--- updatedAt: 2026-06-12T16:10:40.000Z agentTools: projectIndex: https://docs.recordedfuture.com/llms.txt --- # Playbook Alerts: Malicious Sites Detail Retrieve detailed information about a Malicious Sites Playbook Alert with data grouped into UI-ready panels. ### What this endpoint does Retrieves detailed information for one Malicious Sites alert, identified by its playbook\_alert\_id in the URL path, with the data grouped into UI-ready panels. These alerts flag attacker domains impersonating or abusing your protected brands — phishing pages, fake login forms, logo-cloning sites, parked/for-sale lookalikes, and re-registered malicious domains. Use the [Playbook Alerts: Search](https://docs.recordedfuture.com/reference/playbook-alerts-search) endpoint with category: `malicious_sites` to discover alert IDs. For many alerts in one call, use [Playbook Alerts: Malicious Sites Bulk](https://docs.recordedfuture.com/reference/post_malicious-sites); to download captured screenshots, use [Playbook Alerts: Malicious Sites Image](https://docs.recordedfuture.com/reference/get_malicious-sites-playbook-alert-id-image-image-id). # OpenAPI definition ```json { "openapi": "3.0.3", "info": { "title": "Recorded Future Playbook Alerts", "version": "1.4.0", "description": "A Recorded Future API for Playbook Alerts.\n\nThe playbook alert API provides programmatic access to Recorded Future playbook alerts.\nThese alerts differ quite a bit from the standard \"alerts\" generated by Recorded Future, \nin that they include additional lookups and information that further empower the user to make accurate and timely decisions. \nInformation presented in a playbook alert will also be updated as needed, \nbased on new information or changes in the Recorded Future risk scores based on elapsed time or similar.\n\nThe API has several generic endpoint, categorized as common, intended as entry points into Playbook Alert data.\nMost notably there is /search for finding alerts, and resource item endpoints for previewing basic alert data (`GET /common/{id}`),\nand updating an alert (`PUT /common/{id}`).\n\nFor more detailed information and evidence there are a set of endpoint for each alert category.\nThese produce datasets grouped into panels, ready to be rendered as UI elements.\n\nPlease read the [detailed support article](https://support.recordedfuture.com/hc/en-us/articles/6934348280851-Playbook-Alert-API) before using this API.\n", "x-rf-service-id": "service:playbook-alert" }, "servers": [ { "url": "https://api.recordedfuture.com/playbook-alert" } ], "paths": { "/malicious_sites/{playbook_alert_id}": { "post": { "summary": "Playbook Alerts: Malicious Sites Detail", "description": "Retrieve detailed information about a Malicious Sites Playbook Alert with data grouped into UI-ready panels.\n", "security": [ { "ApiKeyAuth": [] }, { "idp": [] } ], "tags": [ "Malicious Sites" ], "parameters": [ { "$ref": "#/components/parameters/PlaybookAlertId" } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "properties": { "panels": { "$ref": "#/components/schemas/MaliciousSitesPanels" } } } } } }, "responses": { "200": { "description": "Data for the requested panels.", "content": { "application/json": { "schema": { "properties": { "status": { "$ref": "#/components/schemas/PlaybookAlertStatusResponse" }, "data": { "$ref": "#/components/schemas/MaliciousSitesResponse" } } } } } } } } } }, "components": { "parameters": { "PlaybookAlertId": { "in": "path", "name": "playbook_alert_id", "required": true, "description": "The unique id of a specific Playbook Alert", "schema": { "type": "string" } } }, "schemas": { "PlaybookAlertStatusResponse": { "type": "object", "properties": { "status_code": { "type": "string", "enum": [ "Ok", "Error" ], "description": "Status describing the result of the request.", "example": "Ok" }, "status_message": { "type": "string", "description": "Text describing the status, suitable for displaying an error.", "example": "Ok" } } }, "MaliciousSitesResponse": { "type": "object", "required": [ "playbook_alert_id" ], "properties": { "playbook_alert_id": { "type": "string" }, "panel_status": { "$ref": "#/components/schemas/MaliciousSitesStatusPanel" }, "panel_evidence_summary": { "$ref": "#/components/schemas/MaliciousSitesEvidenceSummaryPanel" }, "panel_evidence_dns": { "$ref": "#/components/schemas/MaliciousSitesEvidenceDnsPanel" }, "panel_evidence_whois": { "$ref": "#/components/schemas/MaliciousSitesEvidenceWhoisPanel" }, "panel_triage": { "$ref": "#/components/schemas/MaliciousSitesTriagePanel" }, "panel_log_v2": { "$ref": "#/components/schemas/PlaybookAlertLogPanelV2" } } }, "MaliciousSitesEvidenceSummaryPanel": { "type": "object", "description": "Summarized data describing the evidence behind the Malicious Sites alert.\n", "properties": { "explanation": { "type": "string", "description": "A brief explanation of why this assessment was made." }, "cause": { "type": "string", "description": "The cause that triggered the alert creation." }, "resolved_record_list": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesResolvedRecord" } }, "reregistration": { "$ref": "#/components/schemas/MaliciousSitesReregistration" }, "suggested_takedown": { "$ref": "#/components/schemas/MaliciousSitesSuggestedTakedown" }, "attackers": { "type": "array", "description": "Attacker domains details.", "items": { "$ref": "#/components/schemas/MaliciousSitesAttacker" } }, "assessments": { "type": "array", "description": "Aggregated Malicious Sites assessments for this alert.", "items": { "$ref": "#/components/schemas/MaliciousSitesAssessment" } } } }, "MaliciousSitesAssessment": { "type": "object", "description": "Malicious Sites assessment", "properties": { "name": { "type": "string", "description": "Assessment title.", "enum": [ "Suggested Takedown", "Phishing/Scam", "Login Form", "High Interest Logo Detection", "Logo Detection", "Screenshot Mention", "Custom Keyword in Screenshot", "Parked / Ad Hosting Website", "Domain for Sale", "Typosquat", "Similar Domain", "Re-Registration", "Active Mail Server", "Review Recommended", "AI Rejected" ] }, "priority": { "$ref": "#/components/schemas/PlaybookAlertPriority" } }, "required": [ "name", "priority" ] }, "MaliciousSitesSuggestedTakedown": { "type": "object", "description": "Suggested takedown assessment details.", "properties": { "has_phishing_verdict": { "type": "boolean" }, "has_high_interest_logo": { "type": "boolean" }, "has_login_form": { "type": "boolean" }, "screenshot": { "type": "string", "description": "Image identity of supporting screenshot evidence.", "example": "img:27368c9c-5bf3-488a-8300-13657f38e37a" } }, "required": [ "has_phishing_verdict", "has_high_interest_logo", "has_login_form" ] }, "MaliciousSitesPhishingVerdict": { "type": "object", "description": "A phishing verdict assessment.", "properties": { "url": { "type": "string", "example": "url:https://malicious.example.com" }, "source": { "type": "string", "description": "Source identity for this verdict." }, "risk_rule_id": { "type": "string", "description": "The risk rule meta-attribute identity." }, "risk_rule_description": { "type": "string", "description": "Description of the risk rule." }, "severity": { "type": "string", "description": "Severity of the phishing verdict.", "enum": [ "unusual", "suspicious", "malicious", "very_malicious" ] }, "brands": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesTargetedBrand" } }, "last_seen": { "type": "string", "format": "date-time" }, "ttps": { "type": "array", "description": "MITRE ATT&CK identifiers, attack vectors, or malware.", "items": { "type": "string" } } }, "required": [ "url", "source", "risk_rule_id", "severity", "brands", "last_seen", "ttps" ] }, "MaliciousSitesTargetedBrand": { "type": "object", "properties": { "brand": { "type": "string", "description": "Entity identity of the targeted brand." }, "mentions": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesHtmlContentMention" } } }, "required": [ "brand" ] }, "MaliciousSitesHtmlContentMention": { "type": "object", "properties": { "source": { "type": "string", "description": "Source type of the mention (e.g. html, text)." }, "value": { "type": "string", "description": "The mentioned value (URL or text)." } }, "required": [ "source", "value" ] }, "MaliciousSitesAttacker": { "type": "object", "description": "Full domain context for a single attacker domain, with all evidence and assessments scoped to that attacker.", "properties": { "attacker": { "type": "string", "description": "The attacker domain identity.", "example": "idn:malicious.example.com" }, "targets": { "type": "array", "description": "Targeted domains for this attacker.", "items": { "type": "string", "example": "idn:example.com" } }, "assets": { "type": "array", "description": "The protected Digital Risk Protection (DRP) assets — drawn from the customer's watch lists — that this attacker matched against (e.g. a watched domain, company, logotype, or search term). Each entry is a subtype of `DrpAsset`.\n", "items": { "$ref": "#/components/schemas/DrpAsset.DrpAsset" } }, "cause": { "$ref": "#/components/schemas/MaliciousSitesCause" }, "malicious_dns_records": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesDnsRecord" } }, "logotypes": { "type": "array", "description": "Logotype items for this attacker.", "items": { "$ref": "#/components/schemas/MaliciousSitesLogotype" } }, "screenshots": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesScreenshot" } }, "reregistration": { "$ref": "#/components/schemas/MaliciousSitesReregistration" }, "screenshot_mentions": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesScreenshotMention" } }, "suggested_takedown": { "$ref": "#/components/schemas/MaliciousSitesSuggestedTakedown" }, "phishing_verdicts": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesPhishingVerdict" } }, "priority": { "type": "string", "description": "Computed priority for this attacker context.", "example": "High" }, "created_at": { "type": "string", "format": "date-time", "description": "When this attacker was first detected." }, "assessments": { "type": "array", "description": "Malicious Sites assessments scoped to this attacker.", "items": { "$ref": "#/components/schemas/MaliciousSitesAssessment" } } }, "required": [ "attacker", "cause", "priority", "created_at" ] }, "MaliciousSitesDnsRecord": { "type": "object", "properties": { "id": { "type": "string", "description": "Entity identity of the DNS record." }, "assessments": { "type": "array", "description": "Malicious Sites assessments associated with the DNS record.", "items": { "$ref": "#/components/schemas/MaliciousSitesAssessment" } }, "date": { "type": "string", "format": "date-time" } } }, "MaliciousSitesLogotype": { "type": "object", "description": "A logotype detected in a screenshot of the attacker domain.", "properties": { "logotype_id": { "type": "string", "description": "Entity identity of the logotype." }, "screenshot_id": { "type": "string", "description": "Image identity of the screenshot containing the logotype." }, "url": { "type": "string", "description": "URL associated with the logotype." }, "screenshot_width": { "type": "integer", "description": "Width of the screenshot in pixels." }, "screenshot_height": { "type": "integer", "description": "Height of the screenshot in pixels." }, "region": { "$ref": "#/components/schemas/MaliciousSitesLogotypeRegion" }, "is_high_interest": { "type": "boolean", "description": "Whether this logotype is considered high interest." } }, "required": [ "logotype_id", "screenshot_id", "url" ] }, "MaliciousSitesLogotypeRegion": { "type": "object", "description": "Bounding box region of the logotype within the screenshot.", "properties": { "min_x": { "type": "integer", "description": "Minimum X coordinate of the bounding box." }, "min_y": { "type": "integer", "description": "Minimum Y coordinate of the bounding box." }, "max_x": { "type": "integer", "description": "Maximum X coordinate of the bounding box." }, "max_y": { "type": "integer", "description": "Maximum Y coordinate of the bounding box." } }, "required": [ "min_x", "min_y", "max_x", "max_y" ] }, "MaliciousSitesScreenshot": { "type": "object", "description": "A screenshot associated with a Malicious Sites alert, including detected logotypes.", "properties": { "description": { "type": "string" }, "image_id": { "type": "string", "description": "Image identity of the screenshot." }, "created": { "type": "string", "format": "date-time", "description": "When the screenshot was taken." }, "availability": { "$ref": "#/components/schemas/ImageAvailability" }, "tag": { "type": "string", "description": "Assessment tag for the screenshot.", "enum": [ "Suggested Takedown", "Phishing/Scam", "Login Form", "High Interest Logo Detection", "Logo Detection", "Screenshot Mention", "Custom Keyword in Screenshot", "Parked / Ad Hosting Website", "Domain for Sale", "Typosquat", "Similar Domain", "Re-Registration", "Active Mail Server" ] }, "logotypes": { "type": "array", "description": "Logotypes detected in this screenshot.", "items": { "$ref": "#/components/schemas/MaliciousSitesLogotype" } } }, "required": [ "description", "image_id", "created", "availability" ] }, "WhoIsAttributeItem": { "type": "object", "properties": { "provider": { "type": "string", "example": "whois" }, "entity": { "type": "string", "example": "idn:mail.google.mail.pl" }, "attribute": { "type": "string", "example": "attr:whois", "enum": [ "attr:whois", "attr:whoisContacts" ] }, "value": { "oneOf": [ { "type": "object", "description": "Attribute value for attr:whois", "not": { "required": [ "type" ] }, "properties": { "status": { "type": "string" }, "registrarName": { "type": "string", "example": "Example Domains, Inc." }, "privateRegistration": { "type": "boolean" }, "nameServers": { "type": "array", "items": { "type": "string", "example": "idn:ns1.example.com" } }, "contactEmail": { "type": "string", "format": "email" }, "createdDate": { "type": "string", "format": "date-time" }, "updatedDate": { "type": "string", "format": "date-time" }, "expiresDate": { "type": "string", "format": "date-time" } } }, { "type": "object", "description": "Attribute value for attr:whoisContacts", "properties": { "type": { "type": "string", "enum": [ "technicalContact", "registrant", "organization", "administrativeContact" ] }, "telephone": { "type": "string" }, "street1": { "type": "string" }, "state": { "type": "string" }, "postalCode": { "type": "string" }, "organization": { "type": "string" }, "name": { "type": "string" }, "fax": { "type": "string" }, "email": { "type": "string" }, "countryCode": { "type": "string" }, "country": { "type": "string" }, "city": { "type": "string" } }, "required": [ "type" ] } ] }, "added": { "type": "string", "format": "date-time" }, "removed": { "type": "string", "format": "date-time" } }, "required": [ "provider", "entity", "attribute", "value" ] }, "DomainAbusePhishingMaliciousBehaviorThreatType": { "type": "string", "description": "A kind of threat present in the domain.", "enum": [ "malware", "unwanted_software", "social_engineering", "social_engineering_extended_coverage" ] }, "MaliciousSitesStatusPanel": { "type": "object", "description": "Data structure containing general information about the Malicious Sites alert and its associated domain (the entity).\n", "properties": { "status": { "$ref": "#/components/schemas/PlaybookAlertStatus" }, "priority": { "$ref": "#/components/schemas/PlaybookAlertPriority" }, "reopen": { "$ref": "#/components/schemas/PlaybookAlertReopenStrategy" }, "assignee_name": { "$ref": "#/components/schemas/PlaybookAlertAssigneeName" }, "assignee_id": { "$ref": "#/components/schemas/PlaybookAlertAssigneeId" }, "created": { "$ref": "#/components/schemas/PlaybookAlertCreated" }, "updated": { "$ref": "#/components/schemas/PlaybookAlertUpdated" }, "case_rule_id": { "$ref": "#/components/schemas/PlaybookAlertCaseRuleId" }, "case_rule_label": { "$ref": "#/components/schemas/PlaybookAlertCaseRuleLabel" }, "alert_rule": { "$ref": "#/components/schemas/PlaybookAlertAlertRule" }, "creator_name": { "$ref": "#/components/schemas/PlaybookAlertCreatorName" }, "creator_id": { "$ref": "#/components/schemas/PlaybookAlertCreatorId" }, "owner_id": { "$ref": "#/components/schemas/PlaybookAlertOwnerId" }, "owner_name": { "$ref": "#/components/schemas/PlaybookAlertOwnerName" }, "organisation_id": { "$ref": "#/components/schemas/PlaybookAlertOrganisationId" }, "organisation_name": { "$ref": "#/components/schemas/PlaybookAlertOrganisationName" }, "owner_organisation_details": { "$ref": "#/components/schemas/PlaybookAlertOwnerOrganisationDetails" }, "entity_id": { "type": "string", "description": "The domain suspected for Malicious Sites", "example": "idn:mail.google.mail.pl" }, "entity_name": { "type": "string", "description": "The domain suspected for Malicious Sites", "example": "mail.google.mail.pl" }, "entity_criticality": { "$ref": "#/components/schemas/PlaybookAlertEntityCriticality" }, "risk_score": { "$ref": "#/components/schemas/PlaybookAlertEntityScore" }, "assessments": { "type": "array", "description": "Malicious Sites assessments associated with the alert entity.", "items": { "$ref": "#/components/schemas/MaliciousSitesAssessment" } }, "targets": { "description": "This is a list of targeted domains.", "type": "array", "items": { "type": "string", "example": "idn:mail.google.mail.pl" } }, "attackers": { "description": "A list of attacking domains grouped in this alert.", "type": "array", "items": { "type": "string", "example": "idn:mail.google.mail.pl" } }, "actions_taken": { "$ref": "#/components/schemas/PlaybookAlertOnwardActionList" } }, "required": [ "status", "priority", "created", "updated", "case_rule_id", "alert_rule", "assessments", "targets", "actions_taken" ] }, "MaliciousSitesEvidenceDnsPanel": { "type": "object", "description": "Detailed DNS data for the Malicious Sites domain.\n", "properties": { "ip_list": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesResolvedRecord" } }, "mx_list": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesResolvedRecord" } }, "ns_list": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesResolvedRecord" } } }, "required": [ "ip_list", "mx_list", "ns_list" ] }, "MaliciousSitesEvidenceWhoisPanel": { "type": "object", "description": "Detailed WHOIS data for the Malicious Sites domain.\n", "properties": { "body": { "type": "array", "items": { "$ref": "#/components/schemas/WhoIsAttributeItem" } } } }, "MaliciousSitesResolvedRecord": { "type": "object", "properties": { "entity": { "type": "string", "description": "Record" }, "risk_score": { "$ref": "#/components/schemas/PlaybookAlertEntityScore" }, "criticality": { "$ref": "#/components/schemas/PlaybookAlertEntityCriticality" }, "record_type": { "type": "string", "description": "The Record Type, ex A, CNAME, MX or similar." }, "assessments": { "type": "array", "description": "Malicious Sites assessments associated with the DNS record.", "items": { "$ref": "#/components/schemas/MaliciousSitesAssessment" } } } }, "MaliciousSitesReregistration": { "type": "object", "properties": { "registrar": { "type": "string" }, "registrar_name": { "type": "string" }, "iana_id": { "type": "integer" }, "expiration": { "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" } } }, "MaliciousSitesScreenshotMention": { "type": "object", "properties": { "url": { "type": "string", "example": "url:https://www.recordedfuture.com" }, "screenshot": { "type": "string", "example": "img:27368c9c-5bf3-488a-8300-13657f38e37a" }, "document": { "type": "string", "example": "doc:3tR0p" }, "analyzed": { "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" }, "mentioned_entities": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesMentionedEntity" } }, "mentioned_custom_keywords": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesMentionedCustomKeyword" } } } }, "MaliciousSitesMentionedEntity": { "type": "object", "properties": { "entity": { "type": "object", "properties": { "id": { "type": "string", "example": "shq4H" }, "name": { "type": "string", "example": "My Test Product" }, "type": { "type": "string", "example": "Product" } }, "required": [ "id" ] }, "reference": { "type": "string", "example": "19GLiq" }, "fragment": { "type": "string" } }, "required": [ "entity", "reference", "fragment" ] }, "MaliciousSitesMentionedCustomKeyword": { "type": "object", "properties": { "keyword": { "type": "string" }, "reference": { "type": "string", "example": "19GLiq" }, "fragment": { "type": "string" } }, "required": [ "keyword", "reference", "fragment" ] }, "MaliciousSitesPanels": { "description": "Request inclusion of detailed Malicious Sites alert data, grouped into a set of panels. If left unset, all panels will be returned.\n", "type": "array", "items": { "type": "string", "enum": [ "status", "action", "summary", "dns", "whois", "triage", "log" ] }, "example": [ "status", "summary", "dns", "whois", "triage", "log" ] }, "PlaybookAlertLogPanelV2": { "type": "array", "description": "Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries.\n", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "uuid:a3c4f8f0-8dd8-4940-8b0a-75a59764d068" }, "author_id": { "$ref": "#/components/schemas/PlaybookAlertAuthorId" }, "author_name": { "$ref": "#/components/schemas/PlaybookAlertAuthorName" }, "created": { "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" }, "changes": { "type": "array", "items": { "oneOf": [ { "$ref": "#/components/schemas/AssigneeChangeV2" }, { "$ref": "#/components/schemas/CustomStatusChange" }, { "$ref": "#/components/schemas/PriorityChange" }, { "$ref": "#/components/schemas/ReopenStrategyChange" }, { "$ref": "#/components/schemas/TitleChange" }, { "$ref": "#/components/schemas/EntitiesChangeV2" }, { "$ref": "#/components/schemas/RelatedEntitiesChangeV2" }, { "$ref": "#/components/schemas/DescriptionChange" }, { "$ref": "#/components/schemas/ExternalIdChange" }, { "$ref": "#/components/schemas/CommentChange" }, { "$ref": "#/components/schemas/ActionChange" }, { "$ref": "#/components/schemas/AssessmentIdsChange" }, { "$ref": "#/components/schemas/CustomOnwardActionsRemovedChange" }, { "$ref": "#/components/schemas/CustomOnwardActionsAddedChange" }, { "$ref": "#/components/schemas/DomainAbuseDnsChangeV2" }, { "$ref": "#/components/schemas/DomainAbuseWhoisChangeV2" }, { "$ref": "#/components/schemas/DomainAbuseLogotypeChangeV2" }, { "$ref": "#/components/schemas/DomainAbuseMaliciousDnsChangeV2" }, { "$ref": "#/components/schemas/DomainAbuseReregistrationChange" }, { "$ref": "#/components/schemas/DomainAbuseMaliciousUrlChange" }, { "$ref": "#/components/schemas/DomainAbuseScreenshotMentionsChange" }, { "$ref": "#/components/schemas/DomainAbusePhishingMaliciousBehaviorChange" }, { "$ref": "#/components/schemas/DomainAbuseAttackerAddedChange" }, { "$ref": "#/components/schemas/DomainAbuseSyncChange" }, { "$ref": "#/components/schemas/MaliciousSitesAttackerAddedChange" }, { "$ref": "#/components/schemas/MaliciousSitesDnsChange" }, { "$ref": "#/components/schemas/MaliciousSitesWhoisChange" }, { "$ref": "#/components/schemas/MaliciousSitesMaliciousDnsChange" }, { "$ref": "#/components/schemas/MaliciousSitesReregistrationChange" }, { "$ref": "#/components/schemas/MaliciousSitesMaliciousUrlChange" }, { "$ref": "#/components/schemas/MaliciousSitesForSaleChange" }, { "$ref": "#/components/schemas/MaliciousSitesParkedChange" }, { "$ref": "#/components/schemas/MaliciousSitesLogoHashChange" }, { "$ref": "#/components/schemas/MaliciousSitesScreenshotMentionChange" }, { "$ref": "#/components/schemas/MaliciousSitesPhishingVerdictChange" }, { "$ref": "#/components/schemas/MaliciousSitesSuggestedTakedownChange" }, { "$ref": "#/components/schemas/MaliciousSitesLogoChange" }, { "$ref": "#/components/schemas/MaliciousSitesTyposquatChange" }, { "$ref": "#/components/schemas/MaliciousSitesSimilarDomainChange" }, { "$ref": "#/components/schemas/MaliciousSitesAiTriageChange" }, { "$ref": "#/components/schemas/MaliciousSitesAlertCreatedChange" }, { "$ref": "#/components/schemas/MaliciousSitesDetectionCreatedChange" }, { "$ref": "#/components/schemas/MaliciousSitesSyncChange" }, { "$ref": "#/components/schemas/VulnerabilityLifecycleChangeV2" }, { "$ref": "#/components/schemas/CodeRepoLeakageEvidenceChangeV2" }, { "$ref": "#/components/schemas/ThirdPartyAssessmentChangeV2" }, { "$ref": "#/components/schemas/ThirdPartyAssessmentChangeV3" }, { "$ref": "#/components/schemas/FacilityEvidenceChange" }, { "$ref": "#/components/schemas/ClusterChangeAdded" } ] } } }, "required": [ "id", "created", "changes" ] } }, "FacilityAssessment": { "type": "object", "description": "Facility assessment data", "properties": { "name": { "type": "string" }, "criticality": { "$ref": "#/components/schemas/PlaybookAlertPriority" } } }, "ClusterChangeAdded": { "type": "object", "description": "Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert.\n", "properties": { "cluster_id": { "type": "string", "example": "GFcEU4FniNM" }, "main_event": { "type": "object", "properties": { "event_id": { "type": "string", "example": "HFCcAAAAAAY" }, "assessments": { "type": "array", "items": { "$ref": "#/components/schemas/FacilityAssessment" } }, "type": { "type": "string", "enum": [ "event_change_added" ] } }, "required": [ "event_id", "type" ] }, "other_event_ids": { "type": "array", "items": { "type": "string", "example": "HFCcAAAAAAY" } }, "type": { "type": "string", "enum": [ "cluster_change_added" ] } }, "required": [ "type" ] }, "FacilityEvidenceChange": { "type": "object", "properties": { "added": { "type": "array", "items": { "$ref": "#/components/schemas/FacilityEvidence" } }, "type": { "type": "string", "enum": [ "evidence_changes" ] } }, "required": [ "added", "type" ] }, "FacilityMainEvent": { "type": "object", "properties": { "event_id": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/components/schemas/FacilityAssessment" } }, "type": { "type": "string", "enum": [ "event_change_added" ] } } }, "FacilityEvidence": { "type": "object", "properties": { "cluster_id": { "type": "string" }, "main_event": { "$ref": "#/components/schemas/FacilityMainEvent" }, "type": { "type": "string", "enum": [ "cluster_change_added" ] }, "other_event_ids": { "type": "array", "items": { "type": "string" } } } }, "Assignee": { "type": "object", "properties": { "id": { "type": "string", "example": "uhash:Ds92mDX" }, "name": { "type": "string", "example": "Marty" } }, "required": [ "id" ] }, "AssigneeChangeV2": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "$ref": "#/components/schemas/Assignee" }, "new": { "$ref": "#/components/schemas/Assignee" }, "type": { "type": "string", "enum": [ "assignee_change" ] } }, "required": [ "type" ] }, "CustomStatusChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string", "example": "New" }, "new": { "type": "string", "example": "InProgress" }, "type": { "type": "string", "enum": [ "status_change" ] }, "actions_taken": { "$ref": "#/components/schemas/PlaybookAlertOnwardActionList" } }, "required": [ "type", "old", "new", "actions_taken" ] }, "CustomOnwardActionsRemovedChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed_actions_taken": { "$ref": "#/components/schemas/PlaybookAlertOnwardActionList" }, "type": { "type": "string", "enum": [ "onward_actions_removed_change" ] } } }, "CustomOnwardActionsAddedChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "added_actions_taken": { "$ref": "#/components/schemas/PlaybookAlertOnwardActionList" }, "type": { "type": "string", "enum": [ "onward_actions_added_change" ] } } }, "PriorityChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string", "example": "Moderate" }, "new": { "type": "string", "example": "High" }, "type": { "type": "string", "enum": [ "priority_change" ] } }, "required": [ "type", "old", "new" ] }, "ReopenStrategyChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string", "example": "SignificantUpdates" }, "new": { "type": "string", "example": "Never" }, "type": { "type": "string", "enum": [ "reopen_strategy_change" ] } }, "required": [ "type" ] }, "TitleChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "title_change" ] } }, "required": [ "type" ] }, "Entity": { "type": "object", "properties": { "id": { "type": "string", "example": "ip:19.158.255.26" }, "type": { "type": "string", "example": "IpAddress" }, "name": { "type": "string", "example": "19.158.255.26" } }, "required": [ "id", "type" ] }, "EntitiesChangeV2": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "$ref": "#/components/schemas/Entity" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/Entity" } }, "type": { "type": "string", "enum": [ "entities_change" ] } }, "required": [ "type", "removed", "added" ] }, "RelatedEntitiesChangeV2": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "$ref": "#/components/schemas/Entity" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/Entity" } }, "type": { "type": "string", "enum": [ "related_entities_change" ] } }, "required": [ "type", "removed", "added" ] }, "DescriptionChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "description_change" ] } }, "required": [ "type" ] }, "ExternalIdChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "external_id_change" ] } }, "required": [ "type" ] }, "CommentChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "comment": { "type": "string" }, "type": { "type": "string", "enum": [ "comment_change" ] } }, "required": [ "type", "comment" ] }, "ActionChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "type": "string", "example": "task:4d65b0f8-8254-402c-8178-4a9f97afc9b2" } }, "added": { "type": "array", "items": { "type": "string", "example": "task:4d65b0f8-8254-402c-8178-4a9f97afc9b2" } }, "type": { "type": "string", "enum": [ "action_change" ] } }, "required": [ "type", "removed", "added" ] }, "AssessmentIdsChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "type": "string", "example": "Active Mail Server" } }, "added": { "type": "array", "items": { "type": "string", "example": "C&C Server" } }, "type": { "type": "string", "enum": [ "assessment_ids_change" ] } }, "required": [ "type" ] }, "DnsRecordV2": { "type": "object", "properties": { "type": { "type": "string", "example": "A" }, "entity": { "$ref": "#/components/schemas/Entity" } } }, "MaliciousDnsRecord": { "type": "object", "properties": { "id": { "type": "string", "example": "ip:51.103.95.227" }, "assessments": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "example": "C&C Server" }, "level": { "type": "number", "example": 3 }, "title": { "type": "string" } }, "required": [ "id", "level" ] } } } }, "WhoisRecordV2": { "type": "object", "properties": { "status": { "type": "string" }, "registrar_name": { "type": "string" }, "private_registration": { "type": "boolean" }, "name_servers": { "type": "array", "items": { "type": "string", "example": "mail.google.mail.pl" } }, "contact_email": { "type": "string", "example": "mail.google.mail.pl" }, "created": { "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" } }, "required": [ "name_servers" ] }, "WhoisContactRecordV2": { "type": "object", "properties": { "type": { "type": "string" }, "telephone": { "type": "string" }, "street1": { "type": "string" }, "state": { "type": "string" }, "postal_code": { "type": "string" }, "organization": { "type": "string" }, "name": { "type": "string" }, "fax": { "type": "string" }, "email": { "type": "string", "example": "mail.google.mail.pl" }, "country_code": { "type": "string" }, "country": { "type": "string" }, "city": { "type": "string" }, "created": { "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" } }, "required": [ "type" ] }, "DomainAbuseDnsChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "mail.google.mail.pl" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/DnsRecordV2" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/DnsRecordV2" } }, "type": { "type": "string", "enum": [ "dns_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "DomainAbuseWhoisChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "mail.google.mail.pl" }, "old_record": { "$ref": "#/components/schemas/WhoisRecordV2" }, "new_record": { "$ref": "#/components/schemas/WhoisRecordV2" }, "removed_contacts": { "type": "array", "items": { "$ref": "#/components/schemas/WhoisContactRecordV2" } }, "added_contacts": { "type": "array", "items": { "$ref": "#/components/schemas/WhoisContactRecordV2" } }, "type": { "type": "string", "enum": [ "whois_change" ] } }, "required": [ "type", "domain", "removed_contacts", "added_contacts" ] }, "LogotypeInScreenshotV2": { "type": "object", "properties": { "logotype_id": { "type": "string", "example": "U3QTi" }, "screenshot_id": { "type": "string", "example": "img:e8581823-7acd-402e-b863-daabda7db9d0" }, "url": { "type": "string", "example": "https://www.recordedfuture.com" }, "screenshot_width": { "type": "integer", "description": "Width of the screenshot in pixels (when available)." }, "screenshot_height": { "type": "integer", "description": "Height of the screenshot in pixels (when available)." }, "region": { "description": "Bounding box of the detected logotype within the screenshot.", "type": "object", "properties": { "min_x": { "type": "integer" }, "min_y": { "type": "integer" }, "max_x": { "type": "integer" }, "max_y": { "type": "integer" } }, "required": [ "min_x", "min_y", "max_x", "max_y" ] }, "is_high_interest": { "type": "boolean", "description": "True if the logotype belongs to a high-interest brand list." } }, "required": [ "logotype_id", "screenshot_id", "url" ] }, "DomainAbuseLogotypeChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "mail.google.mail.pl" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/LogotypeInScreenshotV2" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/LogotypeInScreenshotV2" } }, "type": { "type": "string", "enum": [ "logotype_in_screenshot_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "MaliciousSitesLogoChange": { "type": "object", "description": "This change only applies to Malicious Sites alerts.", "properties": { "domain": { "type": "string", "example": "mail.google.mail.pl" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/LogotypeInScreenshotV2" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/LogotypeInScreenshotV2" } }, "type": { "type": "string", "enum": [ "malicious_sites_logo_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "DomainAbuseMaliciousDnsChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "mail.google.mail.pl" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousDnsRecord" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousDnsRecord" } }, "type": { "type": "string", "enum": [ "malicious_dns_change" ] } }, "required": [ "domain", "type", "removed", "added" ] }, "ReregistrationRecord": { "type": "object", "properties": { "registrar": { "type": "string", "example": "ip:223.12.10.1" }, "registrar_name": { "type": "string", "example": "NameCheap, Inc" }, "iana_id": { "type": "string" }, "expiration": { "type": "string", "format": "date-time", "example": "2026-07-21T00:00:00Z" } } }, "DomainAbuseReregistrationChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "mail.google.mail.pl" }, "removed": { "$ref": "#/components/schemas/ReregistrationRecord" }, "added": { "$ref": "#/components/schemas/ReregistrationRecord" }, "type": { "type": "string", "enum": [ "reregistration_change" ] } }, "required": [ "domain", "type" ] }, "MaliciousUrlRecord": { "type": "object", "properties": { "url": { "type": "string", "example": "https://www.somesite.com" }, "assessments": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentWithSource" } } } }, "DomainAbuseMaliciousUrlChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "recordedfuture.com" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousUrlRecord" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousUrlRecord" } }, "type": { "type": "string", "enum": [ "malicious_url_change" ] } }, "required": [ "domain", "removed", "added", "type" ] }, "DomainAbuseScreenshotMentionsChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "recordedfuture.com" }, "added": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string", "example": "https://www.somesite.com" }, "screenshot_id": { "type": "string", "example": "img:27368c9c-5bf3-488a-8300-13657f38e37a" }, "document": { "type": "string", "example": "Ft6Qt" }, "analyzed": { "type": "string", "format": "date-time", "example": "2023-07-21T00:00:00Z" }, "mentioned_entities": { "type": "array", "items": { "$ref": "#/components/schemas/MentionedEntity" } }, "mentioned_texts": { "type": "array", "items": { "$ref": "#/components/schemas/MentionedText" } } }, "required": [ "url", "screenshot_id", "document", "analyzed", "mentioned_entities" ] } }, "type": { "type": "string", "enum": [ "screenshot_mentions_change" ] } }, "required": [ "domain", "added", "type" ] }, "MentionedEntity": { "type": "object", "properties": { "entity": { "$ref": "#/components/schemas/Entity" }, "reference": { "type": "string", "example": "oIj2a" }, "fragment": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentWithSource" } } }, "required": [ "entity", "reference", "fragment" ] }, "MentionedText": { "type": "object", "properties": { "text": { "type": "string" }, "reference": { "type": "string" }, "fragment": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentWithSource" } } }, "required": [ "text", "reference", "fragment" ] }, "DomainAbusePhishingMaliciousBehaviorChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string", "example": "idn:mail.google.mail.pl" }, "added": { "$ref": "#/components/schemas/DomainAbusePhishingMaliciousBehaviorThreats" }, "removed": { "$ref": "#/components/schemas/DomainAbusePhishingMaliciousBehaviorThreats" }, "type": { "type": "string", "enum": [ "phishing_malicious_behavior_change" ] } }, "required": [ "domain", "added", "type" ] }, "DomainAbusePhishingMaliciousBehaviorThreats": { "type": "object", "properties": { "threat_types": { "type": "array", "items": { "$ref": "#/components/schemas/DomainAbusePhishingMaliciousBehaviorThreatType" } } } }, "DomainAbuseAttackerAddedChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "attacker": { "type": "string", "example": "mail.google.mail.pl" }, "cause": { "$ref": "#/components/schemas/DomainAbuseCause" }, "manual_addition_user_id": { "type": "string", "example": "uhash:40wXmPVONA" }, "manual_addition_user_name": { "type": "string", "example": "User Name" }, "typosquat_targets": { "type": "array", "items": { "type": "string", "example": "google.com" } }, "similar_domains_keywords": { "type": "array", "items": { "type": "string", "example": "*infix*" } }, "type": { "type": "string", "enum": [ "attacker_added_change" ] } }, "required": [ "attacker", "type" ] }, "MaliciousSitesAttackerAddedChange": { "type": "object", "description": "Attacker added change for Malicious Sites alerts.", "properties": { "attacker": { "type": "string", "description": "The attacker domain identity.", "example": "idn:mail.google.mail.pl" }, "cause": { "$ref": "#/components/schemas/MaliciousSitesCause" }, "manual_addition_user_id": { "type": "string", "example": "uhash:40wXmPVONA" }, "manual_addition_user_name": { "type": "string", "example": "User Name" }, "typosquat_targets": { "type": "array", "items": { "type": "string", "example": "idn:google.com" } }, "similar_domains_keywords": { "type": "array", "items": { "type": "string", "example": "*infix*" } }, "logotypes": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesLogotype" } }, "type": { "type": "string", "enum": [ "malicious_sites_attacker_added_change" ] } }, "required": [ "attacker", "type" ] }, "MaliciousSitesDnsChangeRecord": { "type": "object", "properties": { "type": { "type": "string", "example": "A" }, "entity": { "$ref": "#/components/schemas/Entity" } } }, "MaliciousSitesDnsChange": { "type": "object", "description": "DNS change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity.", "example": "idn:mail.google.mail.pl" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesDnsChangeRecord" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesDnsChangeRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_dns_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "MaliciousSitesWhoisRecord": { "type": "object", "properties": { "status": { "type": "string" }, "registrar_name": { "type": "string" }, "private_registration": { "type": "boolean" }, "name_servers": { "type": "array", "items": { "type": "string", "example": "idn:ns1.example.com" } }, "contact_email": { "type": "string", "example": "email:admin@example.com" }, "created": { "type": "string", "format": "date-time" }, "updated": { "type": "string", "format": "date-time" }, "expires": { "type": "string", "format": "date-time" } } }, "MaliciousSitesWhoisContactRecord": { "type": "object", "properties": { "type": { "type": "string" }, "telephone": { "type": "string" }, "street1": { "type": "string" }, "state": { "type": "string" }, "postal_code": { "type": "string" }, "organization": { "type": "string" }, "name": { "type": "string" }, "fax": { "type": "string" }, "email": { "type": "string", "example": "email:admin@example.com" }, "country_code": { "type": "string" }, "country": { "type": "string" }, "city": { "type": "string" }, "created": { "type": "string", "format": "date-time" } } }, "MaliciousSitesWhoisChange": { "type": "object", "description": "Whois change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity.", "example": "idn:mail.google.mail.pl" }, "old_record": { "$ref": "#/components/schemas/MaliciousSitesWhoisRecord" }, "new_record": { "$ref": "#/components/schemas/MaliciousSitesWhoisRecord" }, "removed_contacts": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesWhoisContactRecord" } }, "added_contacts": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesWhoisContactRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_whois_change" ] } }, "required": [ "type", "domain", "removed_contacts", "added_contacts" ] }, "MaliciousSitesMaliciousDnsChange": { "type": "object", "description": "Malicious DNS change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity.", "example": "idn:mail.google.mail.pl" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousDnsRecord" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousDnsRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_malicious_dns_change" ] } }, "required": [ "domain", "type", "removed", "added" ] }, "MaliciousSitesReregistrationChange": { "type": "object", "description": "Reregistration change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity.", "example": "idn:mail.google.mail.pl" }, "removed": { "$ref": "#/components/schemas/ReregistrationRecord" }, "added": { "$ref": "#/components/schemas/ReregistrationRecord" }, "type": { "type": "string", "enum": [ "malicious_sites_reregistration_change" ] } }, "required": [ "domain", "type" ] }, "MaliciousSitesMaliciousUrlRecord": { "type": "object", "properties": { "url": { "type": "string", "description": "The URL identity.", "example": "url:https://www.somesite.com" }, "assessments": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentWithSource" } } } }, "MaliciousSitesMaliciousUrlChange": { "type": "object", "description": "Malicious URL change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity.", "example": "idn:recordedfuture.com" }, "removed": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesMaliciousUrlRecord" } }, "added": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesMaliciousUrlRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_malicious_url_change" ] } }, "required": [ "domain", "removed", "added", "type" ] }, "DomainAbuseCause": { "type": "string", "description": "Domain Abuse attacker detection cause.", "enum": [ "manual", "typosquat", "similar_domains" ] }, "DrpAsset.DrpAsset": { "description": "A protected DRP asset (a oneOf union of asset subtypes). The `type` property selects the concrete subtype.\n", "oneOf": [ { "$ref": "#/components/schemas/DrpAsset.ClientDomain" }, { "$ref": "#/components/schemas/DrpAsset.SimilarDomainTerm" }, { "$ref": "#/components/schemas/DrpAsset.ScreenshotOcrKeyword" }, { "$ref": "#/components/schemas/DrpAsset.CodeRepoKeyword" }, { "$ref": "#/components/schemas/DrpAsset.Logotype" }, { "$ref": "#/components/schemas/DrpAsset.ImageHash" }, { "$ref": "#/components/schemas/DrpAsset.Company" }, { "$ref": "#/components/schemas/DrpAsset.Organization" }, { "$ref": "#/components/schemas/DrpAsset.Product" }, { "$ref": "#/components/schemas/DrpAsset.Executive" } ], "discriminator": { "propertyName": "type", "mapping": { "client_domain": "#/components/schemas/DrpAsset.ClientDomain", "similar_domain_term": "#/components/schemas/DrpAsset.SimilarDomainTerm", "screenshot_ocr_keyword": "#/components/schemas/DrpAsset.ScreenshotOcrKeyword", "code_repo_keyword": "#/components/schemas/DrpAsset.CodeRepoKeyword", "logotype": "#/components/schemas/DrpAsset.Logotype", "image_hash": "#/components/schemas/DrpAsset.ImageHash", "company": "#/components/schemas/DrpAsset.Company", "organization": "#/components/schemas/DrpAsset.Organization", "product": "#/components/schemas/DrpAsset.Product", "executive": "#/components/schemas/DrpAsset.Executive" } } }, "DrpAsset.ClientDomain": { "type": "object", "description": "A domain on the customer's Domain Watch List.", "required": [ "type", "domain_id" ], "properties": { "type": { "type": "string", "enum": [ "client_domain" ] }, "domain_id": { "type": "string", "description": "Identity of the watched domain.", "example": "idn:example.com" } } }, "DrpAsset.Company": { "type": "object", "description": "A company on the customer's Brand Names Watch List.", "required": [ "type", "company_id" ], "properties": { "type": { "type": "string", "enum": [ "company" ] }, "company_id": { "type": "string", "example": "B_t0_" } } }, "DrpAsset.Organization": { "type": "object", "description": "An organization on the customer's Brand Names Watch List.", "required": [ "type", "organization_id" ], "properties": { "type": { "type": "string", "enum": [ "organization" ] }, "organization_id": { "type": "string" } } }, "DrpAsset.Product": { "type": "object", "description": "A product on the customer's Brand Names Watch List.", "required": [ "type", "product_id" ], "properties": { "type": { "type": "string", "enum": [ "product" ] }, "product_id": { "type": "string" } } }, "DrpAsset.Executive": { "type": "object", "description": "A protected executive identity.", "required": [ "type", "executive_id" ], "properties": { "type": { "type": "string", "enum": [ "executive" ] }, "executive_id": { "type": "string" } } }, "DrpAsset.Logotype": { "type": "object", "description": "A watched logotype detected on the attacker domain.", "required": [ "type", "logotype_id" ], "properties": { "type": { "type": "string", "enum": [ "logotype" ] }, "logotype_id": { "type": "string", "example": "iC8hIQ" } } }, "DrpAsset.ImageHash": { "type": "object", "description": "A watched image (logo) hash matched on the attacker domain.", "required": [ "type", "hash_id" ], "properties": { "type": { "type": "string", "enum": [ "image_hash" ] }, "hash_id": { "type": "string", "example": "hash:abc123" } } }, "DrpAsset.SimilarDomainTerm": { "type": "object", "description": "A similar-domain search term.", "required": [ "type", "term" ], "properties": { "type": { "type": "string", "enum": [ "similar_domain_term" ] }, "term": { "$ref": "#/components/schemas/DrpAsset.DrpTerm" } } }, "DrpAsset.ScreenshotOcrKeyword": { "type": "object", "description": "A keyword matched in OCR-extracted screenshot text.", "required": [ "type", "term" ], "properties": { "type": { "type": "string", "enum": [ "screenshot_ocr_keyword" ] }, "term": { "$ref": "#/components/schemas/DrpAsset.DrpTerm" } } }, "DrpAsset.CodeRepoKeyword": { "type": "object", "description": "A keyword used for code-repository matching.", "required": [ "type", "term" ], "properties": { "type": { "type": "string", "enum": [ "code_repo_keyword" ] }, "term": { "$ref": "#/components/schemas/DrpAsset.DrpTerm" } } }, "DrpAsset.DrpTerm": { "description": "A search term used by a DRP asset (a oneOf union of term subtypes). See text search modes (linguistic, exact, substring/pattern). The `type` property selects the subtype.\n", "oneOf": [ { "$ref": "#/components/schemas/DrpAsset.SubstringTerm" }, { "$ref": "#/components/schemas/DrpAsset.LanguageTerm" }, { "$ref": "#/components/schemas/DrpAsset.ExactTerm" }, { "$ref": "#/components/schemas/DrpAsset.FreetextTerm" } ], "discriminator": { "propertyName": "type", "mapping": { "substring": "#/components/schemas/DrpAsset.SubstringTerm", "language": "#/components/schemas/DrpAsset.LanguageTerm", "exact": "#/components/schemas/DrpAsset.ExactTerm", "freetext": "#/components/schemas/DrpAsset.FreetextTerm" } } }, "DrpAsset.SubstringTerm": { "type": "object", "description": "Substring/pattern match, optionally constrained to a specific entity type.", "required": [ "type", "text", "position" ], "properties": { "type": { "type": "string", "enum": [ "substring" ] }, "text": { "type": "string", "description": "The term text to match." }, "position": { "type": "string", "description": "Where the text must occur within the matched value.", "enum": [ "prefix", "infix", "suffix" ] }, "entity_type_id": { "type": "string", "description": "Optional entity type to match against." } } }, "DrpAsset.LanguageTerm": { "type": "object", "description": "Linguistic match that includes other words sharing the same word stem.", "required": [ "type", "text", "language" ], "properties": { "type": { "type": "string", "enum": [ "language" ] }, "text": { "type": "string", "description": "The term text to match." }, "language": { "type": "string", "description": "Language used for stem matching (e.g. `eng`)." } } }, "DrpAsset.ExactTerm": { "type": "object", "description": "Strict exact-text match.", "required": [ "type", "text" ], "properties": { "type": { "type": "string", "enum": [ "exact" ] }, "text": { "type": "string", "description": "The term text to match." } } }, "DrpAsset.FreetextTerm": { "type": "object", "description": "Free-text match.", "required": [ "type", "text" ], "properties": { "type": { "type": "string", "enum": [ "freetext" ] }, "text": { "type": "string", "description": "The term text to match." } } }, "MaliciousSitesCause": { "type": "string", "description": "Malicious Sites attacker detection cause.", "enum": [ "manual", "typosquat", "similar_domains", "logotype", "logotype_high_interest", "phishing_verdict", "screenshot_mention", "screenshot_custom_keyword", "login_form", "suggested_takedown" ] }, "MaliciousSitesForSaleChange": { "type": "object", "description": "Indicates the domain is for sale.", "properties": { "url": { "type": "string", "example": "https://www.somesite.com" }, "image": { "type": "string", "example": "img:e8581823-7acd-402e-b863-daabda7db9d0" }, "type": { "type": "string", "enum": [ "for_sale_change" ] } }, "required": [ "url", "image", "type" ] }, "MaliciousSitesParkedChange": { "type": "object", "description": "Indicates the domain is parked.", "properties": { "url": { "type": "string", "example": "https://www.somesite.com" }, "image": { "type": "string", "example": "img:e8581823-7acd-402e-b863-daabda7db9d0" }, "type": { "type": "string", "enum": [ "parked_change" ] } }, "required": [ "url", "image", "type" ] }, "MaliciousSitesLogoHashChange": { "type": "object", "description": "Indicates logo(s) were detected on a URL via hash matching.", "properties": { "url": { "type": "string", "example": "https://www.somesite.com" }, "scan": { "type": "string", "example": "uuid:a3c4f8f0-8dd8-4940-8b0a-75a59764d068" }, "hashes": { "type": "array", "items": { "type": "string", "example": "hash:abc123" } }, "brands": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "logo_hash_change" ] } }, "required": [ "url", "hashes", "type" ] }, "MaliciousSitesScreenshotMentionChange": { "type": "object", "description": "Indicates mentions found in a screenshot.", "properties": { "url": { "type": "string", "example": "https://www.somesite.com" }, "scan": { "type": "string", "example": "uuid:a3c4f8f0-8dd8-4940-8b0a-75a59764d068" }, "screenshot": { "type": "string", "example": "img:e8581823-7acd-402e-b863-daabda7db9d0" }, "mentions": { "type": "array", "items": { "type": "string" } }, "texts": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "malicious_sites_screenshot_mention_change" ] } }, "required": [ "url", "scan", "screenshot", "mentions", "texts", "type" ] }, "MaliciousSitesPhishingVerdictChange": { "type": "object", "description": "Indicates a phishing verdict was detected.", "properties": { "domain": { "type": "string", "example": "recordedfuture.com" }, "url": { "type": "string", "example": "https://www.somesite.com" }, "risk_rule": { "type": "string", "example": "attr:some-risk-rule" }, "ttps": { "type": "array", "items": { "type": "string" } }, "brands": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "phishing_verdict_change" ] } }, "required": [ "risk_rule", "ttps", "brands", "type" ] }, "MaliciousSitesSuggestedTakedownChange": { "type": "object", "description": "Indicates a takedown is suggested.", "properties": { "has_phishing_verdict": { "type": "boolean" }, "has_high_interest_logo": { "type": "boolean" }, "has_login_form": { "type": "boolean" }, "screenshot": { "type": "string", "example": "img:e8581823-7acd-402e-b863-daabda7db9d0" }, "type": { "type": "string", "enum": [ "suggested_takedown_change" ] } }, "required": [ "has_phishing_verdict", "has_high_interest_logo", "has_login_form", "type" ] }, "AssessmentWithSource": { "type": "object", "properties": { "id": { "type": "string" }, "level": { "type": "number", "example": 3 }, "source": { "$ref": "#/components/schemas/AssessmentSource" }, "title": { "type": "string" } }, "required": [ "id", "level", "source" ] }, "AssessmentSource": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "required": [ "id" ] }, "CodeRepoLeakageAssessmentV2": { "type": "object", "properties": { "id": { "type": "string", "example": "attr:possibleKeyLeak" }, "level": { "type": "number", "example": 3 }, "title": { "type": "string", "example": "Possible Key Leak" }, "text_indicator": { "type": "string", "example": "credential" }, "entity": { "$ref": "#/components/schemas/Entity" } }, "required": [ "id", "level" ] }, "CodeRepoLeakageEvidenceV2": { "type": "object", "properties": { "assessments": { "type": "array", "items": { "$ref": "#/components/schemas/CodeRepoLeakageAssessmentV2" } }, "document": { "type": "object", "properties": { "id": { "type": "string", "example": "doc:rprM_Q" }, "content": { "type": "string" }, "owner_id": { "type": "string", "example": "uhash:40wXmPVONA" }, "owner_name": { "type": "string", "example": "Marty" }, "published": { "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" } }, "required": [ "id", "content", "owner_id", "published" ] }, "target_entities": { "type": "array", "items": { "$ref": "#/components/schemas/Entity" } }, "watch_lists": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "required": [ "id" ] } } }, "required": [ "assessments", "document", "target_entities", "watch_lists" ] }, "CodeRepoLeakageEvidenceChangeV2": { "type": "object", "description": "This change only applies to Data Leakage on Code Repository alerts.", "properties": { "added": { "type": "array", "items": { "$ref": "#/components/schemas/CodeRepoLeakageEvidenceV2" } }, "type": { "type": "string", "enum": [ "evidence_change" ] } }, "required": [ "added", "type" ] }, "ThirdPartyAssessmentChangeV2": { "type": "object", "description": "This change only applies to Third Party Risk alerts.", "properties": { "risk_attribute": { "type": "string", "example": "Recent Attention on Ransomware Extortion Website" }, "added": { "$ref": "#/components/schemas/ThirdPartyRiskEvidenceChangeV2" }, "removed": { "$ref": "#/components/schemas/ThirdPartyRiskEvidenceChangeV2" }, "type": { "type": "string", "enum": [ "tpr_assessment_change" ] } }, "required": [ "risk_attribute", "type" ] }, "ThirdPartyAssessmentChangeV3": { "type": "object", "description": "This change only applies to Third Party Risk alerts.", "properties": { "risk_attribute": { "type": "string", "example": "Cyber Exploit Signal: Important" }, "assessment_name": { "type": "string", "example": "Cyber Trends" }, "added": { "$ref": "#/components/schemas/ThirdPartyRiskEvidenceChangeV2" }, "removed": { "$ref": "#/components/schemas/ThirdPartyRiskEvidenceChangeV2" }, "type": { "type": "string", "enum": [ "assessment_change" ] } }, "required": [ "risk_attribute", "type" ] }, "ThirdPartyRiskEvidenceChangeV2": { "type": "object", "properties": { "level": { "type": "integer", "example": 3 }, "evidence_string": { "type": "string" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-08-14T17:32:28Z" } }, "required": [ "level" ] }, "VulnerabilityAssessment": { "type": "object", "properties": { "id": { "type": "string", "example": "Exploit Likely" }, "level": { "type": "number", "example": 3 }, "title": { "type": "string" } }, "required": [ "id", "level" ] }, "VulnerabilityLifecycleChangeV2": { "type": "object", "description": "This change only applies to Vulnerability alerts.", "properties": { "added": { "$ref": "#/components/schemas/VulnerabilityAssessment" }, "removed": { "$ref": "#/components/schemas/VulnerabilityAssessment" }, "triggered_by_risk_rule": { "type": "object", "properties": { "id": { "type": "string", "example": "riskrule:dc2929d6-5157-43f5-ad4f-d96b7ecf7da9" }, "name": { "type": "string", "example": "c2929d6-5157-43f5-ad4f-d96b7ecf7da9" }, "description": { "type": "string", "example": "Web Reporting Prior to NVD Disclosure" }, "evidence_string": { "type": "string" }, "machine_name": { "type": "string", "enum": [ "recentMalwareActivity", "vendorCritical", "nistCritical", "malwareActivity", "recentPocVerifiedRemote", "historicMalwareActivity", "recentAnalystNote", "vendorHigh", "nistHigh", "recentPocVerified", "vendorMedium", "nistMedium", "recentLikelyExploitDevelopment", "recentScannerUptake", "linkedToRecentExploitKit", "linkedToRecentRAT", "linkedToRecentRansomware", "linkedToRecentIntrusionMethod", "noCvssScore", "pocVerifiedRemote", "recentPocUnverified", "pocVerified", "vendorLow", "nistLow", "likelyExploitDevelopment", "linkedToRecentCyberExploit", "linkedToCyberExploit", "scannerUptake", "linkedToExploitKit", "linkedToRAT", "linkedToRansomware", "linkedToIntrusionMethod", "recentRelatedNote", "analystNote", "relatedNote", "awaitingCvssScore", "pocUnverified", "cyberSignalCritical", "cyberSignalHigh", "cyberSignalMedium" ], "example": "noCvssScore" }, "timestamp": { "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" } }, "required": [ "id" ] }, "type": { "type": "string", "enum": [ "lifecycle_in_cve_change" ] } }, "required": [ "type" ] }, "PlaybookAlertEntityScore": { "type": "integer", "description": "Risk score assigned to the entity", "maximum": 99, "minimum": 0 }, "PlaybookAlertEntityCriticality": { "type": "string", "enum": [ "Low", "Medium", "High", "Critical", "Very Critical" ], "description": "Label indicating risk criticality for the entity" }, "PlaybookAlertPriority": { "type": "string", "enum": [ "High", "Moderate", "Informational" ], "description": "The priority of the Playbook Alert." }, "PlaybookAlertStatus": { "type": "string", "enum": [ "New", "InProgress", "Dismissed", "Resolved" ], "example": "Resolved", "description": "The status of the Playbook Alert." }, "PlaybookAlertReopenStrategy": { "type": "string", "description": "Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved.\n\nThe following combinations of status/reopen are allowed:\n\n* Dismissed -> Never\n* Resolved -> Never\n* Resolved -> SignificantUpdates\n", "enum": [ "Never", "SignificantUpdates" ] }, "PlaybookAlertOwnerId": { "description": "Id of the owner", "type": "string", "example": "uhash:3HX3rIn4Kv", "deprecated": true }, "PlaybookAlertOwnerName": { "description": "Name of the owner", "type": "string", "example": "Recorded Future", "deprecated": true }, "PlaybookAlertOrganisationId": { "description": "Id of the Organisation", "type": "string", "example": "uhash:3HX3rIn4Kv", "deprecated": true }, "PlaybookAlertOrganisationName": { "description": "Name of the Organisation", "type": "string", "example": "Recorded Future", "deprecated": true }, "PlaybookAlertOrganisationId2": { "description": "Id of the Organisation", "type": "string", "example": "uhash:3HX3rIn4Kv" }, "PlaybookAlertOrganisationName2": { "description": "Name of the Organisation", "type": "string", "example": "Recorded Future" }, "PlaybookAlertEnterpriseId": { "description": "Id of the Enterprise", "type": "string", "example": "uhash:1HX2qIn4Zy" }, "PlaybookAlertEnterpriseName": { "description": "Name of the Enterprise", "type": "string", "example": "Recorded Future" }, "PlaybookAlertAssigneeId": { "description": "ID of the assignee", "type": "string", "example": "uhash:40wXmPVONA" }, "PlaybookAlertAssigneeName": { "description": "Full name of the assignee", "type": "string", "example": "Marty McFly" }, "PlaybookAlertCreatorId": { "description": "Id of the Creator of the Playbook Alert", "type": "string", "example": "uhash:40wXmPVONA" }, "PlaybookAlertCreatorName": { "description": "Full name of the Creator of the Playbook Alert", "type": "string", "example": "Marty McFly" }, "PlaybookAlertCaseRuleId": { "description": "The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field)", "deprecated": true, "type": "string" }, "PlaybookAlertCaseRuleLabel": { "description": "The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user.\n (Deprecated, use 'alertRule.label' field)\n", "deprecated": true, "type": "string", "enum": [ "Domain Abuse", "Malicious Sites", "Cyber Vulnerability", "Data Leakage on Code Repository", "Compromised Bank Check", "Geopolitics Facility", "Novel Identity Exposure", "Third Party Risk", "Malware Report", "Dark Web Brand", "Social Media Impersonation" ] }, "PlaybookAlertRuleId": { "description": "The Rule ID that created the Playbook Alert (without the 'report:' prefix)", "type": "string" }, "PlaybookAlertRuleLabel": { "description": "The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing.\n", "type": "string", "enum": [ "DomainAbuse", "MaliciousSites", "CyberVulnerability", "DataLeakageOnCodeRepository", "CompromisedBankCheck", "GeopoliticsFacility", "NovelIdentityExposure", "ThirdPartyRisk", "MalwareReport", "DarkWebBrand", "SocmedImpersonation", "Undefined" ] }, "PlaybookAlertRuleName": { "description": "The Rule name (if defined) that created the Playbook Alert", "type": "string" }, "PlaybookAlertCreated": { "description": "The Creation time of the Playbook Alert", "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" }, "PlaybookAlertUpdated": { "description": "The Update time of the Playbook Alert", "type": "string", "format": "date-time", "example": "2023-07-21T17:32:28Z" }, "PlaybookAlertAuthorId": { "description": "Id of the author", "type": "string", "example": "uhash:40wXmPVONA" }, "PlaybookAlertAuthorName": { "description": "Full name of the author", "type": "string", "example": "Marty McFly" }, "ImageAvailability": { "type": "string", "description": "Image availability status", "enum": [ "Available", "NotFound", "NotDownloaded", "FlaggedForReview", "NotAvailableForLegalReasons", "ScanCompletedAsPositive" ] }, "PlaybookAlertOrganisation": { "type": "object", "properties": { "organisation_id": { "$ref": "#/components/schemas/PlaybookAlertOrganisationId2" }, "organisation_name": { "$ref": "#/components/schemas/PlaybookAlertOrganisationName2" } } }, "PlaybookAlertOwnerOrganisationDetails": { "type": "object", "properties": { "organisations": { "type": "array", "items": { "$ref": "#/components/schemas/PlaybookAlertOrganisation" } }, "enterprise_id": { "$ref": "#/components/schemas/PlaybookAlertEnterpriseId" }, "enterprise_name": { "$ref": "#/components/schemas/PlaybookAlertEnterpriseName" } } }, "PlaybookAlertAlertRule": { "type": "object", "properties": { "id": { "$ref": "#/components/schemas/PlaybookAlertRuleId" }, "label": { "$ref": "#/components/schemas/PlaybookAlertRuleLabel" }, "name": { "$ref": "#/components/schemas/PlaybookAlertRuleName" } }, "required": [ "id", "label" ] }, "PlaybookAlertOnwardActionList": { "type": "array", "items": { "$ref": "#/components/schemas/OnwardActionId" }, "example": [ "cyber_vulnerability.patched", "brand_mentions_on_code_repository.keys_rotated", "domain_abuse.takedown", "malicious_sites.takedown", "third_party_risk.vendor_mitigated_findings", "identity_novel_exposures.enforced_password_reset" ] }, "OnwardActionId": { "type": "string", "description": "The id for the type of action taken. The possible values can be found in the response from metadata/common in actions_by_category field. The action ids possible can grow over time\n" }, "DomainAbuseSyncChange": { "type": "object", "description": "The alert's assessments were re-synchronised.", "properties": { "domain": { "type": "string", "description": "The domain whose assessments were synchronised.", "example": "idn:mail.google.mail.pl" }, "assessments_before": { "type": "array", "description": "Assessment ids held before the synchronisation.", "items": { "type": "string", "example": "attr:loginForm" } }, "assessments_after": { "type": "array", "description": "Assessment ids held after the synchronisation.", "items": { "type": "string", "example": "case.domain_abuse.assessment.parkedOrAdHostingDomain" } }, "type": { "type": "string", "enum": [ "domain_abuse_sync_change" ] } }, "required": [ "domain", "assessments_before", "assessments_after", "type" ] }, "MaliciousSitesAiTriageChange": { "type": "object", "description": "Indicates an AI triage produced a verdict for the alert, carrying the resulting assessment, the model's rationale, and the scans it analyzed.\n", "properties": { "triage_id": { "type": "string", "description": "Identifier of the triage run that produced this verdict.", "example": "3f2504e0-4f89-41d3-9a0c-0305e82c3301" }, "analyzed_scans": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesAnalyzedScan" } }, "assessment": { "$ref": "#/components/schemas/MaliciousSitesAssessment" }, "rationale": { "type": "string", "description": "The model's free-text explanation for the verdict." }, "type": { "type": "string", "enum": [ "malicious_sites_ai_triage_change" ] } }, "required": [ "triage_id", "type" ] }, "MaliciousSitesAlertCreatedChange": { "type": "object", "description": "Indicates the alert was created for an attacker.", "properties": { "attacker": { "type": "string", "description": "The attacker domain identity.", "example": "idn:mail.google.mail.pl" }, "type": { "type": "string", "enum": [ "malicious_sites_alert_created_change" ] } }, "required": [ "attacker", "type" ] }, "MaliciousSitesAnalyzedScan": { "type": "object", "description": "A screenshot and the URL it was captured from, analyzed by the AI triage.", "properties": { "image": { "type": "string", "description": "The analyzed screenshot image identity.", "example": "img:e8581823-7acd-402e-b863-daabda7db9d0" }, "url": { "type": "string", "description": "The URL the screenshot was captured from.", "example": "url:https://paypa1-login.com/" } } }, "MaliciousSitesDetectionCreatedChange": { "type": "object", "description": "Indicates a detection was created for an attacker.", "properties": { "attacker": { "type": "string", "description": "The attacker domain identity.", "example": "idn:mail.google.mail.pl" }, "detection_id": { "type": "string", "description": "Identifier of the detection that was created.", "example": "e8689e1f-cd0b-bb1e-64bc-2eb4ebaccb65" }, "date": { "type": "string", "format": "date-time", "description": "When the detection was created." }, "type": { "type": "string", "enum": [ "malicious_sites_detection_created_change" ] } }, "required": [ "attacker", "detection_id", "date", "type" ] }, "MaliciousSitesMatchPathElement": { "type": "object", "description": "One element of a match path.", "properties": { "attribute": { "type": "string", "description": "The attribute linking this element to the previous one.", "example": "attr:typoTyposquatTarget" }, "entities": { "type": "array", "items": { "type": "string", "description": "Entity identity.", "example": "idn:paypal.com" } } }, "required": [ "attribute", "entities" ] }, "MaliciousSitesSimilarDomainChange": { "type": "object", "description": "Indicates the attacker domain was detected as similar to the customer's watched keywords. Carries all matched keyword terms.\n", "properties": { "domain": { "type": "string", "description": "The attacker domain identity.", "example": "idn:paypa1-login.com" }, "substring_terms": { "type": "array", "items": { "$ref": "#/components/schemas/DrpAsset.SubstringTerm" } }, "type": { "type": "string", "enum": [ "malicious_sites_similar_domain_change" ] } }, "required": [ "domain", "substring_terms", "type" ] }, "MaliciousSitesSyncChange": { "type": "object", "description": "The alert's assessments were re-synchronised from its underlying detection. This change only applies to Malicious Sites alerts.\n", "properties": { "domain": { "type": "string", "description": "The domain whose assessments were synchronised.", "example": "idn:mail.google.mail.pl" }, "assessments_before": { "type": "array", "description": "Assessment ids held before the synchronisation.", "items": { "type": "string", "example": "alias:case.category.malicious_website.assessment.login_form" } }, "assessments_after": { "type": "array", "description": "Assessment ids held after the synchronisation.", "items": { "type": "string", "example": "alias:case.category.malicious_website.assessment.suggested_takedown" } }, "type": { "type": "string", "enum": [ "malicious_sites_sync_change" ] } }, "required": [ "domain", "assessments_before", "assessments_after", "type" ] }, "MaliciousSitesTriagePanel": { "type": "object", "description": "The current AI-triage verdict for the alert: the resulting assessment, the model's rationale, and the scans it analyzed.\n", "properties": { "triage_id": { "type": "string", "description": "Identifier of the triage run that produced this verdict.", "example": "3f2504e0-4f89-41d3-9a0c-0305e82c3301" }, "assessment": { "$ref": "#/components/schemas/MaliciousSitesAssessment" }, "rationale": { "type": "string", "description": "The model's free-text explanation for the verdict." }, "analyzed_scans": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesAnalyzedScan" } }, "date": { "type": "string", "format": "date-time", "description": "When the triage verdict was produced." } }, "required": [ "triage_id" ] }, "MaliciousSitesTyposquatChange": { "type": "object", "description": "Indicates the attacker domain was detected as a typosquat of the customer's watched domains. Carries all matched target domains, each with the match paths explaining the detection.\n", "properties": { "domain": { "type": "string", "description": "The attacker domain identity.", "example": "idn:paypa1.com" }, "targets": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesTyposquatTarget" } }, "type": { "type": "string", "enum": [ "malicious_sites_typosquat_change" ] } }, "required": [ "domain", "targets", "type" ] }, "MaliciousSitesTyposquatTarget": { "type": "object", "description": "A watched domain the attacker was matched against.", "properties": { "target": { "type": "string", "description": "The watched target domain identity.", "example": "idn:paypal.com" }, "match_paths": { "type": "array", "description": "Match paths explaining the detection. Each path is a chain of elements from the attacker to the monitored asset.\n", "items": { "type": "array", "items": { "$ref": "#/components/schemas/MaliciousSitesMatchPathElement" } } } }, "required": [ "target" ] } }, "securitySchemes": { "ApiKeyAuth": { "description": "API Credential", "type": "apiKey", "in": "header", "name": "X-RFToken" }, "idp": { "description": "Click on \"Authorize\" to be redirected to the login page.", "type": "oauth2", "flows": { "authorizationCode": { "authorizationUrl": "https://id.recordedfuture.com/authorize", "tokenUrl": "https://id.recordedfuture.com/token", "refreshUrl": "https://id.recordedfuture.com/token", "scopes": {} } } } } } } ``` # Sibling pages * [Playbook Alerts: Malicious Sites Bulk](https://docs.recordedfuture.com/reference/post_malicious-sites.md) * [Playbook Alerts: Malicious Sites Screenshot](https://docs.recordedfuture.com/reference/get_malicious-sites-playbook-alert-id-image-image-id.md) * [Playbook Alerts: Malicious Sites Create](https://docs.recordedfuture.com/reference/post_malicious-sites-create.md) # What’s Next * [Bulk Malicious Sites alert lookup](https://docs.recordedfuture.com/reference/post_malicious-sites.md)