--- title: "Detailed Vulnerability alert data" method: POST path: "/vulnerability/{playbook_alert_id}" tags: ["Vulnerability"] --- # Detailed Vulnerability alert data `POST /vulnerability/{playbook_alert_id}` ## Request - Base URL: `https://api.recordedfuture.com/playbook-alert` - URL: `https://api.recordedfuture.com/playbook-alert/vulnerability/{playbook_alert_id}` - Auth: one of: - API key in header `X-RFToken` - OAuth 2 - Authorization code: `https://id.recordedfuture.com/authorize` - Token URL: `https://id.recordedfuture.com/token` Retrieve detailed information about a Vulnerability Playbook Alert with data grouped into UI-ready panels. ## Path parameters - `playbook_alert_id` string, required ## Request body - object - `panels` string[]: Request inclusion of detailed alert data, grouped into a set of panels. If left unset, all panels will be returned. ## Response `200` Data for the requested panels. - object - `status` PlaybookAlertStatusResponse - `status_code` 'Ok' | 'Error': Status describing the result of the request. - `status_message` string: Text describing the status, suitable for displaying an error. - `data` VulnerabilityResponse - `playbook_alert_id` string, required - `panel_status` VulnerabilityStatusPanel: Data structure containing general information about the alert and it's associated vulnerability (the entity). - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required: The status of the Playbook Alert. - `priority` 'High' | 'Moderate' | 'Informational', required: The priority of the Playbook Alert. - `reopen` 'Never' | 'SignificantUpdates': Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates - `assignee_name` string: Full name of the assignee - `assignee_id` string: ID of the assignee - `created` string, date-time, required: The Creation time of the Playbook Alert - `updated` string, date-time, required: The Update time of the Playbook Alert - `case_rule_id` string, required: The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field) - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' | 'Dark Web Brand' | 'Social Media Impersonation': The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field) - `alert_rule` PlaybookAlertAlertRule, required - `id` string, required: The Rule ID that created the Playbook Alert (without the 'report:' prefix) - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'DarkWebBrand' | 'SocmedImpersonation' | 'Undefined', required: The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing. - `name` string: The Rule name (if defined) that created the Playbook Alert - `creator_name` string: Full name of the Creator of the Playbook Alert - `creator_id` string: Id of the Creator of the Playbook Alert - `owner_id` string: Id of the owner - `owner_name` string: Name of the owner - `organisation_id` string: Id of the Organisation - `organisation_name` string: Name of the Organisation - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails - `organisations` PlaybookAlertOrganisation[] - `organisation_id` string: Id of the Organisation - `organisation_name` string: Name of the Organisation - `enterprise_id` string: Id of the Enterprise - `enterprise_name` string: Name of the Enterprise - `entity_id` string: The CVE related to the Vulnerability - `entity_name` string: The CVE related to the Vulnerability - `entity_criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical': Label indicating risk criticality for the entity - `risk_score` integer: Risk score assigned to the entity - `lifecycle_stage` 'Exploited' | 'Exploit Likely' | 'Proof of Concept' | 'Disclosure': The current lifecycle stage of the Playbook Alert - `targets` ResolvedEntity[], required: Targets affected by the vulnerability, based on watchlists - `name` string, required - `actions_taken` OnwardActionId[], required - `panel_evidence_summary` VulnerabilityEvidenceSummaryPanel: Summarized data describing the evidence behind the alert. - `summary` VulnerabilitySummary, required - `targets` ResolvedEntity[]: Targets affected by the vulnerability, based on watchlists - `name` string, required - `lifecycle_stage` 'Exploited' | 'Exploit Likely' | 'Proof of Concept' | 'Disclosure': The current lifecycle stage of the Playbook Alert - `risk_rules` VulnerabilityRiskRule[]: A list of triggered risk rules for this vulnerability. - `rule` string - `description` string - `affected_products` VulnerabilityAffectedProduct[], required: Detailed list of affected products - `name` string - `insikt_notes` InsiktNote[], required: Note by the Insikt research team pertaining to the vulnerability. - `id` string, required - `title` string - `published` string, date-time - `topic` string - `fragment` string: A fragment of the Insikt note text - `panel_log` object[]: Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. This version is deprecated and will be removed completely in future updates. - `id` string - `actor_name` string: Full name of the author - `actor_id` string: Id of the author - `created` string, date-time - `modified` string, date-time - `action_priority` 'High' | 'Moderate' | 'Informational': The priority of the Playbook Alert. - `message` string: Log message - `changes` PlaybookAlertLogPanelChanges - `assignee_change` AssigneeChange - `old` string - `new` string - `type` 'assignee_change', required - `status_change` StatusChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `priority_change` PriorityChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - `reopen_strategy_change` ReopenStrategyChange: This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - `title_change` TitleChange: This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - `entities_change` EntitiesChange - `removed` string[] - `added` string[] - `type` 'entities_change', required - `related_entities_change` RelatedEntitiesChange - `removed` string[] - `added` string[] - `type` 'related_entities_change', required - `description_change` DescriptionChange: This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - `external_id_change` ExternalIdChange: This change applies to any alert type. - `old` string - `new` string - `type` 'external_id_change', required - `actions_change` ActionChange: This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - `assessment_ids_change` AssessmentIdsChange: This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - `context` union - DomainAbuseChangeContext - `type` 'domain_abuse', required - `changes` union[], required - union - … - VulnerabilityChangeContext - `type` 'cyber_vulnerability', required - `changes` union[], required - union - … - CodeRepoLeakageChangeContext - `type` 'code_repo_leakage', required - `changes` union[], required - union - … - ThirdPartyRiskChangeContext - `type` 'third_party_risk', required - `changes` union[], required - union - … - FacilityRiskChangeContext - `type` 'geopolitics_facility', required - `changes` union[], required - union - … - `panel_log_v2` object[]: Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. - `id` string, required - `author_id` string: Id of the author - `author_name` string: Full name of the author - `created` string, date-time, required - `changes` union[], required - union - AssigneeChangeV2: This change applies to any alert type. - `old` Assignee - … - `new` Assignee - … - `type` 'assignee_change', required - CustomStatusChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `actions_taken` OnwardActionId[], required - PriorityChange: This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - ReopenStrategyChange: This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - TitleChange: This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - EntitiesChangeV2: This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'entities_change', required - RelatedEntitiesChangeV2: This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'related_entities_change', required - DescriptionChange: This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - ExternalIdChange: This change applies to any alert type. - `old` string - `new` string - `type` 'external_id_change', required - CommentChange: This change applies to any alert type. - `comment` string, required - `type` 'comment_change', required - ActionChange: This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - AssessmentIdsChange: This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - CustomOnwardActionsRemovedChange: This change applies to any alert type. - `removed_actions_taken` OnwardActionId[] - `type` 'onward_actions_removed_change' - CustomOnwardActionsAddedChange: This change applies to any alert type. - `added_actions_taken` OnwardActionId[] - `type` 'onward_actions_added_change' - DomainAbuseDnsChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` DnsRecordV2[], required - … - `added` DnsRecordV2[], required - … - `type` 'dns_change', required - DomainAbuseWhoisChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `old_record` WhoisRecordV2 - … - `new_record` WhoisRecordV2 - … - `removed_contacts` WhoisContactRecordV2[], required - … - `added_contacts` WhoisContactRecordV2[], required - … - `type` 'whois_change', required - DomainAbuseLogotypeChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'logotype_in_screenshot_change', required - DomainAbuseMaliciousDnsChangeV2: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_dns_change', required - DomainAbuseReregistrationChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'reregistration_change', required - DomainAbuseMaliciousUrlChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousUrlRecord[], required - … - `added` MaliciousUrlRecord[], required - … - `type` 'malicious_url_change', required - DomainAbuseScreenshotMentionsChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `added` object[], required - … - `type` 'screenshot_mentions_change', required - DomainAbusePhishingMaliciousBehaviorChange: This change only applies to Domain Abuse alerts. - `domain` string, required - `added` DomainAbusePhishingMaliciousBehaviorThreats, required - … - `removed` DomainAbusePhishingMaliciousBehaviorThreats - … - `type` 'phishing_malicious_behavior_change', required - DomainAbuseAttackerAddedChange: This change only applies to Domain Abuse alerts. - `attacker` string, required - `cause` 'manual' | 'typosquat' | 'similar_domains': Domain Abuse attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `type` 'attacker_added_change', required - DomainAbuseSyncChange: The alert's assessments were re-synchronised. - `domain` string, required: The domain whose assessments were synchronised. - `assessments_before` string[], required: Assessment ids held before the synchronisation. - `assessments_after` string[], required: Assessment ids held after the synchronisation. - `type` 'domain_abuse_sync_change', required - MaliciousSitesAttackerAddedChange: Attacker added change for Malicious Sites alerts. - `attacker` string, required: The attacker domain identity. - `cause` 'manual' | 'typosquat' | 'similar_domains' | 'logotype' | 'logotype_high_interest' | 'phishing_verdict' | 'screenshot_mention' | 'screenshot_custom_keyword' | 'login_form' | 'suggested_takedown': Malicious Sites attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `logotypes` MaliciousSitesLogotype[] - … - `type` 'malicious_sites_attacker_added_change', required - MaliciousSitesDnsChange: DNS change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` MaliciousSitesDnsChangeRecord[], required - … - `added` MaliciousSitesDnsChangeRecord[], required - … - `type` 'malicious_sites_dns_change', required - MaliciousSitesWhoisChange: Whois change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `old_record` MaliciousSitesWhoisRecord - … - `new_record` MaliciousSitesWhoisRecord - … - `removed_contacts` MaliciousSitesWhoisContactRecord[], required - … - `added_contacts` MaliciousSitesWhoisContactRecord[], required - … - `type` 'malicious_sites_whois_change', required - MaliciousSitesMaliciousDnsChange: Malicious DNS change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_sites_malicious_dns_change', required - MaliciousSitesReregistrationChange: Reregistration change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'malicious_sites_reregistration_change', required - MaliciousSitesMaliciousUrlChange: Malicious URL change for Malicious Sites alerts. - `domain` string, required: The domain identity. - `removed` MaliciousSitesMaliciousUrlRecord[], required - … - `added` MaliciousSitesMaliciousUrlRecord[], required - … - `type` 'malicious_sites_malicious_url_change', required - MaliciousSitesForSaleChange: Indicates the domain is for sale. - `url` string, required - `image` string, required - `type` 'for_sale_change', required - MaliciousSitesParkedChange: Indicates the domain is parked. - `url` string, required - `image` string, required - `type` 'parked_change', required - MaliciousSitesLogoHashChange: Indicates logo(s) were detected on a URL via hash matching. - `url` string, required - `scan` string - `hashes` string[], required - `brands` string[] - `type` 'logo_hash_change', required - MaliciousSitesScreenshotMentionChange: Indicates mentions found in a screenshot. - `url` string, required - `scan` string, required - `screenshot` string, required - `mentions` string[], required - `texts` string[], required - `type` 'malicious_sites_screenshot_mention_change', required - MaliciousSitesPhishingVerdictChange: Indicates a phishing verdict was detected. - `domain` string - `url` string - `risk_rule` string, required - `ttps` string[], required - `brands` string[], required - `type` 'phishing_verdict_change', required - MaliciousSitesSuggestedTakedownChange: Indicates a takedown is suggested. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string - `type` 'suggested_takedown_change', required - MaliciousSitesLogoChange: This change only applies to Malicious Sites alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'malicious_sites_logo_change', required - MaliciousSitesTyposquatChange: Indicates the attacker domain was detected as a typosquat of the customer's watched domains. Carries all matched target domains, each with the match paths explaining the detection. - `domain` string, required: The attacker domain identity. - `targets` MaliciousSitesTyposquatTarget[], required - … - `type` 'malicious_sites_typosquat_change', required - MaliciousSitesSimilarDomainChange: Indicates the attacker domain was detected as similar to the customer's watched keywords. Carries all matched keyword terms. - `domain` string, required: The attacker domain identity. - `substring_terms` DrpAssetSubstringTerm[], required - … - `type` 'malicious_sites_similar_domain_change', required - MaliciousSitesAiTriageChange: Indicates an AI triage produced a verdict for the alert, carrying the resulting assessment, the model's rationale, and the scans it analyzed. - `triage_id` string, required: Identifier of the triage run that produced this verdict. - `analyzed_scans` MaliciousSitesAnalyzedScan[] - … - `assessment` MaliciousSitesAssessment: Malicious Sites assessment - … - `rationale` string: The model's free-text explanation for the verdict. - `type` 'malicious_sites_ai_triage_change', required - MaliciousSitesAlertCreatedChange: Indicates the alert was created for an attacker. - `attacker` string, required: The attacker domain identity. - `type` 'malicious_sites_alert_created_change', required - MaliciousSitesDetectionCreatedChange: Indicates a detection was created for an attacker. - `attacker` string, required: The attacker domain identity. - `detection_id` string, required: Identifier of the detection that was created. - `date` string, date-time, required: When the detection was created. - `type` 'malicious_sites_detection_created_change', required - MaliciousSitesSyncChange: The alert's assessments were re-synchronised from its underlying detection. This change only applies to Malicious Sites alerts. - `domain` string, required: The domain whose assessments were synchronised. - `assessments_before` string[], required: Assessment ids held before the synchronisation. - `assessments_after` string[], required: Assessment ids held after the synchronisation. - `type` 'malicious_sites_sync_change', required - VulnerabilityLifecycleChangeV2: This change only applies to Vulnerability alerts. - `added` VulnerabilityAssessment - … - `removed` VulnerabilityAssessment - … - `triggered_by_risk_rule` object - … - `type` 'lifecycle_in_cve_change', required - CodeRepoLeakageEvidenceChangeV2: This change only applies to Data Leakage on Code Repository alerts. - `added` CodeRepoLeakageEvidenceV2[], required - … - `type` 'evidence_change', required - ThirdPartyAssessmentChangeV2: This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'tpr_assessment_change', required - ThirdPartyAssessmentChangeV3: This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `assessment_name` string - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'assessment_change', required - FacilityEvidenceChange - `added` FacilityEvidence[], required - … - `type` 'evidence_changes', required - ClusterChangeAdded: Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert. - `cluster_id` string - `main_event` object - … - `other_event_ids` string[] - `type` 'cluster_change_added', required --- [API](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts.md) - [All operations](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/recorded-future-playbook-alerts/revisions/604701d2ce52?raw)