---
title: "Lists Threat Watch impacted devices"
method: GET
path: "/threathunting/v1/threatwatch/devices"
tags: ["Threat Watch"]
---

# Lists Threat Watch impacted devices

`GET /threathunting/v1/threatwatch/devices`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threatwatch/devices`
- Auth: API key in header `Authorization`

The Threat Watch API provides a paginated list of devices affected by matches against Indicators of Compromise (IOC) sets identified during Threat Watch scans over the past 30 days. For each impacted device, the results include: Resource type, Count of file matches, Count of impacted snapshots, Matched IOC Sets, Timestamp of the first match, and Timestamp of the last match.

## Query parameters

- `resourceTypes[]` string[]
- `iocSetIds[]` integer[]
- `pageToken` string

## Response `200`

Success

- ThreatWatchDevicesResponse
  - `nextPageToken` string: The token to access the next page of results. This parameter will be empty for the last page of results.
  - `impactedDevices` object[]: List of impacted devices.
    - `deviceID` integer: Device identifier.
    - `resourceIDs` integer[]: List of resource IDs.
    - `resourceName` string: Resource name.
    - `resourceType` string: Resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', and 'ExchangeOnline'.
    - `orgID` integer: Organization ID.
    - `payload` object: Additional resource metadata.
    - `fileMatches` integer: Total file matches for the device.
    - `snapshotsImpacted` integer: Number of infected snapshots.
    - `iocSetsMatched` string[]: List of IOC set names that matched.
    - `firstMatchedOn` string: ISO 8601 timestamp of first match.
    - `lastMatchedOn` string: ISO 8601 timestamp of last match.
  - `totalImpactedDevices` integer: Total number of impacted devices.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)