Druva Threat Hunting API

openapi: 3.2.0
info:
  description: List of APIs to get information and perform operations on the resources managed in Druva Cloud for threat hunt.
  version: 3.0.0
  title: Cyber Resilience Threat Hunting API
servers:
- url: https://apis.druva.com/realize
tags:
- name: Threat Hunting
  description: List of APIs to get information and perform operations on the resources managed in Druva Cloud for threat hunt.
paths:
  /threathunting/v1/search/backupset:
    post:
      summary: Search resources for VMware resource type
      description: Find all resources available for the provided search filters.
      security:
      - Bearer: []
      tags:
      - Threat Hunting
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatHuntSearchBackupsetParams'
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntSearchBackupsetResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: postThreathuntingV1SearchBackupset
      x-operation-id-source: derived
  /threathunting/v1/threathunts:
    post:
      description: Create a threat hunt for all the selected resources.
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Create a threat hunt
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatHuntCreateParams'
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntCreateResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: postThreathuntingV1Threathunts
      x-operation-id-source: derived
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: List all threat hunts
      description: Displays a list of all the existing threat hunts.
      parameters:
      - name: searchName
        in: query
        description: Specify the name of the threat hunt to search and list all the threat hunts that match the name.
        schema:
          type: string
      - description: Specify the scan status of the threat hunt to search and list the threat hunts based on scan statuses. The status can be 'Running', 'Queued', 'Completed', 'Cancelled', or 'Failed'.
        name: scanStatus[]
        in: query
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
          enum:
          - Queued
          - Running
          - Failed
          - Cancelled
          - Completed
      - description: Specify the resource types and list the threat hunts based on resource types. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', and 'ExchangeOnline'.
        name: resourceTypes[]
        in: query
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
          enum:
          - EC2
          - AzureVM
          - VMware
          - OneDrive
          - SharePoint
          - ExchangeOnline
      - description: Specify the scan result of the threat hunt to search and list the threat hunts based on scan results. The scan result can either be 'File matches found' or 'File matches not found'.
        name: scanResult[]
        in: query
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
          enum:
          - File matches found
          - File matches not found
      - name: pageToken
        description: The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.
        in: query
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntListResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1Threathunts
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/cancel:
    put:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to cancel an ongoing threat hunt. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      summary: Cancel a threat hunt
      description: Allows you to cancel an ongoing or running threat hunt job.
      responses:
        '200':
          description: OK
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntJobCancelResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: putThreathuntingV1ThreathuntsByThreatHuntIDCancel
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}:
    delete:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to delete a specific threat hunt. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreatHuntJobDeleteParams'
      summary: Delete a threat hunt
      description: Allows you to delete an existing non-running threat hunt job. Threat hunt, once deleted, cannot be recovered.
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: deleteThreathuntingV1ThreathuntsByThreatHuntID
      x-operation-id-source: derived
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      summary: List threat hunt configuration details
      description: You can view the configuration details provided during threat hunt creation, such as file hashes and file extensions.
      responses:
        '200':
          description: OK
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntGetResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntID
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/summary:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Get threat hunt summary for a specific threat hunt
      description: View the scan summary for a specific threat hunt.
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntScanSummaryResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntIDSummary
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/devices:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Lists the devices that are a part of a Threat Hunt job
      description: Displays a list of all the devices for the selected threat hunt.
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      - name: pageToken
        description: The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.
        in: query
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntListDevicesResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntIDDevices
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/devices/stats:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: List statistics of devices configured for threat hunt
      description: Displays a list of statistics for all devices selected for threat hunt.
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      - name: deviceIDs[]
        in: query
        description: Specify the deviceIDs to filter device statistics.
        style: form
        explode: false
        schema:
          type: array
          items:
            type: integer
      - name: pageToken
        in: query
        description: The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntListDevicesStatsResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntIDDevicesStats
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Get resource details for a specific threat hunt
      description: Displays the selected device ID details and resource type for a specific threat hunt.
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      - name: deviceID
        in: path
        description: Specify the device ID. You can obtain the device ID using the 'List threat hunt devices API'.
        required: true
        schema:
          type: integer
      - name: resourceType
        in: query
        description: Specify the resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or Exchange Online.
        required: true
        schema:
          type: string
          enum:
          - VMware
          - EC2
          - AzureVM
          - OneDrive
          - SharePoint
          - ExchangeOnline
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntGetDeviceDetailsResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntIDDevicesByDeviceID
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/stats:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Get device statistics for a specific threat hunt
      description: Displays a list of statistics for a specific device ID and resource type for a particular threat hunt.
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      - name: deviceID
        in: path
        description: Specify the device ID. You can obtain the device ID using the 'List threat hunt devices API'.
        required: true
        schema:
          type: integer
      - name: resourceType
        in: query
        description: Name of the resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or Exchange Online.
        required: true
        schema:
          type: string
          enum:
          - VMware
          - EC2
          - AzureVM
          - OneDrive
          - SharePoint
          - ExchangeOnline
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntGetDeviceStatsResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntIDDevicesByDeviceIDStats
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/devices/{deviceID}/snapshots:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: List impacted snapshots for a specific threat hunt
      description: Displays a list of impacted snapshots for the selected device ID and resource type for a specific threat hunt.
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID to view the details. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      - name: deviceID
        in: path
        description: Specify the device ID. You can obtain the device ID using the 'List threat hunt devices API'.
        required: true
        schema:
          type: integer
      - name: resourceType
        in: query
        description: Name of the resource type. The resource types can be 'VMware', 'EC2', 'AzureVM', 'OneDrive', 'SharePoint', or Exchange Online.
        required: true
        schema:
          type: string
          enum:
          - VMware
          - EC2
          - AzureVM
          - OneDrive
          - SharePoint
          - ExchangeOnline
      - name: pageToken
        in: query
        description: The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntListImpactedSnapshotsResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntIDDevicesByDeviceIDSnapshots
      x-operation-id-source: derived
  /threathunting/v1/threathunts/{threatHuntID}/report:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Download a report
      description: This API provides the option to download the threat hunt summary or a detailed report. The report will be available after the threat hunt job is complete. The API provides a download URL in its response. Use the URL to download the report.
      parameters:
      - name: threatHuntID
        in: path
        description: Specify the threat hunt ID. You can obtain the ID using the 'List all threat hunts API'.
        required: true
        schema:
          type: integer
      - name: reportType
        in: query
        description: Specify the report Type. The 'File' report type provides a download URL for the File Level Report, and the 'Summary' report type provides a download URL for the snapshot summary report.
        required: true
        schema:
          type: string
          enum:
          - File
          - Summary
      - name: pageToken
        in: query
        description: The token to access the next page of results. Use the token value received in the previous response's parameter 'nextPageToken'.
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHuntDownloadReportResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ThreatHunt_HTTP_500'
      operationId: getThreathuntingV1ThreathuntsByThreatHuntIDReport
      x-operation-id-source: derived
  /common/v1/search/aws/awsaccounts:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Search AWS Accounts
      description: This API provides the option to search AWS Accounts for provided Phoenix (Enterprise Workloads) organization IDs.
      parameters:
      - name: orgIDs[]
        in: query
        description: Specify the unique Phoenix(Enterprise Workload) organization ID.
        required: true
        style: form
        explode: false
        schema:
          type: array
          items:
            type: integer
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/SearchAWSAccountsResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_500'
      operationId: getCommonV1SearchAwsAwsaccounts
      x-operation-id-source: derived
  /common/v1/search/aws/resourceids:
    get:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: List AWS Resources
      description: Provides a list of the AWS Resources backed up to Druva Cloud. It is relevant to the selected Phoenix (Enterprise Workloads) organization IDs, AWS account IDs, and regions. Currently, support is limited to EC2 and EBS Volumes AWS workloads.
      parameters:
      - name: orgIDs[]
        in: query
        description: Specify the unique Phoenix(Enterprise Workload) organization ID.
        required: true
        style: form
        explode: false
        schema:
          type: array
          items:
            type: integer
      - name: accountIDs[]
        in: query
        description: Specify the unique AWS Account IDs. You can obtain the ID using the 'Search AWS Accounts API'.
        required: true
        style: form
        explode: false
        schema:
          type: array
          items:
            type: integer
      - name: regions[]
        in: query
        description: Specify the AWS region's code. For the list of supported regions, refer to the AWS Workloads documentation. For example, 'us-east-1' and 'us-west-2'.
        required: true
        style: form
        explode: false
        schema:
          type: array
          items:
            type: integer
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ListResourceIDsResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_500'
      operationId: getCommonV1SearchAwsResourceids
      x-operation-id-source: derived
  /common/v1/search/aws/resources:
    post:
      tags:
      - Threat Hunting
      security:
      - Bearer: []
      summary: Search AWS Resources
      description: Allows you to search AWS workloads- EC2 and EBS Volumes backed up to Druva Cloud for the selected/provided Phoenix (Enterprise Workloads) organization IDs, AWS account IDs, and regions. Currently, only AWS workloads - EC2 and EBS Volumes are supported.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SearchAWSResourcesParams'
      responses:
        '200':
          description: Success
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/SearchAWSResourcesResponse'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_400'
        '401':
          description: The request either did not include an authentication token, or you have provided an expired authentication token.
        '404':
          description: The requested resource was not found.
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_404'
        '500':
          description: Internal Server Error
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/RealizeCommon_HTTP_500'
      operationId: postCommonV1SearchAwsResources
      x-operation-id-source: derived
components:
  schemas:
    ThreatHuntScanSummaryResponse:
      type: object
      properties:
        threatHuntID:
          type: integer
          description: The identifier to uniquely identify threat hunt.
        impactedResources:
          type: integer
          description: Count of impacted resources against which threat was identified.
        impactedDevices:
          type: integer
          description: Count of impacted devices against which threat was identified.
        impactedSnapshots:
          type: integer
          description: Count of impacted snapshots against which threat was identified among all provided resources.
        totalFilesImpacted:
          type: integer
          description: Count of impacted files against which threat was identified among all provided resources.
        totalResources:
          type: integer
          description: Count of total resources provided during threat hunt creation.
        totalDevices:
          type: integer
          description: Count of total devices provided during threat hunt creation.
        totalSnapshots:
          type: integer
          description: Count of total snapshots that were included in the threat hunt scan.
        scanStartedTime:
          type: string
          description: The date and time when the threat hunt scan was started. Example - Aug 27, 2024 14:13:42.
          example: Aug 27, 2024 14:13:42
        scanCompletedTime:
          type: string
          description: The date and time when the threat hunt scan was completed. Example - Aug 27, 2024 14:13:42.
          example: Aug 27, 2024 14:13:42
        scanStatus:
          type: string
          desc

# --- truncated at 32 KB (64 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/druva/refs/heads/main/openapi/druva-threat-hunting-api-openapi.yml