What this endpoint does

Retrieves detailed information for a single Domain Abuse alert, identified by its alert ID in the URL path. These alerts detect suspicious domains impersonating your organization — including typosquats, phishing domains, and brand abuse. Use the Playbook Alerts: Search endpoint with category domain_abuse to discover alert IDs. This endpoint offers six panel types via the optional panels body parameter: "status", "summary", "dns", "whois", "action", and "log". For retrieving multiple alerts at once, use the Playbook Alerts: Domain Abuse Bulk endpoint; to download captured screenshots, use the Playbook Alerts: Domain Abuse Image endpoint.

Response data

The response contains a single alert with panel-organized data: panel_status identifies the suspicious domain, its risk score, and the legitimate targets being impersonated; panel_evidence_summary explains the detection trigger and includes screenshot references; panel_evidence_dns provides DNS records (A, MX, NS) for the suspicious domain; panel_evidence_whois contains WHOIS registration data; and panel_action tracks available remediation actions such as takedowns and firewall blocking.