What this endpoint does

Returns the available risk context categories used by the SOAR triage and enrichment endpoints. Risk contexts represent specific threat use cases — currently malware (potential infections), phishing (phishing events), and c2 (command and control communications). Each context has a default score threshold that the SOAR: Triage Batch endpoint uses to produce automated verdicts, and a mapping of which indicator types (IP, domain, URL, vulnerability) are evaluated under that context. Call this endpoint to discover available contexts before using the SOAR: Triage Batch endpoint, or to understand the context sub-scores returned by the SOAR: Enrich endpoint.

Response data

Returns an object keyed by context identifier (malware, phishing, c2), where each entry includes the context's display name, a description of the threat use case, the default verdict threshold (a score from 0-100 above which indicators are considered risky), the threshold algorithm type, and a datagroup mapping showing which indicator types are supported and how many risk rules can trigger for each type within that context.