---
title: "Listing of IOC Sets"
method: GET
path: "/threatintel/v1/ioc-sets"
tags: ["Threat Intel"]
---

# Listing of IOC Sets

`GET /threatintel/v1/ioc-sets`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threatintel/v1/ioc-sets`
- Auth: API key in header `Authorization`

Provides a list of all the existing IOC Sets created in the IOC library.

## Query parameters

- `IocType` 'hash' | 'ext', required
- `PageToken` string
- `PageSize` integer
- `SortBy` 'name' | 'totalIOCs' | 'lastModifiedOn'
- `SortOrder` 'asc' | 'desc'
- `PublishedBy` string

## Response `200`

Displays the list of all IOC Sets.

- ListIocSetResponse
  - `allPublishers` string[]: Name of all the administrators who published IOC Set.
  - `iocSets` ListIocSetDetails[]
    - `createdTime` string: Time at which this IOC set was created.
    - `description` string: IOC set description.
    - `id` integer: Unique ID of the IOC set.
    - `iocType` 'hash' | 'ext': Type of IOC set, can be either hash or extension.
    - `isDruvaIOC` boolean: Indicates that IOC set is published by Druva, only for customers with Threat Intel Premium License.
    - `lastModifiedOn` string: Time at which this IOC set was last updated.
    - `name` string: Name of IOC set.
    - `nonConvertedIOCs` integer: Count to IOC that were non SHA1 and there corresponding SHA1 was not found.
    - `publishedBy` string: Name of admin who published this IOC set.
    - `source` string: Source of IOC set.
    - `totalIOCs` integer: Total number of IOCs in the IOC set.
  - `nextPageToken` string: The token to access the next page of results. This parameter will be empty for the last page of the results. For example - eyJpZCI6NTY1NX0=
  - `totalRecords` integer: Total number of IOC sets.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal error.

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)