v1

latestOpenAPI 3.0.12026-07-2491247233.8 KB

Hunt Jobs

Start hunt job

Start a hunt job

post/v0/hunt-jobs

Request body

namestring nullable

Name of the hunt job.

privateboolean

Restrict hunt job visibility to admins only.

range_end_timestring date-time required

Exclusive end datetime of the hunt job, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z').

range_start_timestring date-time required

Inclusive start datetime of the hunt job, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z').

sourcestring required

MQL source of the hunt job.

triage_email_bombboolean

Pre-filters to only include messages that are contained in an email bomb. Combined with triage_reported, triage_flagged, and triage_dlp_rule_matched with a logical OR.

triage_flaggedboolean

Pre-filters to only includes flagged messages. Combined with triage_reported, triage_email_bomb, and triage_dlp_rule_matched with a logical OR.

triage_reportedboolean

Pre-filters to only includes user-reported messages. Combined with triage_flagged, triage_email_bomb, and triage_dlp_rule_matched with a logical OR.

Response

Created

hunt_job_idstring

ID of the started hunt job.