---
title: "Lists all the IOCs that matches the specified parameters"
method: GET
path: "/threatintel/v1/ioc-sets/iocs"
tags: ["Threat Intel"]
---

# Lists all the IOCs that matches the specified parameters

`GET /threatintel/v1/ioc-sets/iocs`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threatintel/v1/ioc-sets/iocs`
- Auth: API key in header `Authorization`

Lists all the IOCs that matches the specified parameters.

## Query parameters

- `IOCSetIDs` integer[]
- `PublisherType` string
- `IOCSetName` string
- `IOCSetType` 'hash' | 'ext'
- `SortOrder` 'asc' | 'desc'
- `PageSize` integer
- `PageToken` string

## Response `200`

- GetIOCsResponse
  - `iocs` IOCDetails[]
    - `addedBy` string: Name of administrator who added the IOC.
    - `addedTime` string: Time at which this IOC was added.
    - `convertedIoc` string: Corresponding SHA1 of SHA256 and MD5 hash or empty if not converted, else same as user input
    - `id` integer: Unique ID of the IOC.
    - `iocSetID` integer: Unique ID of the IOC set.
    - `iocType` 'hash' | 'ext': Details of the IOC type. It can be either file hash or file extension.
    - `iocValue` string: IOC value added by the administrator.
  - `nextPageToken` string: The token to access the next page of results. This parameter will be empty for the last page of the results. For example - eyJpZCI6NTY1NX0=.
  - `totalIocs` integer: Total number of IOCs present in the specified IOC set.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal error.

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)