--- title: "Playbook Alerts: Malicious Sites Detail" method: POST path: "/malicious_sites/{playbook_alert_id}" tags: ["Malicious Sites"] --- # Playbook Alerts: Malicious Sites Detail `POST /malicious_sites/{playbook_alert_id}` ## Request - Base URL: `https://api.recordedfuture.com/playbook-alert` - URL: `https://api.recordedfuture.com/playbook-alert/malicious_sites/{playbook_alert_id}` - Auth: one of: - API key in header `X-RFToken` - OAuth 2 - Authorization code: `https://id.recordedfuture.com/authorize` - Token URL: `https://id.recordedfuture.com/token` Retrieve detailed information about a Malicious Sites Playbook Alert with data grouped into UI-ready panels. ## Path parameters - `playbook_alert_id` string, required ## Request body - object - `panels` string[]: Request inclusion of detailed Malicious Sites alert data, grouped into a set of panels. If left unset, all panels will be returned. ## Response `200` Data for the requested panels. - object - `status` PlaybookAlertStatusResponse - `status_code` 'Ok' | 'Error': Status describing the result of the request. - `status_message` string: Text describing the status, suitable for displaying an error. - `data` MaliciousSitesResponse - `playbook_alert_id` string, required - `panel_status` MaliciousSitesStatusPanel: Data structure containing general information about the Malicious Sites alert and its associated domain (the entity). - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required: The status of the Playbook Alert. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `reopen` 'Never' | 'SignificantUpdates': Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates - `assignee_name` string: Full name of the assignee - `assignee_id` string: ID of the assignee - `created` string, date-time, required: The Creation time of the Playbook Alert - `updated` string, date-time, required: The Update time of the Playbook Alert - `case_rule_id` string, required: The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field) - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' | 'Dark Web Brand' | 'Social Media Impersonation': The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field) - `alert_rule` PlaybookAlertAlertRule, required - `id` string, required: The Rule ID that created the Playbook Alert (without the 'report:' prefix) - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'DarkWebBrand' | 'SocmedImpersonation' | 'Undefined', required: The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing. - `name` string: The Rule name (if defined) that created the Playbook Alert - `creator_name` string: Full name of the Creator of the Playbook Alert - `creator_id` string: Id of the Creator of the Playbook Alert - `owner_id` string: Id of the owner - `owner_name` string: Name of the owner - `organisation_id` string: Id of the Organisation - `organisation_name` string: Name of the Organisation - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails - `organisations` PlaybookAlertOrganisation[] - `organisation_id` string: Id of the Organisation - `organisation_name` string: Name of the Organisation - `enterprise_id` string: Id of the Enterprise - `enterprise_name` string: Name of the Enterprise - `entity_id` string: The domain suspected for Malicious Sites - `entity_name` string: The domain suspected for Malicious Sites - `entity_criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical': Label indicating risk criticality for the entity - `risk_score` integer: Risk score assigned to the entity - `assessments` MaliciousSitesAssessment[], required: Malicious Sites assessments associated with the alert entity. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `targets` string[], required: This is a list of targeted domains. - `attackers` string[]: A list of attacking domains grouped in this alert. - `actions_taken` OnwardActionId[], required - `panel_evidence_summary` MaliciousSitesEvidenceSummaryPanel: Summarized data describing the evidence behind the Malicious Sites alert. - `explanation` string: A brief explanation of why this assessment was made. - `cause` string: The cause that triggered the alert creation. - `resolved_record_list` MaliciousSitesResolvedRecord[] - `entity` string: Record - `risk_score` integer: Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical': Label indicating risk criticality for the entity - `record_type` string: The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[]: Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `reregistration` MaliciousSitesReregistration - `registrar` string - `registrar_name` string - `iana_id` integer - `expiration` string, date-time - `suggested_takedown` MaliciousSitesSuggestedTakedown: Suggested takedown assessment details. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string: Image identity of supporting screenshot evidence. - `attackers` MaliciousSitesAttacker[]: Attacker domains details. - `attacker` string, required: The attacker domain identity. - `targets` string[]: Targeted domains for this attacker. - `assets` DrpAssetDrpAsset[]: The protected Digital Risk Protection (DRP) assets — drawn from the customer's watch lists — that this attacker matched against (e.g. a watched domain, company, logotype, or search term). Each entry is a subtype of `DrpAsset`. - union: A protected DRP asset (a oneOf union of asset subtypes). The `type` property selects the concrete subtype. - DrpAssetClientDomain: A domain on the customer's Domain Watch List. - … - DrpAssetSimilarDomainTerm: A similar-domain search term. - … - DrpAssetScreenshotOcrKeyword: A keyword matched in OCR-extracted screenshot text. - … - DrpAssetCodeRepoKeyword: A keyword used for code-repository matching. - … - DrpAssetLogotype: A watched logotype detected on the attacker domain. - … - DrpAssetImageHash: A watched image (logo) hash matched on the attacker domain. - … - DrpAssetCompany: A company on the customer's Brand Names Watch List. - … - DrpAssetOrganization: An organization on the customer's Brand Names Watch List. - … - DrpAssetProduct: A product on the customer's Brand Names Watch List. - … - DrpAssetExecutive: A protected executive identity. - … - `cause` 'manual' | 'typosquat' | 'similar_domains' | 'logotype' | 'logotype_high_interest' | 'phishing_verdict' | 'screenshot_mention' | 'screenshot_custom_keyword' | 'login_form' | 'suggested_takedown', required: Malicious Sites attacker detection cause. - `malicious_dns_records` MaliciousSitesDnsRecord[] - `id` string: Entity identity of the DNS record. - `assessments` MaliciousSitesAssessment[]: Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `date` string, date-time - `logotypes` MaliciousSitesLogotype[]: Logotype items for this attacker. - `logotype_id` string, required: Entity identity of the logotype. - `screenshot_id` string, required: Image identity of the screenshot containing the logotype. - `url` string, required: URL associated with the logotype. - `screenshot_width` integer: Width of the screenshot in pixels. - `screenshot_height` integer: Height of the screenshot in pixels. - `region` MaliciousSitesLogotypeRegion: Bounding box region of the logotype within the screenshot. - `min_x` integer, required: Minimum X coordinate of the bounding box. - `min_y` integer, required: Minimum Y coordinate of the bounding box. - `max_x` integer, required: Maximum X coordinate of the bounding box. - `max_y` integer, required: Maximum Y coordinate of the bounding box. - `is_high_interest` boolean: Whether this logotype is considered high interest. - `screenshots` MaliciousSitesScreenshot[] - `description` string, required - `image_id` string, required: Image identity of the screenshot. - `created` string, date-time, required: When the screenshot was taken. - `availability` 'Available' | 'NotFound' | 'NotDownloaded' | 'FlaggedForReview' | 'NotAvailableForLegalReasons' | 'ScanCompletedAsPositive', required: Image availability status - `tag` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server': Assessment tag for the screenshot. - `logotypes` MaliciousSitesLogotype[]: Logotypes detected in this screenshot. - `logotype_id` string, required: Entity identity of the logotype. - `screenshot_id` string, required: Image identity of the screenshot containing the logotype. - `url` string, required: URL associated with the logotype. - `screenshot_width` integer: Width of the screenshot in pixels. - `screenshot_height` integer: Height of the screenshot in pixels. - `region` MaliciousSitesLogotypeRegion: Bounding box region of the logotype within the screenshot. - … - `is_high_interest` boolean: Whether this logotype is considered high interest. - `reregistration` MaliciousSitesReregistration - `registrar` string - `registrar_name` string - `iana_id` integer - `expiration` string, date-time - `screenshot_mentions` MaliciousSitesScreenshotMention[] - `url` string - `screenshot` string - `document` string - `analyzed` string, date-time - `mentioned_entities` MaliciousSitesMentionedEntity[] - `entity` object, required - … - `reference` string, required - `fragment` string, required - `mentioned_custom_keywords` MaliciousSitesMentionedCustomKeyword[] - `keyword` string, required - `reference` string, required - `fragment` string, required - `suggested_takedown` MaliciousSitesSuggestedTakedown: Suggested takedown assessment details. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string: Image identity of supporting screenshot evidence. - `phishing_verdicts` MaliciousSitesPhishingVerdict[] - `url` string, required - `source` string, required: Source identity for this verdict. - `risk_rule_id` string, required: The risk rule meta-attribute identity. - `risk_rule_description` string: Description of the risk rule. - `severity` 'unusual' | 'suspicious' | 'malicious' | 'very_malicious', required: Severity of the phishing verdict. - `brands` MaliciousSitesTargetedBrand[], required - `brand` string, required: Entity identity of the targeted brand. - `mentions` MaliciousSitesHtmlContentMention[] - … - `last_seen` string, date-time, required - `ttps` string[], required: MITRE ATT&CK identifiers, attack vectors, or malware. - `priority` string, required: Computed priority for this attacker context. - `created_at` string, date-time, required: When this attacker was first detected. - `assessments` MaliciousSitesAssessment[]: Malicious Sites assessments scoped to this attacker. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `assessments` MaliciousSitesAssessment[]: Aggregated Malicious Sites assessments for this alert. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `panel_evidence_dns` MaliciousSitesEvidenceDnsPanel: Detailed DNS data for the Malicious Sites domain. - `ip_list` MaliciousSitesResolvedRecord[], required - `entity` string: Record - `risk_score` integer: Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical': Label indicating risk criticality for the entity - `record_type` string: The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[]: Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `mx_list` MaliciousSitesResolvedRecord[], required - `entity` string: Record - `risk_score` integer: Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical': Label indicating risk criticality for the entity - `record_type` string: The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[]: Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `ns_list` MaliciousSitesResolvedRecord[], required - `entity` string: Record - `risk_score` integer: Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical': Label indicating risk criticality for the entity - `record_type` string: The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[]: Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `panel_evidence_whois` MaliciousSitesEvidenceWhoisPanel: Detailed WHOIS data for the Malicious Sites domain. - `body` WhoIsAttributeItem[] - `provider` string, required - `entity` string, required - `attribute` 'attr:whois' | 'attr:whoisContacts', required - `value` object, required: Attribute value for attr:whoisContacts - `type` 'technicalContact' | 'registrant' | 'organization' | 'administrativeContact', required - `telephone` string - `street1` string - `state` string - `postalCode` string - `organization` string - `name` string - `fax` string - `email` string - `countryCode` string - `country` string - `city` string - `added` string, date-time - `removed` string, date-time - `panel_triage` MaliciousSitesTriagePanel: The current AI-triage verdict for the alert: the resulting assessment, the model's rationale, and the scans it analyzed. - `triage_id` string, required: Identifier of the triage run that produced this verdict. - `assessment` MaliciousSitesAssessment: Malicious Sites assessment - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' | 'Review Recommended' | 'AI Rejected', required: Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `rationale` string: The model's free-text explanation for the verdict. - `analyzed_scans` MaliciousSitesAnalyzedScan[] - `image` string: The analyzed screenshot image identity. - `url` string: The URL the screenshot was captured from. - `date` string, date-time: When the triage verdict was produced. - `panel_log_v2` object[]: Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. - `id` string, required - `author_id` string: Id of the author - `author_name` string: Full name of the author - `created` string, date-time, required - `changes` union[], required - union - AssigneeChangeV2: This change applies to any alert type. - `old` Assignee - … - `new` Assignee - … - `type` 'assignee_change', required - CustomStatusChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `actions_taken` OnwardActionId[], required - PriorityChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - ReopenStrategyChange: This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - TitleChange: This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - EntitiesChangeV2: This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'entities_change', required - RelatedEntitiesChangeV2: This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'related_entities_change', required - DescriptionChange: This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - ExternalIdChange: This change applies to any alert type. - `old` string - `new` string - `type` 'external_id_change', required - CommentChange: This change applies to any alert type. - `comment` string, required - `type` 'comment_change', required - ActionChange: This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - AssessmentIdsChange: This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - CustomOnwardActionsRemovedChange: This change applies to any alert type. - `removed_actions_taken` OnwardActionId[] - `type` 'onward_actions_removed_change' - CustomOnwardActionsAddedChange: This change applies to any alert type. - `added_actions_taken` OnwardActionId[] - `type` 'onward_actions_added_change' - DomainAbuseDnsChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` DnsRecordV2[], required - … - `added` DnsRecordV2[], required - … - `type` 'dns_change', required - DomainAbuseWhoisChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `old_record` WhoisRecordV2 - … - `new_record` WhoisRecordV2 - … - `removed_contacts` WhoisContactRecordV2[], required - … - `added_contacts` WhoisContactRecordV2[], required - … - `type` 'whois_change', required - DomainAbuseLogotypeChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'logotype_in_screenshot_change', required - DomainAbuseMaliciousDnsChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_dns_change', required - DomainAbuseReregistrationChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'reregistration_change', required - DomainAbuseMaliciousUrlChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousUrlRecord[], required - … - `added` MaliciousUrlRecord[], required - … - `type` 'malicious_url_change', required - DomainAbuseScreenshotMentionsChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `added` object[], required - … - `type` 'screenshot_mentions_change', required - DomainAbusePhishingMaliciousBehaviorChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `added` DomainAbusePhishingMaliciousBehaviorThreats, required - … - `removed` DomainAbusePhishingMaliciousBehaviorThreats - … - `type` 'phishing_malicious_behavior_change', required - DomainAbuseAttackerAddedChange: This change only applies to Domain Abuse alerts. - `attacker` string, required - `cause` 'manual' | 'typosquat' | 'similar_domains': Domain Abuse attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `type` 'attacker_added_change', required - DomainAbuseSyncChange: The alert's assessments were re-synchronised. - `domain` string, required: The domain whose assessments were synchronised. - `assessments_before` string[], required: Assessment ids held before the synchronisation. - `assessments_after` string[], required: Assessment ids held after the synchronisation. - `type` 'domain_abuse_sync_change', required - MaliciousSitesAttackerAddedChange: Attacker added change for Malicious Sites alerts. - `attacker` string, required: The attacker domain identity. - `cause` 'manual' | 'typosquat' | 'similar_domains' | 'logotype' | 'logotype_high_interest' | 'phishing_verdict' | 'screenshot_mention' | 'screenshot_custom_keyword' | 'login_form' | 'suggested_takedown': Malicious Sites attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `logotypes` MaliciousSitesLogotype[] - … - `type` 'malicious_sites_attacker_added_change', required - MaliciousSitesDnsChange: DNS change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` MaliciousSitesDnsChangeRecord[], required - … - `added` MaliciousSitesDnsChangeRecord[], required - … - `type` 'malicious_sites_dns_change', required - MaliciousSitesWhoisChange: Whois change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `old_record` MaliciousSitesWhoisRecord - … - `new_record` MaliciousSitesWhoisRecord - … - `removed_contacts` MaliciousSitesWhoisContactRecord[], required - … - `added_contacts` MaliciousSitesWhoisContactRecord[], required - … - `type` 'malicious_sites_whois_change', required - MaliciousSitesMaliciousDnsChange: Malicious DNS change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_sites_malicious_dns_change', required - MaliciousSitesReregistrationChange: Reregistration change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'malicious_sites_reregistration_change', required - MaliciousSitesMaliciousUrlChange: Malicious URL change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` MaliciousSitesMaliciousUrlRecord[], required - … - `added` MaliciousSitesMaliciousUrlRecord[], required - … - `type` 'malicious_sites_malicious_url_change', required - MaliciousSitesForSaleChange: Indicates the domain is for sale. - `url` string, required - `image` string, required - `type` 'for_sale_change', required - MaliciousSitesParkedChange: Indicates the domain is parked. - `url` string, required - `image` string, required - `type` 'parked_change', required - MaliciousSitesLogoHashChange: Indicates logo(s) were detected on a URL via hash matching. - `url` string, required - `scan` string - `hashes` string[], required - `brands` string[] - `type` 'logo_hash_change', required - MaliciousSitesScreenshotMentionChange: Indicates mentions found in a screenshot. - `url` string, required - `scan` string, required - `screenshot` string, required - `mentions` string[], required - `texts` string[], required - `type` 'malicious_sites_screenshot_mention_change', required - MaliciousSitesPhishingVerdictChange: Indicates a phishing verdict was detected. - `domain` string - `url` string - `risk_rule` string, required - `ttps` string[], required - `brands` string[], required - `type` 'phishing_verdict_change', required - MaliciousSitesSuggestedTakedownChange: Indicates a takedown is suggested. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string - `type` 'suggested_takedown_change', required - MaliciousSitesLogoChange: This change only applies to Malicious Sites alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'malicious_sites_logo_change', required - MaliciousSitesTyposquatChange: Indicates the attacker domain was detected as a typosquat of the customer's watched domains. Carries all matched target domains, each with the match paths explaining the detection. - `domain` string, required: The attacker domain identity. - `targets` MaliciousSitesTyposquatTarget[], required - … - `type` 'malicious_sites_typosquat_change', required - MaliciousSitesSimilarDomainChange: Indicates the attacker domain was detected as similar to the customer's watched keywords. Carries all matched keyword terms. - `domain` string, required: The attacker domain identity. - `substring_terms` DrpAssetSubstringTerm[], required - … - `type` 'malicious_sites_similar_domain_change', required - MaliciousSitesAiTriageChange: Indicates an AI triage produced a verdict for the alert, carrying the resulting assessment, the model's rationale, and the scans it analyzed. - `triage_id` string, required: Identifier of the triage run that produced this verdict. - `analyzed_scans` MaliciousSitesAnalyzedScan[] - … - `assessment` MaliciousSitesAssessment: Malicious Sites assessment - … - `rationale` string: The model's free-text explanation for the verdict. - `type` 'malicious_sites_ai_triage_change', required - MaliciousSitesAlertCreatedChange: Indicates the alert was created for an attacker. - `attacker` string, required: The attacker domain identity. - `type` 'malicious_sites_alert_created_change', required - MaliciousSitesDetectionCreatedChange: Indicates a detection was created for an attacker. - `attacker` string, required: The attacker domain identity. - `detection_id` string, required: Identifier of the detection that was created. - `date` string, date-time, required: When the detection was created. - `type` 'malicious_sites_detection_created_change', required - MaliciousSitesSyncChange: The alert's assessments were re-synchronised from its underlying detection. This change only applies to Malicious Sites alerts. - `domain` string, required: The domain whose assessments were synchronised. - `assessments_before` string[], required: Assessment ids held before the synchronisation. - `assessments_after` string[], required: Assessment ids held after the synchronisation. - `type` 'malicious_sites_sync_change', required - VulnerabilityLifecycleChangeV2: This change only applies to Vulnerability alerts. - `added` VulnerabilityAssessment - … - `removed` VulnerabilityAssessment - … - `triggered_by_risk_rule` object - … - `type` 'lifecycle_in_cve_change', required - CodeRepoLeakageEvidenceChangeV2: This change only applies to Data Leakage on Code Repository alerts. - `added` CodeRepoLeakageEvidenceV2[], required - … - `type` 'evidence_change', required - ThirdPartyAssessmentChangeV2: This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'tpr_assessment_change', required - ThirdPartyAssessmentChangeV3: This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `assessment_name` string - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'assessment_change', required - FacilityEvidenceChange - `added` FacilityEvidence[], required - … - `type` 'evidence_changes', required - ClusterChangeAdded: Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert. - `cluster_id` string - `main_event` object - … - `other_event_ids` string[] - `type` 'cluster_change_added', required --- [API](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/revisions/604701d2ce52?raw)