---
title: "Lookup all available risk contexts"
method: GET
path: "/triage/contexts"
tags: ["Soar"]
---

# Lookup all available risk contexts

`GET /triage/contexts`

## Request

- Base URL: `https://api.recordedfuture.com/soar/v3`
- URL: `https://api.recordedfuture.com/soar/v3/triage/contexts`
- Auth: API key in header `X-RFToken`

Retrieve configuration for the malware, phishing, and c2 risk contexts, including default thresholds used by the triage endpoint.

## Response `200`

output

- ContextResponse: Response wrapper for triage context operations.
  - `malware` Context: A triage context configuration defining risk thresholds and data group settings for automated triage decisions.
    - `default_threshold` integer: Default threshold to determinate verdict
    - `description` string
    - `datagroup` object: Includes information on all data groups available for this context
  - `phishing` Context: A triage context configuration defining risk thresholds and data group settings for automated triage decisions.
    - `default_threshold` integer: Default threshold to determinate verdict
    - `description` string
    - `datagroup` object: Includes information on all data groups available for this context
  - `c2` Context: A triage context configuration defining risk thresholds and data group settings for automated triage decisions.
    - `default_threshold` integer: Default threshold to determinate verdict
    - `description` string
    - `datagroup` object: Includes information on all data groups available for this context

---

[API](https://skmtc.dev/recordedfuture/apis/soar-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/soar-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/soar-api/revisions/42946e24f836?raw)