ThreatHuntConfig

Config as the input to start a threat hunt.

Fields

Field	Type	Description
clusterUuid	String!	UUID used to identify the cluster the request goes to.
fileScanCriteria	MalwareScanFileCriteria	Criteria to restrict files to scan.
indicatorsOfCompromise	[IndicatorOfCompromise!]!	List of IOCs to scan for.
maxMatchesPerSnapshot	Int	Maximum number of matches per shapshot, per IOC. Scanning for an Indicator Of Compromise within a snapshot will terminate once this many matches have been detected. Defaults to one.
name	String!	Name of this threat hunt.
notes	String!	Notes to describe this threat hunt.
objects	[CdmHierarchySnappableNew!]!	The objects to be scanned for malware.
registryPatterns	[RegistryPatternSpec!]!	Registry key patterns to search for in Windows snapshots (TH v1).
requestedMatchDetails	RequestedMatchDetails	Additional information required for files with malware matches.
shouldExpandArchiveFiles	Boolean!	When true, the lambda engine expands zip/archive files during the threat hunt scan and runs YARA processors on each extracted inner file. Populated from HuntScanFileCriteria.should_expand_archive_files by the threat-hunt dispatcher.
shouldTrustFilesystemTimeInfo	Boolean!	Specifies whether features that rely on the accuracy of filesystem metadata, like creation time and modification time of files, are enabled or not. These features include backend optimizations to skip re-scanning files that have not changed across snapshots, as indicated by the unchanged timestamps of files. This flag also gates access to some filters that can be specified in this API. Note that this flag should be used with caution, as relying on file timestamps may make the system vulnerable to adversarial techniques such as timestamp manipulation.
snapshotScanLimit	MalwareScanSnapshotLimit	Limit which snapshots to include in the threat hunt.

Used By

Referenced by

• ThreatHuntDetails.config
• ThreatHuntResult.config
• ThreatHuntSummaryReply.config