---
title: "List impacted resources"
method: GET
path: "/ransomiq/v1/resources/impacted"
tags: ["Ransomware Detection"]
---

# List impacted resources

`GET /ransomiq/v1/resources/impacted`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/ransomiq/v1/resources/impacted`
- Auth: API key in header `Authorization`

Provides a paginated list of resources impacted by ransomware detection. It consolidates multiple alerts per resource, prioritizing Encryption Detected alert over Suspicious Indicators alert, and allows filtering by resource name prefix, detection status, and resource type.

## Query parameters

- `lastDays` integer
- `resourceType` 'VMware' | 'EC2' | 'AzureVM' | 'EBS Volume'
- `detectionStatus` 'encryptionDetected' | 'suspiciousIndicators'
- `resourceName` string
- `pageToken` string
- `pageSize` integer
- `sortOrder` 'asc' | 'desc'

## Response `200`

OK

- RIQImpactedResourcesResponse
  - `impactedResources` RIQImpactedResource[]
    - `detectionStatus` 'encryptionDetected' | 'suspiciousIndicators'
    - `firstDetectedOn` string
    - `indicatorsDetected` string[]
    - `orgId` integer
    - `ransomwareFamily` string[]
    - `resourceID` integer
    - `resourceName` string
    - `resourceType` 'VMware' | 'EC2' | 'AzureVM' | 'EBS Volume': The type of the resource.
  - `nextPageToken` string
  - `totalResources` integer

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)