DRdruva
Threat Hunting

Create a threat hunt

Create a threat hunt for all the selected resources.

post/threathunting/v1/threathunts

Request

  • Base URL
    https://apis.druva.com/realize
  • URL
    https://apis.druva.com/realize/threathunting/v1/threathunts
  • Auth
    API key in header Authorization

Request body

namestring

Specify a name for the threat hunt.

descriptionstring

Provide a description of the threat hunt.

fileHashesstring[]

Specify the malicious file hashes for the threat hunt. Example - ['9032a70bc7f6c44ba2bf639b6f09b8d10b056e00']

fileExtensionsstring[]

Specify the malicious file extensions for the threat hunt. Example - ['.wcry']

threatIntelIOCSetIDsinteger[]

Specify the Threat-Intel IOC Set IDs list to include predefined file hashes and extensions in the threat scan. You can choose the IOC Sets from the IOC Library section under Cyber Resilience.

autoQuarantineboolean

Specify the boolean flag to mark snapshots as quarantined when a threat is detected after the scan completion. Currently, Auto-Quarantine is supported for VMware, Azure Virtual Machines, and AWS Workloads - EC2 and EBS Volumes.

snapshotRangeStartDatestring

Specify the start date to allow the threat hunt to scan for threats using snapshots created on this date. Format: YYYY-MM-DD.

snapshotRangeEndDatestring

Specify the end date to allow the threat hunt to use snapshots created through this date to scan for threats. Format - YYYY-MM-DD.

Example request

{
  "name": "Lock Extension Analysis",
  "description": "Threat hunting for lock extension analysis",
  "fileHashes": [
    "9032a70bc7f6c44ba2bf639b6f09b8d10b056e00"
  ],
  "fileExtensions": [
    ".wcry"
  ],
  "snapshotRangeStartDate": "2024-10-25",
  "snapshotRangeEndDate": "2024-10-27",
  "resourcesToScan": {
    "<resourceType>": [
      {
        "orgID": -1,
        "deviceID": 124
      }
    ]
  }
}

Response

Success

threatHuntIDinteger

The identifier to uniquely identify threat hunt.

messagestring

Example response

{
  "message": "Threat hunt created successfully.",
  "validationFailures": {
    "invalidHashes": [
      "abvfdinvalid"
    ],
    "excludedExtensions": [
      ".abc.txt.1"
    ],
    "invalidResourceIDs": [
      1
    ],
    "invalidIOCSets": [
      1
    ]
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.