--- title: "Search for Playbook Alerts" method: POST path: "/search" tags: ["Common"] --- # Search for Playbook Alerts `POST /search` ## Request - Base URL: `https://api.recordedfuture.com/playbook-alert` - URL: `https://api.recordedfuture.com/playbook-alert/search` - Auth: one of: - API key in header `X-RFToken` - OAuth 2 - Authorization code: `https://id.recordedfuture.com/authorize` - Token URL: `https://id.recordedfuture.com/token` Searches for Playbook Alerts based on filtering conditions supplied in the body. Not specifying a filter for a property means the filter will match a Playbook Alert regardless of the property's value. Only Playbook Alerts matching all specified criteria are included in the response. ## Request body - object - `from` integer: Pagination offset, show items from this index and onwards. From + limit cannot exceed 10 000. This field cannot be used together with 'offset' field. This field is deprecated, use 'offset' and 'next_offset' fields to paginate search results instead. - `limit` integer: Pagination limit, show items up to this limit. From + limit cannot exceed 10 000. - `order_by` 'created' | 'modified': Order results by created or modified data. - `direction` 'asc' | 'desc': Order results ascending or descending. - `entity` string[]: Entity of the alert (ID). For Domain Abuse alerts the entity is the attacker domain and for Vulnerability Alerts the entity is the CVE. - `statuses` PlaybookAlertStatus[]: Return Playbook Alerts with this status. Valid statuses can be listed in /metadata/common. If omitted or empty, all statuses will be selected. - `priority` PlaybookAlertPriority[]: Return Playbook Alerts with this priority. Valid priorities can be listed in /metadata/common. If omitted or empty, all priorities will be selected. - `category` PlaybookAlertCategory[]: Return Playbook Alerts with this category. Valid categories can be listed in /metadata/common. If omitted or empty, all categories will be selected. - `assignee` string[]: Return Playbook Alerts with this assignee. Valid assignees can be listed in /metadata/assignees. If omitted or empty, no filtering will be done on assignee. - `created_range` TimeRange: Time range - `from` string, date-time: At or after this point in time. - `until` string, date-time: Before or at this point in time. - `updated_range` TimeRange: Time range - `from` string, date-time: At or after this point in time. - `until` string, date-time: Before or at this point in time. - `organisation` string[]: Return Playbook Alerts with either of the organisations as owner. If omitted or empty, no filtering will be done on organisations. - `offset` string: Allows pagination by using `next_offset` from previous search response. Cannot be used together with 'from' field. ## Response `200` Paginated list of Playbook Alerts matching the search criteria - SearchResponse - `status` PlaybookAlertStatusResponse - `status_code` 'Ok' | 'Error': Status describing the result of the request. - `status_message` string: Text describing the status, suitable for displaying an error. - `data` PlaybookAlertPreview[] - `playbook_alert_id` string, required: Unique ID of the Playbook Alert - `rule_id` string, required: Unique ID of the Playbook Rule that generated this Playbook Alert. This field is deprecated, use 'alert_rule.id' instead. - `alert_rule` PlaybookAlertAlertRule, required - `id` string, required: The Rule ID that created the Playbook Alert (without the 'report:' prefix) - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'DarkWebBrand' | 'SocmedImpersonation' | 'Undefined', required: The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing. - `name` string: The Rule name (if defined) that created the Playbook Alert - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required: The status of the Playbook Alert. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `reopen` 'Never' | 'SignificantUpdates': Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates - `created` string, date-time, required: The Creation time of the Playbook Alert - `updated` string, date-time, required: The Update time of the Playbook Alert - `category` 'domain_abuse' | 'malicious_sites' | 'cyber_vulnerability' | 'code_repo_leakage' | 'third_party_risk' | 'identity_novel_exposures' | 'geopolitics_facility' | 'dark_web' | 'socmed_impersonation', required - `title` string: The title of the Playbook Alert. This field can be filled in several ways: 1. If there is one entity linked to the alert then title will be a name of this entity. 2. If there is multiple entities linked to the alert then title will be a name of the first entity plus number of not shown entities in format " +N". 3. If no entity then it will be a title of the alert itself. 4. If there is no alert title then title will be just empty. - `assignee_name` string: Full name of the assignee - `assignee_id` string: ID of the assignee - `owner_id` string, required: Id of the owner - `owner_name` string, required: Name of the owner - `organisation_id` string, required: Id of the Organisation - `organisation_name` string, required: Name of the Organisation - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails, required - `organisations` PlaybookAlertOrganisation[] - `organisation_id` string: Id of the Organisation - `organisation_name` string: Name of the Organisation - `enterprise_id` string: Id of the Enterprise - `enterprise_name` string: Name of the Enterprise - `actions_taken` OnwardActionId[], required - `counts` object - `returned` integer - `total` number - `next_offset` string: Pagination parameter to be used as 'offset' in the next search request --- [API](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/revisions/604701d2ce52?raw)