v1

latestOpenAPI 3.1.02026-07-245531,0212.1 MB

Threat Hunting

Create a threat hunt

Create a threat hunt for all the selected resources.

post/threathunting/v1/threathunts

Request body

namestring

Specify a name for the threat hunt.

descriptionstring

Provide a description of the threat hunt.

fileHashesstring[]

Specify the malicious file hashes to be used for the threat hunt. Example - ['9032a70bc7f6c44ba2bf639b6f09b8d10b056e00'].

fileExtensionsstring[]

Specify the malicious file extensions to be used for the threat hunt. Example - ['.wcry'].

threatIntelIOCSetIDsinteger[]

Specify the Threat-Intel IOC Set IDs list to include predefined file hashes and extensions in the threat scan. You can choose the IOC Sets from the IOC Library section under Cyber Resilience.

autoQuarantineboolean

Specify the boolean flag to mark snapshots as quarantined when a threat is detected after the scan completion. Currently, Auto-Quarantine is supported for VMware.

snapshotRangeStartDatestring

Specify the start date to allow the threat hunt to scan for threats using snapshots created on this date. Format: YYYY-MM-DD.

snapshotRangeEndDatestring

Specify the end date to allow the threat hunt to use snapshots created through this date to scan for threats. Format - YYYY-MM-DD.

Example request

{
  "name": "Lock Extension Analysis",
  "description": "Threat hunting for lock extension analysis",
  "fileHashes": [
    "9032a70bc7f6c44ba2bf639b6f09b8d10b056e00"
  ],
  "fileExtensions": [
    ".wcry"
  ],
  "snapshotRangeStartDate": "2024-10-25",
  "snapshotRangeEndDate": "2024-10-27",
  "resourcesToScan": {
    "<resourceType>": [
      {
        "orgID": -1,
        "deviceID": 124
      }
    ]
  }
}

Response

Success