DRdruva
Threat Hunting

Get device statistics for a specific threat hunt

Displays a list of statistics for a specific device ID and resource type for a particular threat hunt.

get/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/stats

Request

  • Base URL
    https://apis.druva.com/realize
  • URL
    https://apis.druva.com/realize/threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/stats
  • Auth
    API key in header Authorization

Path parameters

threatHuntIDinteger required

Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.

deviceIDinteger required

Specify the device ID. You can obtain the device ID using the 'List threat hunt devices API'.

Query parameters

resourceType'VMware' | 'EC2' | 'AzureVM' | 'OneDrive' | 'SharePoint' | 'ExchangeOnline' required

Name of the resource type. The resource type can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or Exchange Online.

Response

Success

threatHuntIDinteger

The unique identifier for a threat hunt.

deviceIDinteger

Unique identifier for a device.

resourceTypestring

Name of the resource type. The resource type can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or Exchange Online.

totalSnapshotsinteger

Count of total snapshots for this resource.

totalFilesImpactedinteger

Count of impacted files against which threat was identified for this resource.

impactedSnapshotsinteger

Count of impacted snapshots against which threat was identified for this resource.

totalQuarantinedSnapshotsinteger

Count of impacted snapshots that were quarantined.

firstImpactedSnapshotstring

Name of the first impacted snapshot. Example - Nov 21 2019, 14:39:34.

lastImpactedSnapshotstring

Name of the last impacted snapshot. Example - Nov 21 2019, 14:39:34.

firstScannedSnapshotstring

Name of the first scanned snapshot. Example - Nov 21 2019, 14:39:34.

lastScannedSnapshotstring

Name of the last scanned snapshot. Example - Nov 21 2019, 14:39:34.

autoQuarantineStatusstring

The auto quarantine status of the threat hunt. The status can be 'Successful,' 'Successful with errors', 'Not Applicable', or 'Failed'.

resourceIDsinteger[]

Lists the Resource IDs associated with the chosen device ID.

Example response

{
  "threatHuntID": 13,
  "firstImpactedSnapshot": "Nov 21 2019, 14:39:34",
  "lastImpactedSnapshot": "Nov 21 2019, 14:39:34",
  "firstScannedSnapshot": "Nov 21 2019, 14:39:34",
  "lastScannedSnapshot": "Nov 21 2019, 14:39:34"
}

Changes

No recorded changes to this operation across all 1 revision of this API.