---
title: "Get Threat Watch device statistics"
method: GET
path: "/threathunting/v1/threatwatch/devices/{deviceID}/stats"
tags: ["Threat Watch"]
---

# Get Threat Watch device statistics

`GET /threathunting/v1/threatwatch/devices/{deviceID}/stats`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threatwatch/devices/{deviceID}/stats`
- Auth: API key in header `Authorization`

Provides comprehensive, device-level statistics for a specified device. The data includes: impacted snapshot counts; Total files impacted across all snapshots; Timestamps for the first and last impacted snapshots; Indicator of Compromise (IOC) sets that matched on the device.

## Path parameters

- `deviceID` integer, required

## Query parameters

- `resourceType` 'vmware' | 'ec2' | 'azurevm' | 'onedrive' | 'sharepoint' | 'exchangeonline', required

## Response `200`

Success

- ThreatWatchDeviceStatsResponse
  - `deviceID` integer: Device identifier.
  - `resourceIDs` integer[]: List of resource IDs associated with the device.
  - `resourceType` string: Resource type (VMware, EC2, AzureVM, OneDrive, SharePoint, ExchangeOnline).
  - `impactedSnapshots` integer: Number of impacted snapshots.
  - `totalFilesImpacted` integer: Total files impacted across all snapshots.
  - `firstImpactedSnapshot` string: ISO 8601 timestamp of first impacted snapshot.
  - `lastImpactedSnapshot` string: ISO 8601 timestamp of last impacted snapshot.
  - `iocSetsMatched` object[]: List of IOC sets that matched on the device.
    - `iocSetID` integer: IOC set identifier.
    - `iocSetName` string: IOC set name.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)