---
title: "Create a threat hunt"
method: POST
path: "/threathunting/v1/threathunts"
tags: ["Threat Hunting"]
---

# Create a threat hunt

`POST /threathunting/v1/threathunts`

Create a threat hunt for all the selected resources.

## Request body

- ThreatHuntCreateParams
  - `name` string — Specify a name for the threat hunt.
  - `description` string — Provide a description of the threat hunt.
  - `fileHashes` string[] — Specify the malicious file hashes to be used for the threat hunt. Example - ['9032a70bc7f6c44ba2bf639b6f09b8d10b056e00'].
  - `fileExtensions` string[] — Specify the malicious file extensions to be used for the threat hunt. Example - ['.wcry'].
  - `threatIntelIOCSetIDs` integer[] — Specify the Threat-Intel IOC Set IDs list to include predefined file hashes and extensions in the threat scan. You can choose the IOC Sets from the IOC Library section under Cyber Resilience.
  - `autoQuarantine` boolean — Specify the boolean flag to mark snapshots as quarantined when a threat is detected after the scan completion. Currently, Auto-Quarantine is supported for VMware.
  - `snapshotRangeStartDate` string — Specify the start date to allow the threat hunt to scan for threats using snapshots created on this date. Format: YYYY-MM-DD.
  - `snapshotRangeEndDate` string — Specify the end date to allow the threat hunt to use snapshots created through this date to scan for threats. Format - YYYY-MM-DD.
  - `resourcesToScan` object — Specify the resources for creating a threat hunt and provide the resource type. Currently, VMware resource type is supported.
    - `<resourceType>` object[] — Currently, VMware resource type is supported.
      - `orgID` integer — The Phoenix organization ID for the resource. For inSync workloads, value will be -1.
      - `deviceID` integer — ID of device for which threat hunt should be created.

## Response `200`

Success

## Other responses

- `400` — Bad Request
- `401` — The request either did not include an authentication token, or you have provided an expired authentication token.
- `404` — The requested resource was not found.
- `500` — Internal Server Error

---

[API](https://skmtc.net/druva/apis/authentication.md) · [All operations](https://skmtc.net/druva/apis/authentication/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/druva/authentication/revisions/2af2bf148b25/schema)