What this endpoint does

Retrieves detailed information for multiple Identity Novel Exposures alerts in a single request (up to 250 alert IDs). These alerts are triggered when Recorded Future discovers newly stolen credentials belonging to your organization's users — typically harvested by infostealer malware (such as LummaC2, RedLine, or Raccoon) from compromised endpoints. Use the Playbook Alerts: Search endpoint with category identity_novel_exposures to discover alert IDs. The optional panels parameter lets you request only specific data sections ("status", "summary", or "log"). For single-alert retrieval, use the Playbook Alerts: Identity Exposures Detail endpoint instead.

Response data

Each alert contains panel-organized data: panel_status provides alert metadata with the exposed identity (typically an email address) as the entity; panel_evidence_summary contains the core intelligence — the compromised subject identity, the authorization_url where the credentials were used, exposed_secret details (password type, whether it's effectively cleartext, and hashes in SHA1/SHA256/NTLM/MD5), compromised_host forensics (operating system, username, malware file path, exfiltration date, computer name, antivirus), the malware_family that harvested the credentials, attacker infrastructure (IP address), related technologies (software/services involved), and dump metadata describing the credential source. Available remediation actions include enforcing password resets, placing users in risky groups, reviewing incident reports, and disabling accounts.