---
title: "Create a threat hunt"
method: POST
path: "/threathunting/v1/threathunts"
tags: ["Threat Hunting"]
---

# Create a threat hunt

`POST /threathunting/v1/threathunts`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threathunts`
- Auth: API key in header `Authorization`

Create a threat hunt for all the selected resources.

## Request body

- ThreatHuntCreateParams
  - `name` string: Specify a name for the threat hunt.
  - `description` string: Provide a description of the threat hunt.
  - `fileHashes` string[]: Specify the malicious file hashes for the threat hunt. Example - ['9032a70bc7f6c44ba2bf639b6f09b8d10b056e00']
  - `fileExtensions` string[]: Specify the malicious file extensions for the threat hunt. Example - ['.wcry']
  - `threatIntelIOCSetIDs` integer[]: Specify the Threat-Intel IOC Set IDs list to include predefined file hashes and extensions in the threat scan. You can choose the IOC Sets from the IOC Library section under Cyber Resilience.
  - `autoQuarantine` boolean: Specify the boolean flag to mark snapshots as quarantined when a threat is detected after the scan completion. Currently, Auto-Quarantine is supported for VMware, Azure Virtual Machines, and AWS Workloads - EC2 and EBS Volumes.
  - `snapshotRangeStartDate` string: Specify the start date to allow the threat hunt to scan for threats using snapshots created on this date. Format: YYYY-MM-DD.
  - `snapshotRangeEndDate` string: Specify the end date to allow the threat hunt to use snapshots created through this date to scan for threats. Format - YYYY-MM-DD.
  - `resourcesToScan` object: Specify the resources for creating a threat hunt and provide the resource type. Supported resource types: VMware, EC2 and EBS Volumes (AWS workloads), Azure Virtual Machines (Enterprise workloads), and OneDrive, SharePoint, ExchangeOnline (Microsoft 365 workloads).
    - `<resourceType>` object[]: Resource type key: VMware, AzureVM, EC2, OneDrive, SharePoint, or ExchangeOnline. For Phoenix workloads use orgID; for M365 workloads use orgID -1.
      - `orgID` integer: Phoenix (Enterprise Workloads) organization ID in case of Phoenix Servers.
      - `deviceID` integer: The unique identifier of the device for which threat hunt should be created.

## Response `200`

Success

- ThreatHuntCreateResponse
  - `threatHuntID` integer: The identifier to uniquely identify threat hunt.
  - `message` string
  - `validationFailures` object: This occurs in case of validation failure for the file hash, file extension, resources or IOC sets.
    - `invalidHashes` string[]: File hashes discarded from threat hunt creation.
    - `excludedExtensions` string[]: Extensions with a length of more than 200 or extensions having more than one dot are discarded.
    - `invalidResourceIDs` integer[]: Resources that are deleted or unavailable are discarded from threat hunt creation.
    - `invalidIOCSets` integer[]: IOC sets that are either deleted or invalid.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)