What this endpoint does

Retrieves threat hunt jobs awaiting execution — the entry point for the integration-driven hunting workflow. Hunting profiles generate jobs automatically on schedule; poll this endpoint to discover new work. Pass your enterprise integration identifier (e.g., uhash:XXXXXXXXXX) as the integration query parameter to scope results. Discover your identifier via Threat Hunting: Query Profiles. For each job: (1) set status to "started" via Threat Hunting: Update Job Status, (2) fetch indicators via Threat Hunting: Get Job Indicators and/or rules via Threat Hunting: Get Job Rules, (3) set status to "completed" or "failed".

Response data

Returns jobs waiting for your integration to process — each represents a scheduled threat hunt with a specific time window defining the intelligence lookback period. An empty list (HTTP 200) means no hunts are pending; poll at an interval matching your profile's cron schedule. When jobs appear, process them in the three-step workflow described above. The job UUID is required for all subsequent operations (fetching indicators, fetching rules, updating status). The time range defines the intelligence window the hunt covers — indicators and rules returned for that job are scoped to threats observed within that period.

200List of pending threat hunt jobs