OBJECT
ThreatHuntConfig
Description
Config as the input to start a threat hunt.
link GraphQL Schema definition
- type ThreatHuntConfig {
- # Criteria to restrict files to scan.
- : MalwareScanFileCriteria
- # List of IOCs to scan for.
- : [IndicatorOfCompromise!]!
- # Maximum number of matches per shapshot, per IOC. Scanning for an Indicator Of
- # Compromise within a snapshot will terminate once this many matches have been
- # detected. Defaults to one.
- : Int
- # Name of this threat hunt.
- : String!
- # Notes to describe this threat hunt.
- : String!
- # Additional information required for files with malware matches.
- : RequestedMatchDetails
- # Specifies whether features that rely on the accuracy of filesystem metadata,
- # like creation time and modification time of files, are enabled or not. These
- # features include backend optimizations to skip re-scanning files that have not
- # changed across snapshots, as indicated by the unchanged timestamps of files.
- # This flag also gates access to some filters that can be specified in this API.
- # Note that this flag should be used with caution, as relying on file timestamps
- # may make the system vulnerable to adversarial techniques such as timestamp
- # manipulation.
- : Boolean!
- # Limit which snapshots to include in the threat hunt.
- : MalwareScanSnapshotLimit
- # UUID used to identify the cluster the request goes to.
- : String!
- # The objects to be scanned for malware.
- : [CdmHierarchySnappableNew!]!
- }