What this endpoint does

Retrieves detailed information for a single Identity Novel Exposures alert, identified by its alert ID in the URL path. These alerts are triggered when newly stolen credentials belonging to your organization's users are discovered — typically harvested by infostealer malware from compromised endpoints. Use the Playbook Alerts: Search endpoint with category identity_novel_exposures to discover alert IDs. The optional panels body parameter lets you request specific data sections ("status", "summary", or "log"). For retrieving multiple alerts at once, use the Playbook Alerts: Identity Exposures Bulk endpoint instead.

Response data

The response contains a single alert with panel-organized data: panel_evidence_summary provides the core intelligence including the compromised identity (email), the service URL where credentials were used, exposed secret details (password hashes in multiple algorithms, cleartext status), compromised host forensics (OS, malware file path, exfiltration date, antivirus), the malware family responsible, attacker infrastructure, and the credential source metadata; panel_status provides alert metadata; and panel_log_v2 tracks the change history.