DRdruva
Threat Hunting

List threat hunt configuration details

You can view the configuration details provided during threat hunt creation, such as file hashes and file extensions.

get/threathunting/v1/threathunts/{threatHuntID}

Request

  • Base URL
    https://apis.druva.com/realize
  • URL
    https://apis.druva.com/realize/threathunting/v1/threathunts/{threatHuntID}
  • Auth
    API key in header Authorization

Path parameters

threatHuntIDinteger required

Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.

Response

OK

autoQuarantineboolean

This field states if the Auto-Quarantine option was selected. If set to true,then Auto-Quarantine was selected.

createdBystring

Name of the administrator who created this threat hunt.

descriptionstring

The description provided during threat hunt creation.

fileExtensionsstring[]

List of file extensions provided during threat hunt creation.

fileHashesstring[]

List of file hashes provided during threat hunt creation.

includePredefinedFileHashboolean

This field states if the predefined file hashes option was selected. If set to true, then the predefined file hashes option was selected.

namestring

Name of the threat hunt.

resourceTypesstring[]
snapshotRangeEndDatestring

The end date selected while threat hunt creation. Format - YYYY-MM-DD Example - 2020-01-02.

snapshotRangeStartDatestring

The start date selected while threat hunt creation. Format - YYYY-MM-DD Example - 2020-01-02.

threatHuntIDinteger

The identifier to uniquely identify threat hunt.

Example response

{
  "threatIntelIOCs": {
    "hashSets": [
      {
        "id": 1,
        "name": "IOC Set 1",
        "totalIOCs": 39
      }
    ],
    "extSets": [
      {
        "id": 2,
        "name": "IOC Set 2",
        "totalIOCs": 63
      }
    ]
  },
  "resourceTypes": [
    "VMware"
  ],
  "devices": [
    {
      "deviceID": 1,
      "resourceType": "VMware"
    }
  ],
  "snapshotRangeEndDate": "2020-01-02",
  "snapshotRangeStartDate": "2020-01-02"
}

Changes

No recorded changes to this operation across all 1 revision of this API.