GuidesAPI ReferenceGitHub RepositoryPartner IntegrationsWhat's New
API Reference
Product DocumentationSupportSandbox Account

Create a threat hunt

post
https://govapis.druva.com/realize/threathunting/v1/threathunts

Create a threat hunt for all the selected resources.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params
string

Specify a name for the threat hunt.

string

Provide a description of the threat hunt.

fileHashes
array of strings

Specify the malicious file hashes to be used for the threat hunt. Example - ['9032a70bc7f6c44ba2bf639b6f09b8d10b056e00'].

fileHashes
fileExtensions
array of strings

Specify the malicious file extensions to be used for the threat hunt. Example - ['.wcry'].

fileExtensions
threatIntelIOCSetIDs
array of integers

Specify the Threat-Intel IOC Set IDs list to include predefined file hashes and extensions in the threat scan. You can choose the IOC Sets from the IOC Library section under Cyber Resilience.

threatIntelIOCSetIDs
boolean

Specify the boolean flag to mark snapshots as quarantined when a threat is detected after the scan completion. Currently, Auto-Quarantine is supported for VMware.

string

Specify the start date to allow the threat hunt to scan for threats using snapshots created on this date. Format: YYYY-MM-DD.

string

Specify the end date to allow the threat hunt to use snapshots created through this date to scan for threats. Format - YYYY-MM-DD.

resourcesToScan
object

Specify the resources for creating a threat hunt and provide the resource type. Currently, VMware resource type is supported.

Responses

401

The request either did not include an authentication token, or you have provided an expired authentication token.

Updated about 4 hours ago

Language
Credentials
Header
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
*/*

Updated about 4 hours ago