RErecordedfuture
Common

Search for Playbook Alerts

Searches for Playbook Alerts based on filtering conditions supplied in the body. Not specifying a filter for a property means the filter will match a Playbook Alert regardless of the property's value. Only Playbook Alerts matching all specified criteria are included in the response.

post/search

Request

  • Base URL
    https://api.recordedfuture.com/playbook-alert
  • URL
    https://api.recordedfuture.com/playbook-alert/search
  • Auth
    • API key in header X-RFToken
    • or OAuth 2
      Authorization code: https://id.recordedfuture.com/authorize
      Token URL: https://id.recordedfuture.com/token

Request body

frominteger

Pagination offset, show items from this index and onwards. From + limit cannot exceed 10 000. This field cannot be used together with 'offset' field. This field is deprecated, use 'offset' and 'next_offset' fields to paginate search results instead.

limitinteger

Pagination limit, show items up to this limit. From + limit cannot exceed 10 000.

order_by'created' | 'modified'

Order results by created or modified data.

direction'asc' | 'desc'

Order results ascending or descending.

entitystring[]

Entity of the alert (ID). For Domain Abuse alerts the entity is the attacker domain and for Vulnerability Alerts the entity is the CVE.

statusesPlaybookAlertStatus[]

Return Playbook Alerts with this status. Valid statuses can be listed in /metadata/common. If omitted or empty, all statuses will be selected.

priorityPlaybookAlertPriority[]

Return Playbook Alerts with this priority. Valid priorities can be listed in /metadata/common. If omitted or empty, all priorities will be selected.

categoryPlaybookAlertCategory[]

Return Playbook Alerts with this category. Valid categories can be listed in /metadata/common. If omitted or empty, all categories will be selected.

assigneestring[]

Return Playbook Alerts with this assignee. Valid assignees can be listed in /metadata/assignees. If omitted or empty, no filtering will be done on assignee.

organisationstring[]

Return Playbook Alerts with either of the organisations as owner. If omitted or empty, no filtering will be done on organisations.

offsetstring

Allows pagination by using next_offset from previous search response. Cannot be used together with 'from' field.

Example request

{
  "limit": 100,
  "entity": [
    "idn:mail.google.mail.pl"
  ],
  "statuses": [
    "Resolved"
  ],
  "assignee": [
    "uhash:40wXmPVONA"
  ],
  "created_range": {
    "from": "2023-07-21T17:32:28Z",
    "until": "2023-07-21T17:32:28Z"
  },
  "updated_range": {
    "from": "2023-07-21T17:32:28Z",
    "until": "2023-07-21T17:32:28Z"
  },
  "organisation": [
    "uhash:40wXmPVONA"
  ],
  "offset": "eyJvZmZzZXQiOlswLCJzaDAwNSJdfQ=="
}

Response

Paginated list of Playbook Alerts matching the search criteria

next_offsetstring

Pagination parameter to be used as 'offset' in the next search request

Example response

{
  "status": {
    "status_code": "Ok",
    "status_message": "Ok"
  },
  "data": [
    {
      "status": "Resolved",
      "created": "2023-07-21T17:32:28Z",
      "updated": "2023-07-21T17:32:28Z",
      "title": "mail.google.mail.pl",
      "assignee_name": "Marty McFly",
      "assignee_id": "uhash:40wXmPVONA",
      "owner_id": "uhash:3HX3rIn4Kv",
      "owner_name": "Recorded Future",
      "organisation_id": "uhash:3HX3rIn4Kv",
      "organisation_name": "Recorded Future",
      "owner_organisation_details": {
        "organisations": [
          {
            "organisation_id": "uhash:3HX3rIn4Kv",
            "organisation_name": "Recorded Future"
          }
        ],
        "enterprise_id": "uhash:1HX2qIn4Zy",
        "enterprise_name": "Recorded Future"
      },
      "actions_taken": [
        "cyber_vulnerability.patched",
        "brand_mentions_on_code_repository.keys_rotated",
        "domain_abuse.takedown",
        "malicious_sites.takedown",
        "third_party_risk.vendor_mitigated_findings",
        "identity_novel_exposures.enforced_password_reset"
      ]
    }
  ],
  "counts": {
    "returned": 1,
    "total": 1
  },
  "next_offset": "eyJvZmZzZXQiOlswLCJzaDAwNSJdfQ=="
}

Changes

No recorded changes to this operation across all 1 revision of this API.