---
title: "Playbook Alerts: Malicious Sites Create"
method: POST
path: "/malicious_sites/create"
tags: ["Malicious Sites"]
---

# Playbook Alerts: Malicious Sites Create

`POST /malicious_sites/create`

Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause `manual` and the creator is taken from the authenticated request.

If the attacker matches the main attacker of an existing alert, the attacker is added to that alert instead of creating a new one.

Provide exactly one of `rule` or `organization` to select the use case configuration the alert is created under.

## Request body

- union
  - object
    - `attacker` string, required — The attacker domain to create the alert for.
    - `rule` string, required — The id of the alert rule (use case configuration) to create the alert under. Provide either `rule` or `organization`.
    - `organization` string — The id of the organization whose Malicious Sites use case configuration the alert is created under. Provide either `rule` or `organization`.
    - `options` MaliciousSitesCreateOptions — Optional overrides applied to the created Malicious Sites alert.
      - `targets` string[] — Domains or other entities that are related to this alert.
      - `assignee` string — The assignee of the alert. Defaults to the assignee in the alert rule.
      - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved' — The status of the Playbook Alert.
      - `priority` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
      - `description` string — Optional free-text description of the alert.
  - object
    - `attacker` string, required — The attacker domain to create the alert for.
    - `rule` string — The id of the alert rule (use case configuration) to create the alert under. Provide either `rule` or `organization`.
    - `organization` string, required — The id of the organization whose Malicious Sites use case configuration the alert is created under. Provide either `rule` or `organization`.
    - `options` MaliciousSitesCreateOptions — Optional overrides applied to the created Malicious Sites alert.
      - `targets` string[] — Domains or other entities that are related to this alert.
      - `assignee` string — The assignee of the alert. Defaults to the assignee in the alert rule.
      - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved' — The status of the Playbook Alert.
      - `priority` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert.
      - `description` string — Optional free-text description of the alert.

## Response `200`

The Malicious Sites alert was created or extended, or the alert already exists.

- object
  - `status` PlaybookAlertStatusResponse
    - `status_code` 'Ok' | 'Error' — Status describing the result of the request.
    - `status_message` string — Text describing the status, suitable for displaying an error.
  - `outcome` 'alert_created' | 'attacker_added' | 'already_tracked'
  - `playbook_alert_id` string — The id of the created or matched Playbook Alert.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)