What this endpoint does

Retrieves threat indicators (IPs, domains, hashes, URLs) from a specific threat hunt job — a point-in-time snapshot captured when the job was generated. Part of the async hunting workflow: (1) poll Threat Hunting: Get Pending Jobs for job IDs, (2) update to "started" via Threat Hunting: Update Job Status, (3) fetch indicators here and/or rules via Threat Hunting: Get Job Rules, (4) mark "completed" or "failed". Filter by observable type and hash algorithm. Enable risk enrichment with include.risk.score: true.

Response data

Returns the IOCs your integration should hunt for — malicious IPs, domains, file hashes, and URLs scoped to the job's time window. These are point-in-time snapshots, not live feeds, so the same job always returns the same indicators. Optionally include risk scores and triggered rule details to prioritize which indicators represent the highest-confidence threats. Pagination uses opaque cursor tokens — pass nextOffset from one response as offset in the next request until nextOffset is absent. Filter by type to match your tool's capabilities (e.g., only hash for endpoint sweeps, only ip and domain for network hunts). Returns 404 if the job ID doesn't exist.

200Indicators for this profile

404Threat hunt job not found