DRdruva
Threat Hunting

Get resource details for a specific threat hunt

Displays the selected device ID details and resource type for a specific threat hunt.

get/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}

Request

  • Base URL
    https://apis.druva.com/realize
  • URL
    https://apis.druva.com/realize/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}
  • Auth
    API key in header Authorization

Path parameters

threatHuntIDinteger required

Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.

deviceIDinteger required

Specify the device ID. You can obtain the device ID using the 'List threat hunt devices API'.

Query parameters

resourceType'VMware' | 'EC2' | 'AzureVM' | 'OneDrive' | 'SharePoint' | 'ExchangeOnline' required

Specify the resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or Exchange Online.

Response

Success

threatHuntIDinteger

The unique identifier for a threat hunt.

deviceIDinteger

Unique identifier for a device.

orgIDinteger

The unique identifier of the Phoenix (Enterprise Workloads) organization for the resource.

resourceParentIDinteger

Unique identifier for the parent resource.In the context of VMware, this is the unique identifier for the ESXi FQDN.

resourceNamestring

Name of the resource. In case of VMware, resource name will be VM name. Example - Ernie Carter's VM.

resourceTypestring

Name of resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or 'Exchange Online'.

resourceParentNamestring

Resource Parent Name. In case of VMware, this will be vCenter/ESXi name.

orgNamestring

Organization Name for Enterprise Workloads. This field is empty if the organization has been deleted.

payloadobject

All other fields that belong to the selected resource. Example - {'type':'EBS'}.

resourceIDsinteger[]

List of resource IDs for the selected device ID.

Example response

{
  "threatHuntID": 13
}

Changes

No recorded changes to this operation across all 1 revision of this API.