---
title: "Playbook Alerts: Malicious Sites Create"
method: POST
path: "/malicious_sites/create"
tags: ["Malicious Sites"]
---

# Playbook Alerts: Malicious Sites Create

`POST /malicious_sites/create`

## Request

- Base URL: `https://api.recordedfuture.com/playbook-alert`
- URL: `https://api.recordedfuture.com/playbook-alert/malicious_sites/create`
- Auth: one of:
  - API key in header `X-RFToken`
  - OAuth 2
    - Authorization code: `https://id.recordedfuture.com/authorize`
    - Token URL: `https://id.recordedfuture.com/token`

Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause `manual` and the creator is taken from the authenticated request.

If the attacker matches the main attacker of an existing alert, the attacker is added to that alert instead of creating a new one.

Provide exactly one of `rule` or `organization` to select the use case configuration the alert is created under.

## Request body

- union
  - object
    - `attacker` string, required: The attacker domain to create the alert for.
    - `rule` string, required: The id of the alert rule (use case configuration) to create the alert under. Provide either `rule` or `organization`.
    - `organization` string: The id of the organization whose Malicious Sites use case configuration the alert is created under. Provide either `rule` or `organization`.
    - `options` MaliciousSitesCreateOptions: Optional overrides applied to the created Malicious Sites alert.
      - `targets` string[]: Domains or other entities that are related to this alert.
      - `assignee` string: The assignee of the alert. Defaults to the assignee in the alert rule.
      - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved': The status of the Playbook Alert.
      - `priority` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert.
      - `description` string: Optional free-text description of the alert.
  - object
    - `attacker` string, required: The attacker domain to create the alert for.
    - `rule` string: The id of the alert rule (use case configuration) to create the alert under. Provide either `rule` or `organization`.
    - `organization` string, required: The id of the organization whose Malicious Sites use case configuration the alert is created under. Provide either `rule` or `organization`.
    - `options` MaliciousSitesCreateOptions: Optional overrides applied to the created Malicious Sites alert.
      - `targets` string[]: Domains or other entities that are related to this alert.
      - `assignee` string: The assignee of the alert. Defaults to the assignee in the alert rule.
      - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved': The status of the Playbook Alert.
      - `priority` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert.
      - `description` string: Optional free-text description of the alert.

## Response `200`

The Malicious Sites alert was created or extended, or the alert already exists.

- object
  - `status` PlaybookAlertStatusResponse
    - `status_code` 'Ok' | 'Error': Status describing the result of the request.
    - `status_message` string: Text describing the status, suitable for displaying an error.
  - `outcome` 'alert_created' | 'attacker_added' | 'already_tracked'
  - `playbook_alert_id` string: The id of the created or matched Playbook Alert.

---

[API](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/revisions/604701d2ce52?raw)