Review Hunt findings

Pull every open Hunt finding across your estate into your SIEM or ticketing system, narrow it down by severity, platform or finding kind, and suppress findings you’ve accepted. The same patterns apply to sensitive-data findings from data classification.

Before you begin

A personal access token with security read access. Suppressing findings needs write access and an admin user. See Authentication.
Finding kinds used by the v2 endpoints (the threat_kind values): ransomware, malware, encryption, filesystem_error, pursuit and custom. Severities are critical, high, medium, low and info. GET /gateway/api/v2/threats/definitions returns each kind with a readable title and source.

List Hunt findings

GET /gateway/api/v2/threats returns one row per asset and finding kind (one per asset and hunt rule for custom), for live assets only. Virtual machines are hunted through their attached volumes and disks, so those findings roll up onto the VM’s row and are listed in attached_assets. For the per-volume breakdown, use GET /gateway/api/v2/assets/{assetId}/threats.

Filters (comma-separated): severity, platform, asset_kind, threat_kind, asset_id, policy_id (or unpoliced), plus search for free text. status is one of open (the default), acknowledged, suppressed, resolved or all. Page with page_size and next_page_token.

GET

/gateway/api/v2/threatsList findings (v2)

Try it

This example pulls every open critical or high ransomware and malware row on AWS:

curl -G "https://acme.app.elastio.com/gateway/api/v2/threats" \
  -H "Authorization: Bearer $ELASTIO_TOKEN" \
  --data-urlencode "platform=aws" \
  --data-urlencode "severity=critical,high" \
  --data-urlencode "threat_kind=ransomware,malware" \
  --data-urlencode "page_size=100"

import os, requests

BASE = "https://acme.app.elastio.com"
HEADERS = {"Authorization": f"Bearer {os.environ['ELASTIO_TOKEN']}"}

params = {"platform": "aws", "severity": "critical,high", "threat_kind": "ransomware,malware", "page_size": 100}
rows = []
while True:
    resp = requests.get(f"{BASE}/gateway/api/v2/threats", headers=HEADERS, params=params, timeout=30)
    resp.raise_for_status()
    body = resp.json()
    rows.extend(body.get("data", []))
    token = (body.get("pagination") or {}).get("next_page_token")
    if not token:
        break
    params["next_page_token"] = token

for r in rows:
    print(r["severity"], r["threat_kind"], r["asset_name"], r.get("files_affected"), r.get("signature"))

$Base = "https://acme.app.elastio.com"
$Headers = @{ Authorization = "Bearer $env:ELASTIO_TOKEN" }
$Query = "platform=aws&severity=critical,high&threat_kind=ransomware,malware&page_size=100"

$Rows = @()
$Token = $null
do {
    $Uri = "$Base/gateway/api/v2/threats?$Query"
    if ($Token) { $Uri += "&next_page_token=$([uri]::EscapeDataString($Token))" }
    $Page = Invoke-RestMethod -Uri $Uri -Headers $Headers
    $Rows += $Page.data
    $Token = $Page.pagination.next_page_token
} while ($Token)

$Rows | Select-Object severity, threat_kind, asset_name, files_affected, signature

Example response (trimmed):

{
  "total": 1,
  "data": [
    {
      "id": "threat:6f1c2a9e-3b4d-4e8f-9a7b-1c2d3e4f5a6b:ransomware",
      "asset_id": "6f1c2a9e-3b4d-4e8f-9a7b-1c2d3e4f5a6b",
      "asset_name": "payments-api-01",
      "asset_kind": "ec2_instance",
      "platform": "aws",
      "platform_details": { "account_id": "123456789012", "region": "us-east-1" },
      "kind": "hunt",
      "threat_kind": "ransomware",
      "severity": "critical",
      "count": 2,
      "latest_scan_at": "2026-10-11T21:58:12Z",
      "attached_assets": [{ "asset_id": "0e1f2a3b-4c5d-4e6f-8a7b-9c0d1e2f3a4b", "asset_name": "vol-0123456789abcdef0" }],
      "files_affected": 418,
      "signature": "…",
      "signatures": ["…"],
      "report_id": null,
      "details": null,
      "status": "open",
      "status_changed_at": "2026-10-11T21:58:12Z",
      "suppressed_until": null,
      "suppression_reason": null,
      "resolved_at": null,
      "acknowledged_at": null
    }
  ],
  "pagination": { "next_page_token": "", "prev_page_token": "" }
}

For Pursuit rows, report_id points to the persistence report. See Investigate with Pursuit. For custom rows, details carries the hunt_rule_id and hunt_scan_id.

Build filters from live counts

GET /gateway/api/v2/threats/filters takes the same filters and returns, for each facet (severity, platform, asset_kind, threat_kind, policy_id), the available values with the number of rows each one would match.

GET

/gateway/api/v2/threats/filtersGet filter options for v2 findings

Try it

curl "https://acme.app.elastio.com/gateway/api/v2/threats/filters?platform=aws" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.get(f"{BASE}/gateway/api/v2/threats/filters", headers=HEADERS, params={"platform": "aws"}, timeout=30)
resp.raise_for_status()
for opt in resp.json()["threat_kind"]:
    print(opt["value"], opt["count"])

(Invoke-RestMethod -Uri "$Base/gateway/api/v2/threats/filters?platform=aws" -Headers $Headers).threat_kind

{
  "severity": [{ "value": "critical", "label": "Critical", "count": 3 }, { "value": "high", "label": "High", "count": 9 }],
  "platform": [{ "value": "aws", "label": "AWS", "count": 12 }],
  "asset_kind": [{ "value": "ec2_instance", "label": "EC2 instance", "count": 10 }],
  "threat_kind": [{ "value": "ransomware", "label": "Ransomware", "count": 2 }, { "value": "malware", "label": "Malware", "count": 10 }],
  "policy_id": [{ "value": "unpoliced", "label": "…", "count": 1 }]
}

Suppress a finding

Suppress a finding you’ve reviewed and accepted until a given time, with a reason. Both suppression endpoints are admin-only: the gateway checks the role behind your token.

The spec doesn’t say which identifier threat_id takes. The records returned by GET /gateway/api/v1/scanjobs/{scanJobId}/threats (List what a hunt found) have a UUID id and carry suppressed_until and suppression_reason, so this example uses that ID. The v2 rows above use composite IDs (threat:{asset_id}:{threat_kind}) and show suppression state through status: "suppressed".

POST

/gateway/shared-services/v1/threats/{threat_id}/suppressSuppress a finding

Try it

curl -X POST "https://acme.app.elastio.com/gateway/shared-services/v1/threats/e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b/suppress" \
  -H "Authorization: Bearer $ELASTIO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Known test sample used by the red team", "until": "2026-12-31T23:59:59Z" }'

threat_id = "e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b"
resp = requests.post(
    f"{BASE}/gateway/shared-services/v1/threats/{threat_id}/suppress",
    headers=HEADERS,
    json={"reason": "Known test sample used by the red team", "until": "2026-12-31T23:59:59Z"},
    timeout=30,
)
resp.raise_for_status()  # 204 No Content on success

$ThreatId = "e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b"
$Body = @{ reason = "Known test sample used by the red team"; until = "2026-12-31T23:59:59Z" } | ConvertTo-Json
Invoke-RestMethod -Method Post -Uri "$Base/gateway/shared-services/v1/threats/$ThreatId/suppress" `
  -Headers $Headers -ContentType "application/json" -Body $Body

A successful call returns 204 No Content. To remove the suppression early:

DELETE

/gateway/shared-services/v1/threats/{threat_id}/suppressionRemove a finding suppression

Try it

curl -X DELETE "https://acme.app.elastio.com/gateway/shared-services/v1/threats/e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b/suppression" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.delete(
    f"{BASE}/gateway/shared-services/v1/threats/{threat_id}/suppression",
    headers=HEADERS, timeout=30,
)
resp.raise_for_status()  # 204 No Content on success

Invoke-RestMethod -Method Delete -Uri "$Base/gateway/shared-services/v1/threats/$ThreatId/suppression" -Headers $Headers

To review what’s currently suppressed, list findings with status=suppressed.

Review sensitive-data findings

Data classification flags files that contain sensitive information. GET /gateway/api/v2/data-classification/findings lists the assets that currently have findings. Volume and disk findings roll up to the attached VM. Filter by findings_category, severity (the asset’s highest severity: critical, high, medium or low), platform, asset_kind, asset_id, policy_id or search, and page with page_size and next_page_token.

GET

/gateway/api/v2/data-classification/findingsList assets with sensitive data classification findings

Try it

curl "https://acme.app.elastio.com/gateway/api/v2/data-classification/findings?severity=critical,high&page_size=50" \
  -H "Authorization: Bearer $ELASTIO_TOKEN"

resp = requests.get(
    f"{BASE}/gateway/api/v2/data-classification/findings",
    headers=HEADERS, params={"severity": "critical,high", "page_size": 50}, timeout=30,
)
resp.raise_for_status()
for a in resp.json()["data"]:
    print(a["asset_name"], a["highest_severity"], a["findings_by_category"])

(Invoke-RestMethod -Uri "$Base/gateway/api/v2/data-classification/findings?severity=critical,high&page_size=50" -Headers $Headers).data |
  Select-Object asset_name, highest_severity, findings_by_category

{
  "total": 1,
  "data": [
    {
      "asset_id": "6f1c2a9e-3b4d-4e8f-9a7b-1c2d3e4f5a6b",
      "asset_name": "fileserver-02",
      "asset_kind": "ec2_instance",
      "platform": "aws",
      "platform_details": { "account_id": "123456789012", "region": "us-east-1" },
      "findings_by_category": { "…": 128 },
      "findings_by_category_severity": { "…": "high" },
      "highest_severity": "high",
      "updated_at": "2026-10-11T22:10:00Z"
    }
  ],
  "pagination": { "next_page_token": "", "prev_page_token": "" }
}

The spec doesn’t list the category names. Get them from GET /gateway/api/v2/data-classification/findings/filters and the default severity of each type from GET /gateway/api/v2/data-classification/definitions. To drill into one asset, call GET /gateway/api/v1/assets/{assetId}/data-classification. For the individual sensitive files from one hunt, call GET /gateway/api/v1/assets/{assetId}/scanjobs/{scanJobId}/data-classification/findings.

Ransomware Summary has a single endpoint, GET /gateway/api/v1/ransomware-short. It returns a date and a ransomware list of items whose fields the spec doesn’t describe.

All endpoints