What this endpoint does

Discovers threat hunting profiles available to your organization. Unlike detection and prevention profiles (which expose indicators/rules directly), hunting profiles operate through an async job workflow: they generate jobs on a schedule, and integrations poll Threat Hunting: Get Pending Jobs to retrieve them. Use this endpoint to discover profile schedules and lookback windows — the id returned here appears in each pending job's profile field. Supply either ids (array of UUIDs, max 100) or enterprise (e.g., uhash:XXXXXXXXXX) — at least one required. Empty body or empty ids returns 400.

Response data

Returns the hunting profiles your organization has configured — each one defines a recurring threat hunt that automatically generates jobs containing fresh indicators and detection rules for your security tools. The schedule (cron expression) and lookback (in seconds) tell you how frequently the profile runs and how far back it looks for threat data — use this to align your polling cadence with the profile's job generation rhythm. If you poll Threat Hunting: Get Pending Jobs less frequently than the schedule runs, jobs will queue up. The nextRun timestamp shows when the next job will be created. These scheduling fields are unique to hunting profiles — detection and prevention profiles operate on continuous update models instead.