What this endpoint does

Returns configuration for the three SOAR risk contexts: malware, phishing, and c2. Call this to discover default score thresholds, threshold types, and supported indicator types before using SOAR: Triage Batch. The object keys (malware, phishing, c2) — not the nested name display strings — are the values to pass as {context_name} in the triage batch URL.

Response data

Returns the scoring configuration that drives automated triage verdicts — essentially the playbook settings for each threat category. Each context defines what "malicious" means for that use case: the default threshold score an indicator must exceed, whether the threshold applies as a minimum or maximum across the batch, and which indicator types are evaluated for that context (e.g., the c2 context scores IPs, URLs, and domains but not hashes or vulnerabilities — any unsupported types submitted to triage will not contribute to the verdict). Use these defaults as starting points and override them with threshold and threshold_type query parameters in the triage endpoint when your security policy requires different sensitivity levels.

200output