--- updatedAt: 2026-06-12T16:10:41.000Z agentTools: projectIndex: https://docs.recordedfuture.com/llms.txt --- # Playbook Alerts: Malicious Sites Create Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause `manual` and the creator is taken from the authenticated request. If the attacker matches the main attacker of an existing alert, the attacker is added to that alert instead of creating a new one. Provide exactly one of `rule` or `organization` to select the use case configuration the alert is created under. ### What this endpoint does Manually creates a Malicious Sites Playbook Alert for an attacker domain you supply — useful when an analyst spots a phishing or brand-impersonation site that automated detection hasn't alerted on yet. The alert is created with cause `manual` and attributed to the authenticated caller. Provide exactly one of `rule` (the alert rule id) or `organization` (whose Malicious Sites use case configuration the alert is created under), and optionally set targets, assignee, status, priority, or a free-text description via `options`. If the attacker domain already matches the main attacker of an existing alert, the domain is added to that alert instead of creating a duplicate. ### Response data The `outcome` field tells you what happened — `alert_created` (a new alert), `attacker_added` (folded into an existing alert), or `already_tracked` (nothing new to do) — along with the `playbook_alert_id` of the created or matched alert, ready to pass to [Playbook Alerts: Malicious Sites Detail](https://docs.recordedfuture.com/reference/post_malicious-sites-playbook-alert-id). # OpenAPI definition ```json { "openapi": "3.0.3", "info": { "title": "Recorded Future Playbook Alerts", "version": "1.4.0", "description": "A Recorded Future API for Playbook Alerts.\n\nThe playbook alert API provides programmatic access to Recorded Future playbook alerts.\nThese alerts differ quite a bit from the standard \"alerts\" generated by Recorded Future, \nin that they include additional lookups and information that further empower the user to make accurate and timely decisions. \nInformation presented in a playbook alert will also be updated as needed, \nbased on new information or changes in the Recorded Future risk scores based on elapsed time or similar.\n\nThe API has several generic endpoint, categorized as common, intended as entry points into Playbook Alert data.\nMost notably there is /search for finding alerts, and resource item endpoints for previewing basic alert data (`GET /common/{id}`),\nand updating an alert (`PUT /common/{id}`).\n\nFor more detailed information and evidence there are a set of endpoint for each alert category.\nThese produce datasets grouped into panels, ready to be rendered as UI elements.\n\nPlease read the [detailed support article](https://support.recordedfuture.com/hc/en-us/articles/6934348280851-Playbook-Alert-API) before using this API.\n", "x-rf-service-id": "service:playbook-alert" }, "servers": [ { "url": "https://api.recordedfuture.com/playbook-alert" } ], "paths": { "/malicious_sites/create": { "post": { "summary": "Playbook Alerts: Malicious Sites Create", "description": "Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause `manual` and the creator is taken from the authenticated request.\n\nIf the attacker matches the main attacker of an existing alert, the attacker is added to that alert instead of creating a new one.\n\nProvide exactly one of `rule` or `organization` to select the use case configuration the alert is created under.\n", "security": [ { "ApiKeyAuth": [] }, { "idp": [] } ], "tags": [ "Malicious Sites" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "attacker" ], "oneOf": [ { "required": [ "rule" ] }, { "required": [ "organization" ] } ], "properties": { "attacker": { "description": "The attacker domain to create the alert for.", "type": "string", "example": "idn:mail.google.mail.pl" }, "rule": { "description": "The id of the alert rule (use case configuration) to create the alert under. Provide either `rule` or `organization`.\n", "type": "string", "example": "report:rule1" }, "organization": { "description": "The id of the organization whose Malicious Sites use case configuration the alert is created under. Provide either `rule` or `organization`.\n", "type": "string", "example": "uhash:40wXmPVONA" }, "options": { "$ref": "#/components/schemas/MaliciousSitesCreateOptions" } } } } } }, "responses": { "200": { "description": "The Malicious Sites alert was created or extended, or the alert already exists.", "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "$ref": "#/components/schemas/PlaybookAlertStatusResponse" }, "outcome": { "type": "string", "enum": [ "alert_created", "attacker_added", "already_tracked" ], "example": "alert_created" }, "playbook_alert_id": { "description": "The id of the created or matched Playbook Alert.", "type": "string", "example": "task:34da3a87-87ed-4ccd-8ca3-437167acdb76" } } } } } } } } } }, "components": { "schemas": { "PlaybookAlertStatusResponse": { "type": "object", "properties": { "status_code": { "type": "string", "enum": [ "Ok", "Error" ], "description": "Status describing the result of the request.", "example": "Ok" }, "status_message": { "type": "string", "description": "Text describing the status, suitable for displaying an error.", "example": "Ok" } } }, "MaliciousSitesCreateOptions": { "type": "object", "description": "Optional overrides applied to the created Malicious Sites alert.", "properties": { "targets": { "description": "Domains or other entities that are related to this alert.", "type": "array", "items": { "type": "string", "example": "idn:google.com" } }, "assignee": { "description": "The assignee of the alert. Defaults to the assignee in the alert rule.", "type": "string", "example": "uhash:40wXmPVONA" }, "status": { "$ref": "#/components/schemas/PlaybookAlertStatus" }, "priority": { "$ref": "#/components/schemas/PlaybookAlertPriority" }, "description": { "description": "Optional free-text description of the alert.", "type": "string" } } }, "PlaybookAlertPriority": { "type": "string", "enum": [ "High", "Moderate", "Informational" ], "description": "The priority of the Playbook Alert." }, "PlaybookAlertStatus": { "type": "string", "enum": [ "New", "InProgress", "Dismissed", "Resolved" ], "example": "Resolved", "description": "The status of the Playbook Alert." } }, "securitySchemes": { "ApiKeyAuth": { "description": "API Credential", "type": "apiKey", "in": "header", "name": "X-RFToken" }, "idp": { "description": "Click on \"Authorize\" to be redirected to the login page.", "type": "oauth2", "flows": { "authorizationCode": { "authorizationUrl": "https://id.recordedfuture.com/authorize", "tokenUrl": "https://id.recordedfuture.com/token", "refreshUrl": "https://id.recordedfuture.com/token", "scopes": {} } } } } } } ``` # Sibling pages * [Playbook Alerts: Malicious Sites Detail](https://docs.recordedfuture.com/reference/post_malicious-sites-playbook-alert-id.md) * [Playbook Alerts: Malicious Sites Bulk](https://docs.recordedfuture.com/reference/post_malicious-sites.md) * [Playbook Alerts: Malicious Sites Screenshot](https://docs.recordedfuture.com/reference/get_malicious-sites-playbook-alert-id-image-image-id.md)