---
title: "Check if the specified IOC exists in any of the existing IOC Sets"
method: GET
path: "/threatintel/v1/ioc/lookup"
tags: ["Threat Intel"]
---

# Check if the specified IOC exists in any of the existing IOC Sets

`GET /threatintel/v1/ioc/lookup`

## Request

- Base URL: `https://apis.druva.com/realize`
- URL: `https://apis.druva.com/realize/threatintel/v1/ioc/lookup`
- Auth: API key in header `Authorization`

Check if the specified IOC exists in any of the existing IOC Sets.

## Query parameters

- `IocValue` string, required

## Response `200`

- IocLookupResponse
  - `iocSets` IocSetForLookup[]
    - `id` integer: Unique ID of the IOC set.
    - `iocSetType` 'hash' | 'ext': Type of IOC, can be either hash or extension.
    - `lastModifiedOn` string: Time at which this IOC set was last updated.
    - `name` string: Name of IOC set.
    - `publishDate` string: Time at which this IOC set was published.
    - `publishedBy` string: Name of admin who published this IOC set.

## Other responses

- `400`: Bad Request
- `401`: The request either did not include an authentication token, or you have provided an expired authentication token.
- `404`: The requested resource was not found.
- `500`: Internal error.

---

[API](https://skmtc.dev/druva/apis/cyber-resilience.md) - [All operations](https://skmtc.dev/druva/apis/cyber-resilience/llms.txt) - [OpenAPI document](https://skmtc.dev/druva/apis/cyber-resilience/revisions/b149d46c996a?raw)