---
title: "Lists IOC Sets and impacted details for each IOC Set"
method: GET
path: "/threathunting/v1/threatwatch/iocs"
tags: ["Threat Watch"]
---

# Lists IOC Sets and impacted details for each IOC Set

`GET /threathunting/v1/threatwatch/iocs`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threathunting/v1/threatwatch/iocs`
- Auth: API key in header `Authorization`

Fetches a paginated list of IOC Sets containing threat impact metrics and daily trends categorized by resource type. 
 Parameters minTime (required): Start date for the requested data range (Format: YYYY-MM-DD). maxTime (optional): End date for the requested data range (Format: YYYY-MM-DD). Defaults to current time. Must be on or after minTime. pageToken (optional): Pagination token used to retrieve subsequent result pages. 
 Returns Metadata for IOC Sets Threat impact metrics Daily trend data segmented by resource type

## Query parameters

- `minTime` string, required
- `maxTime` string
- `pageToken` string

## Response `200`

Success

- ThreatWatchIOCsResponse
  - `nextPageToken` string: Token for pagination to next page.
  - `iocSet` object[]: The list of Indicators of Compromise (IOC) sets, along with their associated impact metrics, has been compiled.
    - `iocSetName` string: IOC set name.
    - `iocSetType` string: Type of IOC set - 'hash' or 'extension'.
    - `iocSetId` integer: IOC set identifier.
    - `totalIOCsInSet` integer: Total number of IOCs in the set.
    - `source` string: Source of the IOC set (e.g., 'CISA', 'Druva', 'Custom').
    - `lastUpdated` string: ISO 8601 timestamp of last update.
    - `createdBy` string: Creator of the IOC set.
    - `isDruvaPublished` boolean: Indicates if the IOC Set is a Druva-published entity.
    - `threatImpact` object: Overall threat impact metrics.
      - `devicesImpacted` integer: Total devices impacted by this IOC Set.
      - `snapshotsImpacted` integer: Total snapshots impacted by this IOC Set.
      - `filesImpacted` integer: Total files impacted by this IOC Set.
      - `uniqueIOCMatches` integer: Number of unique IOCs that matched.
      - `firstMatchedOn` string: ISO 8601 timestamp of first match.
      - `lastMatchedOn` string: ISO 8601 timestamp of last match.
    - `impactTrend` object[]: Trends in daily impact over the specified period.
      - `date` string: Use the YYYY-MM-DD format for the date.
      - `devicesImpacted` integer: The devices affected as of this date.
      - `snapshotsImpacted` integer: The snapshots affected as of this date.
      - `filesImpacted` integer: The files affected as of this date.
      - `impactByResourceType` object[]: Breakdown by resource type.
        - `resourceType` string: The resource type (VMware, EC2, AzureVM, OneDrive, SharePoint, ExchangeOnline) affected as of this date.
        - `impactedDevices` integer: The devices affected for the resource type.
  - `totalImpactedIOCSets` integer: The total count of affected IOC sets.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)