---
title: "Hunt overview"
method: GET
path: "/api/hunt/overview"
tags: ["Hunt"]
---

# Hunt overview

`GET /api/hunt/overview`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/hunt/overview`
- Auth: HTTP bearer

Landing dashboard: environment metric tiles, the intel -> exposure funnel, detection coverage distribution, and recent Threats / rule proposals / blocking gaps.

## Response `200`

Successful response

- object
  - `primaryCta` object, required
    - `label` string, required
    - `href` string, required
    - `activeHuntAlertCount` number, required
  - `summary` object, required
    - `windowDays` union, required
      - 7
      - 30
    - `intelIngestedCount` number, required
    - `threatsTrackedCount` number, required
    - `threatsAssessedCount` number, required
    - `exposureAlertsGeneratedCount` number, required
    - `foundIocAlertsGeneratedCount` number, required
    - `activeHuntAlertCount` number, required
    - `ruleProposalsCreatedCount` number, required
    - `detectionPrsOpenedCount` number, required
    - `ruleProposalsShippedCount` number, required
    - `blockingGapsOpenCount` number, required
    - `blockingGapsResolvedCount` number, required
    - `coverageStateDistribution` object, required
      - `none` number, required
      - `partial` number, required
      - `covered` number, required
      - `unknown` number, required
  - `funnel` object, required
    - `intelIngestedCount` number, required
    - `huntableIntelCount` number, required
    - `threatsTrackedCount` number, required
    - `threatsAssessedCount` number, required
    - `exposureAlertsGeneratedCount` number, required
  - `recentThreats` object[], required
    - `threatId` string, required
    - `title` string, required
    - `canonicalType` 'vulnerability' | 'campaign', required
    - `canonicalKeyType` 'cve' | 'advisory' | 'vendor_advisory' | 'campaign_name' | 'malware_family', required
    - `canonicalKey` string, required
    - `firstSeenAt` string, required
    - `latestIntelAt` string, required
    - `huntResultBadge` 'compromise_signal_found' | 'exposure_found' | 'covered_by_existing_detection' | 'no_exposure_found' | 'inconclusive' | 'null', nullable, required
    - `exposureScore` number, nullable, required
    - `exposureBand` 'critical' | 'high' | 'medium' | 'low' | 'minimal' | 'null', nullable, required
    - `exposureState` 'compromise_signal_found' | 'exposure_found' | 'no_exposure_found' | 'inconclusive' | 'null', nullable, required
    - `coverageState` 'none' | 'partial' | 'covered' | 'unknown' | 'null', nullable, required
    - `affectedAssetCount` number, required
    - `activeHuntAlertId` string, nullable, required
    - `activeHuntAlertStatus` 'open' | 'in_progress' | 'escalated' | 'closed_true_positive' | 'closed_false_positive' | 'closed_true_positive_benign' | 'dismissed' | 'duplicate' | 'expired' | 'null', nullable, required: Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed, duplicate, and expired alerts are archived and hidden from alert lists.
    - `latestAlertId` string, nullable, required
    - `latestAlertStatus` 'open' | 'in_progress' | 'escalated' | 'closed_true_positive' | 'closed_false_positive' | 'closed_true_positive_benign' | 'dismissed' | 'duplicate' | 'expired' | 'null', nullable, required: Lifecycle status for a first-class alert. Terminal closed statuses include final disposition. Dismissed, duplicate, and expired alerts are archived and hidden from alert lists.
    - `deliverableCount` number, required
  - `recentRuleProposals` object[], required
    - `deliverableId` string, required
    - `proposalId` string, nullable, required
    - `pullRequestUrl` string, nullable, required
    - `threatId` string, required
    - `threatTitle` string, required
    - `intent` string, required
    - `pinning` 'ioc_pinned' | 'behavioral' | 'mixed', required
    - `targetProduct` string, nullable, required
    - `targetLogSource` string, nullable, required
    - `lifecycleStatus` 'authoring' | 'drafted' | 'in_review' | 'shipped' | 'dismissed' | 'failed', required
    - `createdAt` string, required
  - `recentBlockingGaps` object[], required
    - `gapId` string, required
    - `product` string, required
    - `logSource` string, required
    - `scopeType` 'org' | 'integration' | 'account' | 'environment' | 'asset_group' | 'tenant' | 'domain', required
    - `scopeId` string, nullable, required
    - `blocking` boolean, required
    - `gapStatus` 'open' | 'resolved' | 'dismissed', required
    - `establishedAt` string, required
    - `linkedThreats` object[], required
      - `threatId` string, required
      - `threatTitle` string, required
      - `canonicalKey` string, required
      - `blocking` boolean, required
    - `createdAt` string, required
  - `capabilities` object
    - `canReadEvidence` boolean, required
    - `canReassess` boolean, required
    - `canTriage` boolean, required

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)