--- title: "List Hunt" method: POST path: "/security-hunt/get-list" tags: ["Hunt"] --- # List Hunt `POST /security-hunt/get-list` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-hunt/get-list` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to list all Hunt items ## Request body - object - `query` SecurityHuntQuerySchema: Query schema for SecurityHunt. A field takes a value, which it matches exactly, or an operator its type allows. A relation is filtered by the fields of the record it names, {"": {"": }}, and a resource with owners by who owns it, {"owners": {"_type": "OwnedBy", "userIds": [...], "teamIds": [...]}}. - `_id` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `createdAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `updatedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `deletedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `projectId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `name` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `description` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `searchQuery` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `filters` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `timeRange` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `schedule` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `notifyUsers` union: A filter on a Entity Array field: a value, which it matches exactly, or one of these operators: EqualTo, IsNull, NotNull, Includes. A list of ids, or Includes, matches the records related to any of them; IsNull those related to none. - string[] - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - `notifyTeams` union: A filter on a Entity Array field: a value, which it matches exactly, or one of these operators: EqualTo, IsNull, NotNull, Includes. A list of ids, or Includes, matches the records related to any of them; IsNull those related to none. - string[] - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'Includes', required - `value` string[], required - `libraryHuntId` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `scheduledByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `searchedUpToAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `nextRunAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `lastRunAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `lastRunEventCount` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `lastRunError` union: A filter on a Very Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `lastFoundAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `lastFoundSinceAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `lastFoundEventCount` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `createdByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `deletedByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `select` SecurityHuntSelectSchema: Select schema for SecurityHunt. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `name` boolean - `description` boolean - `searchQuery` boolean - `filters` boolean - `timeRange` boolean - `schedule` boolean - `notifyUsers` UserRelationSelectSchema: What a select may name of the User records a relation holds: set a field to true to include it. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `name` boolean - `email` boolean - `profilePictureId` boolean - `twoFactorAuthEnabled` boolean - `notifyTeams` TeamRelationSelectSchema: What a select may name of the Team records a relation holds: set a field to true to include it. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `name` boolean - `libraryHuntId` boolean - `scheduledByUserId` boolean - `searchedUpToAt` boolean - `nextRunAt` boolean - `lastRunAt` boolean - `lastRunEventCount` boolean - `lastRunError` boolean - `lastFoundAt` boolean - `lastFoundSinceAt` boolean - `lastFoundEventCount` boolean - `createdByUserId` boolean - `deletedByUserId` boolean - `sort` SecurityHuntSortSchema: Sort schema for SecurityHunt. Only sortable fields are included. - `_id` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `updatedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `projectId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `name` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `description` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `searchQuery` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `timeRange` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `schedule` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `libraryHuntId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `scheduledByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `searchedUpToAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `nextRunAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastRunAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastRunEventCount` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastRunError` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastFoundAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastFoundSinceAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastFoundEventCount` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `limit` number: Maximum number of items to return. Defaults to 10. - `skip` number: Number of items to skip for pagination. Defaults to 0. ## Response `200` Successful response - object - `data` SecurityHunt[] - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this hunt belongs to. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `name` string, required: What the hunt looks for, in a few words. At most 100 characters. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `description` string: Why the hunt matters and what to do when it finds something, for whoever opens it later. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `searchQuery` string: What the hunt searches for, in the Events search bar's language: words a message contains, fields such as severity:High or user:alice, and source attributes such as @threat.matched:true. At most 2,000 characters. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `filters` object: The Events sidebar's filters kept beside the search: each field's values, or with ! before the field the values it leaves out. At most 50 values. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `timeRange` 'Past 5 Mins' | 'Past 15 Mins' | 'Past 30 Mins' | 'Past 1 Hour' | 'Past 2 Hours' | 'Past 3 Hours' | 'Past 1 Day' | 'Past 2 Days' | 'Past 1 Week' | 'Past 2 Weeks' | 'Past 1 Month' | 'Past 3 Months' | 'Custom', required: How far back the hunt searches when it is opened, as the Events time picker names it: Past 1 Hour, Past 1 Day, Past 1 Week, Past 1 Month and the rest. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `schedule` 'Not Scheduled' | 'Every Hour' | 'Every 6 Hours' | 'Every Day' | 'Every Week', required: How often the hunt runs on its own and tells people what it found: Not Scheduled, Every Hour, Every 6 Hours, Every Day or Every Week. Each run searches the events that arrived since the run before. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `notifyUsers` object[]: The people told when a scheduled run finds events, each as their notification settings say. Only people who can read security events are told. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `_id` string, uuid: Unique identifier for the entity - `notifyTeams` object[]: The teams whose members are told when a scheduled run finds events, each as their notification settings say. Only members who can read security events are told. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [Project Owner, Project Admin, Security Admin, Security Member, Edit Detection Rule] - `_id` string, uuid: Unique identifier for the entity - `libraryHuntId` string: The Hunt Library starter this hunt was added from, such as encoded-powershell. Empty for a hunt saved from a search of your own. Permissions - Create: [Project Owner, Project Admin, Security Admin, Security Member, Create Detection Rule], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `scheduledByUserId` string, uuid: ID of the person the hunt's scheduled runs run as. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `searchedUpToAt` object: How far the scheduled runs have searched: the next run reads the events from here on. Set to the moment the schedule is set or the search changes. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `nextRunAt` object: When the hunt next runs on its schedule. Empty for a hunt that is not scheduled. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastRunAt` object: When the hunt last ran on its schedule, whether it found anything or not. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastRunEventCount` number: How many events the hunt's last scheduled run found. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastRunError` string: Why the hunt's last scheduled run could not be made. Empty when it ran. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastFoundAt` object: The end of the events the last run that found something searched: what it found arrived before this. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastFoundSinceAt` object: The start of the events the last run that found something searched: what it found arrived after this. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `lastFoundEventCount` number: How many events the last run that found something found. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `createdByUserId` string, uuid: ID of the person who saved the hunt. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who deleted the hunt. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Detection Rule], Update: [No access - you don't have permission for this operation] - `count` number ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)