---
title: "Triage multiple IOC entities"
method: POST
path: "/triage/contexts/{context_name}"
tags: ["Soar"]
---

# Triage multiple IOC entities

`POST /triage/contexts/{context_name}`

## Request

- Base URL: `https://api.recordedfuture.com/soar/v3`
- URL: `https://api.recordedfuture.com/soar/v3/triage/contexts/{context_name}`
- Auth: API key in header `X-RFToken`

Evaluate up to 1,000 indicators against a specific risk context (malware, phishing, or c2) and return a boolean verdict based on context-specific sub-scores.

## Path parameters

- `context_name` string, required

## Query parameters

- `format` 'phantom'
- `metadata` boolean
- `threshold` integer
- `threshold_type` 'min' | 'max'

## Request body

- EnrichRequest: Entities to be enriched, grouped by type up to a total of 1000 IOCs.
  - `ip` string[]: IPs to enrich
  - `domain` string[]: Domains to enrich
  - `url` string[]: URLs to enrich
  - `hash` string[]: Hashes to enrich
  - `vulnerability` string[]: Vulnerabilities to enrich
  - `companybydomain` string[]: Companies to enrich, identified by their domain name.

## Response `200`

output

- TriageResponse: Triage results with automated verdicts for submitted entities based on configured risk thresholds.
  - `data` TriageResponseData, required: Data wrapper containing triage verdicts and enrichment results.
    - `triage` TriageData: Automated triage verdict for an entity based on risk threshold evaluation.
      - `threshold_type` 'min' | 'max'
      - `context` string
      - `verdict` boolean
      - `threshold` integer: Default value depends on the context
      - `scores` object
        - `min` integer
        - `max` integer
    - `results` object[]: Individual enrichment result for a single entity.
      - `risk` object, required
        - `score` number, required: Overall risk score for this entity (0-99).
        - `level` number, required: Risk level category (0=None, 1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
        - `context` object, required: Risk context data keyed by context name (e.g., phishing, c2, malware, public). Each key represents a risk context use case.
        - `rule` object, required: Aggregate risk rule data for this entity across all contexts.
          - `summary` object[]: Summary of triggered rules grouped by severity level.
            - `level` number, required: Severity level (1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
            - `count` number, required: Number of rules triggered at this severity level.
          - `mostCritical` string: Name of the most critical (highest severity) rule triggered.
          - `count` integer, required: Total number of risk rules triggered for this entity.
          - `maxCount` integer, required: Maximum number of risk rules available for this entity type.
          - `evidence` object: Evidence data keyed by rule identifier (e.g., spamSiteDetected, historicalThreatListMembership, defanged). Each key is a camelCase rule slug.
      - `entity` object, required
        - `id` string, required
        - `name` string, required
        - `type` string, required
        - `description` string
  - `counts` Counts, required: Pagination counts for list responses.
    - `returned` number, required
    - `total` number, required
  - `metadata` Metadata: Response metadata with additional context about the enrichment operation. Only included when the metadata query parameter is set to true.
    - `entries` object[]: Metadata entries providing additional context about the response data elements.
      - `key` string: The metadata key or field name.
      - `value` string: The metadata value or description.

---

[API](https://skmtc.dev/recordedfuture/apis/soar-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/soar-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/soar-api/revisions/42946e24f836?raw)