look like https://app.threatconnect.com/#/details/groups/123456/overview. The number between groups/ and /overview is the Group's ID. Similarly, if you navigate to the legacy Details screen for a Group, the URL should look like https://app.threatconnect.com/auth/<GROUP-TYPE>/<GROUP-TYPE>.xhtml?<GROUP-TYPE>=123456. The number following <GROUP-TYPE>= is the Group's ID.
If targeting a Group by its XID, you must use the owner query parameter to specify the owner in which the Group exists.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation.