--- title: Hunters slug: connectors/hunters docTags: createdAt: 2026-06-09T16:29:59.981Z --- The Hunters connector enables automated interactions with the Hunters threat detection and response platform, facilitating advanced security operations. Hunters is a cutting-edge threat detection and response platform that specializes in aggregating and analyzing security data to identify potential threats. The Hunters connector for Swimlane Turbine enables users to seamlessly integrate threat management capabilities into their security workflows. With this connector, security teams can add comments to leads, retrieve comprehensive leads lists, monitor data source health, and update lead statuses and classifications without leaving the Swimlane environment. This integration empowers users to act swiftly on threats, streamline their security operations, and maintain a strong security posture with minimal manual intervention. ### Limitations None to date. ### Supported Versions This Hunters connector uses the latest version API. ## Configuration ### Prerequisites To effectively utilize the Hunters connector within Swimlane Turbine, ensure you have the following prerequisites: - HTTP Bearer Authentication with the following parameters: - URL: The endpoint URL for Hunters API access. - Token: A valid bearer token such as JWT for secure authentication. ## Authentication Methods ### HTTP Bearer Authentication: - URL: The endpoint URL for the Hunters API. - Username: Your Hunters username with sufficient permissions. - Token: The token for the Hunters API. ## Capabilities This Hunters connector provides the following capabilities: - Add Lead Comment - Get Data Sources Status And Health - Get Leads - Get Leads Change Log - Set Lead Status - Set Leads Classification - Set Leads Status ## Additional Documentation - [Hunters Connector Documentation](https://docs.swimlane.com/connectors/hunters) - [Hunters API Documentation](https://docs.hunters.ai/) # Configurations ## HTTP Bearer Authentication Authenticates using bearer token such as a JWT, etc. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API key, token, etc. | string | Required | | verify\_ssl | Verify SSL certificate. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add Lead Comment Adds a user-defined comment to a specific lead in Hunters, identified by the unique lead\_uuid. ### Endpoint - **URL:** `/leads/{{lead_uuid}}/comment` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.lead_uuid` | string | Required | The UUID of the lead to update. | | `parameters.organization` | string | Optional | Return only results relevant to the specified organization. Note that this field is relevant to multi-tenant applications only. | | | | | | | `parameters.org_id` | string | Optional | Return only results relevant to the specified organization ID. An organization ID is defined by Hunters during tenant provisioning. Note that this field is relevant to multi-tenant applications only. | | `comment` | string | Optional | The comment to add to the lead. | ### Input Example `{"path_parameters":{"lead_uuid":"string"},"parameters":{"organization":"string","org_id":"string"},"comment":"string"}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.id` | string | Unique identifier | | `results.text` | string | Result of the operation | | `results.writer` | string | Result of the operation | | `results.created_at` | string | Result of the operation | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":[{}]}}` ## Get Data Sources Status And Health Retrieve operational insights by checking the status and health of data sources integrated with Hunters. ### Endpoint - **URL:** `Get Data Sources Status And Health` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------- | | `parameters.organization` | string | Optional | Return only results relevant to the specified organization. Note that this field is relevant to multi-tenant applications only. | | | | | | | `parameters.dataflow_id` | string | Optional | Return only results for the specified data flow ID. | ### Input Example `{"parameters":{"organization":"string","dataflow_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.dataflow` | string | Response data | | `results.id` | string | Unique identifier | | `results.datatype` | string | Response data | | `results.integration_type` | string | Type of the resource | | `results.description` | object | Result of the operation | | `results.status` | string | Status value | | `results.error_details` | object | Result of the operation | | `results.last_insertion_time` | string | Result of the operation | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":[{}]}}` ## Get Leads Retrieves a complete list of leads from the Hunters platform, facilitating efficient lead management. ### Endpoint - **URL:** `/leads` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.uuid` | array | Optional | To return only specific leads, provide a list of lead IDs, separated by comma. | | `parameters.offset` | number | Optional | The starting point for the paged response. | | `parameters.limit` | number | Optional | Define the maximum number of items to be returned in the paged response. Maximum 10000. | | `parameters.risk` | array | Optional | Return only leads with the specified risk level(s), separated by a comma. | | `parameters.status` | array | Optional | Return only leads in the specified status(es), separated by comma. | | `parameters.investigation_state` | array | Optional | Return only leads in the specified auto-investigation state(s), separated by a comma. | | `parameters.source` | array | Optional | The name of the vendor from which data originates. | | `parameters.assignee` | array | Optional | Return only leads with specific assignee(s). The expected value is the assignee's email address or addresses, separated by a comma. | | `parameters.sort` | array | Optional | Determine how leads will be sorted. Use desc and asc to determine order. | | `parameters.is_alert` | boolean | Optional | Set to true to return only leads that matured into Alerts, and to false to return all leads. | | `parameters.show_null_status` | boolean | Optional | If set to true, all leads without a set status will be returned with status = null instead of "open". | | `parameters.since` | string | Optional | Return only leads that were created after the specified date (ISO 8601). | | `parameters.until` | string | Optional | Return only leads that were created before the specified date (ISO 8601). | | `parameters.updated_since` | string | Optional | Used with investigation\_state and updated\_until to return only leads that transitioned to a specific investigation status inside a specific timeframe. (ISO 8601) | | `parameters.updated_until` | string | Optional | Used with investigation\_state and updated\_since to return only leads that transitioned to a specific investigation status within a specific timeframe. (ISO 8601) | | `parameters.organization` | string | Optional | Return only results relevant to the specified organization. Relevant to multi-tenant applications only. | | `parameters.org_id` | string | Optional | Return only results relevant to the specified organization ID. Relevant to multi-tenant applications only. | | `parameters.detector` | array | Optional | Return only leads originating from the specified detector(s), separated by a comma. | | `parameters.data_source` | array | Optional | Return only leads involving the specified data source(s), separated by a comma. | | `parameters.include_attributes` | boolean | Optional | Include lead attributes in the response. | | `parameters.threat_uuid` | string | Optional | The ID of the threat cluster. | | `parameters.context_uuid` | string | Optional | The ID of the context by which leads are clustered. | ### Input Example `{"parameters":{"uuid":["string"],"offset":123,"limit":123,"risk":["string"],"status":["string"],"investigation_state":["string"],"source":["string"],"assignee":["string"],"sort":["string"],"is_alert":true,"show_null_status":true,"since":"string","until":"string","updated_since":"string","updated_until":"string","organization":"string","org_id":"string","detector":["string"],"data_source":["string"],"include_attributes":true,"threat_uuid":"string","context_uuid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.uuid` | string | Unique identifier | | `results.event time` | string | Result of the operation | | `results.event end time` | string | Result of the operation | | `results.score` | number | Result of the operation | | `results.source` | string | Result of the operation | | `results.description` | string | Result of the operation | | `results.status` | string | Status value | | `results.ingestion time` | string | Result of the operation | | `results.detection time` | string | Result of the operation | | `results.risk` | string | Result of the operation | | `results.comments` | array | Result of the operation | | `results.comments.id` | string | Unique identifier | | `results.comments.text` | string | Result of the operation | | `results.comments.writer` | string | Result of the operation | | `results.comments.created at` | string | Result of the operation | | `results.detector` | string | Result of the operation | | `results.data sources` | string | Response data | | `results.investigation state` | string | Result of the operation | | `results.threat uuid` | string | Unique identifier | | `results.is alert` | boolean | Result of the operation | | `results.threat description` | string | Result of the operation | | `results.classification` | string | Result of the operation | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":[{}]}}` ## Get Leads Change Log Retrieve a detailed log of changes to leads within the Hunters platform, offering insights into modifications. ### Endpoint - **URL:** `/leads/change-log` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | `parameters.uuid` | array | Optional | To return only specific leads, provide a list of lead IDs, separated by comma. | | `parameters.offset` | number | Optional | The starting point for the paged response. | | `parameters.limit` | number | Optional | Define the maximum number of items to be returned in the paged response. maximum- 10000 | | `parameters.risk` | array | Optional | Return only leads with the specified risk level(s), separated by a comma. | | `parameters.status` | array | Optional | Return only leads in the specified status(es), separated by comma. | | `parameters.source` | array | Optional | The name of the vendor from which data originates. | | `parameters.assignee` | array | Optional | Return only leads with specific assignee(s). The expected value is the assignee's email address or addresses, separated by a comma. | | `parameters.sort` | array | Optional | Determine how leads will be sorted. Use desc and asc to determine order. | | `parameters.is_alert` | boolean | Optional | Set to true to return only leads that matured into Alerts, and to false to return all leads. | | `parameters.since` | string | Optional | Return only leads that were created after the specified date (ISO 8601). | | `parameters.until` | string | Optional | Return only leads that were created before the specified date (ISO 8601). | | `parameters.organization` | string | Optional | Return only results relevant to the specified organization. Relevant to multi-tenant applications only. | | `parameters.org_id` | string | Optional | Return only results relevant to the specified organization ID. Relevant to multi-tenant applications only. | | `parameters.detector` | array | Optional | Return only leads originating from the specified detector(s), separated by a comma. | | `parameters.data_source` | array | Optional | Return only leads involving the specified data source(s), separated by a comma. | | `parameters.threat_uuid` | string | Optional | The ID of the threat cluster. | | `parameters.context_uuid` | string | Optional | The ID of the context by which leads are clustered. | | `parameters.change_time_since` | string | Optional | Return only leads that were updated after the specified date (ISO 8601). Used with change\_time\_until. | | `parameters.change_time_until` | string | Optional | Return only leads that were updated before the specified date (ISO 8601). Used with change\_time\_since. | ### Input Example `{"parameters":{"uuid":["string"],"offset":123,"limit":123,"risk":["string"],"status":["string"],"source":["string"],"assignee":["string"],"sort":["string"],"is_alert":true,"since":"string","until":"string","organization":"string","org_id":"string","detector":["string"],"data_source":["string"],"threat_uuid":"string","context_uuid":"string","change_time_since":"string","change_time_until":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | array | Result of the operation | | `results.uuid` | string | Unique identifier | | `results.detection_time` | string | Result of the operation | | `results.event_time` | string | Result of the operation | | `results.change_log` | array | Result of the operation | | `results.change_log.change_id` | string | Unique identifier | | `results.change_log.change_type` | string | Type of the resource | | `results.change_log.old_value` | string | Value for the parameter | | `results.change_log.new_value` | string | Value for the parameter | | `results.change_log.timestamp` | string | Result of the operation | | `results.change_log.actor_id` | string | Unique identifier | | `results.change_log.change_actor` | string | Result of the operation | | `results.change_log.actor_type` | string | Type of the resource | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":[{}]}}` ## Set Lead Status Updates a lead's status in Hunters by using the unique identifier (UUID) and a specified new status value. ### Endpoint - **URL:** `/leads/{{lead_uuid}}/status` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.lead_uuid` | string | Required | The UUID of the lead to update. | | `parameters.organization` | string | Optional | Return only results relevant to the specified organization. Note that this field is relevant to multi-tenant applications only. | | | | | | | `parameters.org_id` | string | Optional | Return only results relevant to the specified organization ID. An organization ID is defined by Hunters during tenant provisioning. Note that this field is relevant to multi-tenant applications only. | | `status` | string | Optional | The status of the lead, as defined by the user. | | | | | | ### Input Example `{"path_parameters":{"lead_uuid":"string"},"parameters":{"organization":"string","org_id":"string"},"status":"active"}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | object | Result of the operation | | `results.object` | object | Result of the operation | | `results.object.uuid` | string | Unique identifier | | `results.object.status` | string | Status value | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":{"object":{}}}}` ## Set Leads Classification Assign a classification status to specified leads in Hunters by their unique identifiers, with options including benign, malicious, or unknown. ### Endpoint - **URL:** `/leads/classification` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.organization` | string | Optional | Return only results relevant to the specified organization. Note that this field is relevant to multi-tenant applications only. | | | | | | | `parameters.org_id` | string | Optional | Return only results relevant to the specified organization ID. An organization ID is defined by Hunters during tenant provisioning. Note that this field is relevant to multi-tenant applications only. | | `classification` | string | Optional | The classification of the lead, as defined by the user. | | | | | | | `lead_uuids` | array | Optional | The UUIDs of the leads to update. This field is required. | ### Input Example `{"parameters":{"organization":"string","org_id":"string"},"classification":"string","lead_uuids":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | object | Result of the operation | | `results.success` | object | Result of the operation | | `results.success.lead_uuids` | array | Unique identifier | | `results.success.classification` | string | Result of the operation | | `results.failed` | object | Result of the operation | | `results.failed.lead_uuids` | array | Unique identifier | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":{"success":{},"failed":{}}}}` ## Set Leads Status Bulk update the status of specified leads in Hunters using 'status' and 'lead\_uuids' parameters. ### Endpoint - **URL:** `/leads/status` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.organization` | string | Optional | Return only results relevant to the specified organization. Note that this field is relevant to multi-tenant applications only. | | `parameters.org_id` | string | Optional | Return only results relevant to the specified organization ID. An organization ID is defined by Hunters during tenant provisioning. Note that this field is relevant to multi-tenant applications only. | | `status` | string | Optional | The status of the lead, as defined by the user. | | `lead_uuids` | array | Optional | The UUIDs of the leads to update. This field is required. | ### Input Example `{"parameters":{"organization":"string","org_id":"string"},"status":"active","lead_uuids":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `results` | object | Result of the operation | | `results.success` | object | Result of the operation | | `results.success.lead_uuids` | array | Unique identifier | | `results.failed` | object | Result of the operation | | `results.failed.lead_uuids` | array | Unique identifier | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"results":{"success":{},"failed":{}}}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |