DRdruva
Threat Watch

Lists Threat Watch impacted devices

The Threat Watch API provides a paginated list of devices affected by matches against Indicators of Compromise (IOC) sets identified during Threat Watch scans over the past 30 days. For each impacted device, the results include: Resource type, Count of file matches, Count of impacted snapshots, Matched IOC Sets, Timestamp of the first match, and Timestamp of the last match.

get/threathunting/v1/threatwatch/devices

Request

  • Base URL
    https://apis.druva.com/realize
  • URL
    https://apis.druva.com/realize/threathunting/v1/threatwatch/devices
  • Auth
    API key in header Authorization

Query parameters

resourceTypes[]string[]

Devices can be filtered based on their resource type (lowercase workload names: vmware, ec2, azurevm, onedrive, sharepoint, exchangeonline).

iocSetIds[]integer[]

Filters devices based on IOC set IDs. You can specify multiple IOC Set IDs.

pageTokenstring

The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.

Response

Success

nextPageTokenstring

The token to access the next page of results. This parameter will be empty for the last page of results.

totalImpactedDevicesinteger

Total number of impacted devices.

Changes

No recorded changes to this operation across all 1 revision of this API.