---
title: "List threat hunt configuration details"
method: GET
path: "/threathunting/v1/threathunts/{threatHuntID}"
tags: ["Threat Hunting"]
---

# List threat hunt configuration details

`GET /threathunting/v1/threathunts/{threatHuntID}`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threathunts/{threatHuntID}`
- Auth: API key in header `Authorization`

You can view the configuration details provided during threat hunt creation, such as file hashes and file extensions.

## Path parameters

- `threatHuntID` integer, required

## Response `200`

OK

- ThreatHuntGetResponse
  - `autoQuarantine` boolean: This field states if the Auto-Quarantine option was selected. If set to true,then Auto-Quarantine was selected.
  - `createdBy` string: Name of the administrator who created this threat hunt.
  - `description` string: The description provided during threat hunt creation.
  - `fileExtensions` string[]: List of file extensions provided during threat hunt creation.
  - `fileHashes` string[]: List of file hashes provided during threat hunt creation.
  - `includePredefinedFileHash` boolean: This field states if the predefined file hashes option was selected. If set to true, then the predefined file hashes option was selected.
  - `threatIntelIOCs` object: Details of all the selected IOC sets used in the Threat scan.
    - `hashSets` object[]: Details of selected IOC sets with file hashes.
      - `id` integer: The unique ID of the IOC Set.
      - `name` string: The name provided for the IOC Set.
      - `totalIOCs` integer: The total count of SHA-1 converted file hashes in the IOC Set.
    - `extSets` object[]: Details of selected IOC sets with file extensions.
      - `id` integer: The unique ID of the IOC Set.
      - `name` string: The name provided for the IOC Set.
      - `totalIOCs` integer: The total count of file extensions in the IOC Set.
  - `name` string: Name of the threat hunt.
  - `resourceTypes` string[]
  - `devices` object[]: List of devices that were a part of the threat hunt scan.
    - `deviceID` integer
    - `resourceType` string
    - `resourceIDs` integer[]: List of resource IDs that were part of the threat hunt scan.
  - `snapshotRangeEndDate` string: The end date selected while threat hunt creation. Format - YYYY-MM-DD Example - 2020-01-02.
  - `snapshotRangeStartDate` string: The start date selected while threat hunt creation. Format - YYYY-MM-DD Example - 2020-01-02.
  - `threatHuntID` integer: The identifier to uniquely identify threat hunt.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)