--- title: "Playbook Alerts: Malicious Sites Bulk" method: POST path: "/malicious_sites" tags: ["Malicious Sites"] --- # Playbook Alerts: Malicious Sites Bulk `POST /malicious_sites` Batch-retrieve detailed intelligence for up to 250 Malicious Sites alerts in a single request. ## Request body - object - `playbook_alert_ids` string[], required — The unique ids of the triggered Playbook Alerts. Maximum number of ids in a single request is 250. - `panels` string[] — Request inclusion of detailed Malicious Sites alert data, grouped into a set of panels. If left unset, all panels will be returned. ## Response `200` Data for the requested panels. - object - `status` PlaybookAlertStatusResponse - `status_code` 'Ok' | 'Error' — Status describing the result of the request. - `status_message` string — Text describing the status, suitable for displaying an error. - `data` MaliciousSitesResponse[] - `playbook_alert_id` string, required - `panel_status` MaliciousSitesStatusPanel — Data structure containing general information about the Malicious Sites alert and its associated domain (the entity). - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required — The status of the Playbook Alert. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `reopen` 'Never' | 'SignificantUpdates' — Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates - `assignee_name` string — Full name of the assignee - `assignee_id` string — ID of the assignee - `created` string, date-time, required — The Creation time of the Playbook Alert - `updated` string, date-time, required — The Update time of the Playbook Alert - `case_rule_id` string, required — The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field) - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' — The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field) - `alert_rule` PlaybookAlertAlertRule, required - `id` string, required — The Rule ID that created the Playbook Alert (without the 'report:' prefix) - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'Undefined', required — The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing. - `name` string — The Rule name (if defined) that created the Playbook Alert - `creator_name` string — Full name of the Creator of the Playbook Alert - `creator_id` string — Id of the Creator of the Playbook Alert - `owner_id` string — Id of the owner - `owner_name` string — Name of the owner - `organisation_id` string — Id of the Organisation - `organisation_name` string — Name of the Organisation - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails - `organisations` PlaybookAlertOrganisation[] - `organisation_id` string — Id of the Organisation - `organisation_name` string — Name of the Organisation - `enterprise_id` string — Id of the Enterprise - `enterprise_name` string — Name of the Enterprise - `entity_id` string — The domain suspected for Malicious Sites - `entity_name` string — The domain suspected for Malicious Sites - `entity_criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical' — Label indicating risk criticality for the entity - `risk_score` integer — Risk score assigned to the entity - `assessments` MaliciousSitesAssessment[], required — Malicious Sites assessments associated with the alert entity. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `targets` string[], required — This is a list of targeted domains. - `attackers` string[] — A list of attacking domains grouped in this alert. - `actions_taken` OnwardActionId[], required - `panel_evidence_summary` MaliciousSitesEvidenceSummaryPanel — Summarized data describing the evidence behind the Malicious Sites alert. - `explanation` string — A brief explanation of why this assessment was made. - `cause` string — The cause that triggered the alert creation. - `resolved_record_list` MaliciousSitesResolvedRecord[] - `entity` string — Record - `risk_score` integer — Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical' — Label indicating risk criticality for the entity - `record_type` string — The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[] — Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `reregistration` MaliciousSitesReregistration - `registrar` string - `registrar_name` string - `expiration` string, date-time - `suggested_takedown` MaliciousSitesSuggestedTakedown — Suggested takedown assessment details. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string — Image identity of supporting screenshot evidence. - `attackers` MaliciousSitesAttacker[] — Attacker domains details. - `attacker` string, required — The attacker domain identity. - `targets` string[] — Targeted domains for this attacker. - `assets` DrpAssetDrpAsset[] — The protected Digital Risk Protection (DRP) assets — drawn from the customer's watch lists — that this attacker matched against (e.g. a watched domain, company, logotype, or search term). Each entry is a subtype of `DrpAsset`. - union — A protected DRP asset (a oneOf union of asset subtypes). The `type` property selects the concrete subtype. - DrpAssetClientDomain — A domain on the customer's Domain Watch List. - … - DrpAssetSimilarDomainTerm — A similar-domain search term. - … - DrpAssetScreenshotOcrKeyword — A keyword matched in OCR-extracted screenshot text. - … - DrpAssetCodeRepoKeyword — A keyword used for code-repository matching. - … - DrpAssetLogotype — A watched logotype detected on the attacker domain. - … - DrpAssetImageHash — A watched image (logo) hash matched on the attacker domain. - … - DrpAssetCompany — A company on the customer's Brand Names Watch List. - … - DrpAssetOrganization — An organization on the customer's Brand Names Watch List. - … - DrpAssetProduct — A product on the customer's Brand Names Watch List. - … - DrpAssetExecutive — A protected executive identity. - … - `cause` 'manual' | 'typosquat' | 'similar_domains' | 'logotype' | 'logotype_high_interest' | 'phishing_verdict' | 'screenshot_mention' | 'screenshot_custom_keyword' | 'login_form' | 'suggested_takedown', required — Malicious Sites attacker detection cause. - `malicious_dns_records` MaliciousSitesDnsRecord[] - `id` string — Entity identity of the DNS record. - `assessments` MaliciousSitesAssessment[] — Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `date` string, date-time - `logotypes` MaliciousSitesLogotype[] — Logotype items for this attacker. - `logotype_id` string, required — Entity identity of the logotype. - `screenshot_id` string, required — Image identity of the screenshot containing the logotype. - `url` string, required — URL associated with the logotype. - `screenshot_width` integer — Width of the screenshot in pixels. - `screenshot_height` integer — Height of the screenshot in pixels. - `region` MaliciousSitesLogotypeRegion — Bounding box region of the logotype within the screenshot. - `min_x` integer, required — Minimum X coordinate of the bounding box. - `min_y` integer, required — Minimum Y coordinate of the bounding box. - `max_x` integer, required — Maximum X coordinate of the bounding box. - `max_y` integer, required — Maximum Y coordinate of the bounding box. - `is_high_interest` boolean — Whether this logotype is considered high interest. - `screenshots` MaliciousSitesScreenshot[] - `description` string, required - `image_id` string, required — Image identity of the screenshot. - `created` string, date-time, required — When the screenshot was taken. - `availability` 'Available' | 'NotFound' | 'NotDownloaded' | 'FlaggedForReview' | 'NotAvailableForLegalReasons' | 'ScanCompletedAsPositive', required — Image availability status - `tag` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server' — Assessment tag for the screenshot. - `logotypes` MaliciousSitesLogotype[] — Logotypes detected in this screenshot. - `logotype_id` string, required — Entity identity of the logotype. - `screenshot_id` string, required — Image identity of the screenshot containing the logotype. - `url` string, required — URL associated with the logotype. - `screenshot_width` integer — Width of the screenshot in pixels. - `screenshot_height` integer — Height of the screenshot in pixels. - `region` MaliciousSitesLogotypeRegion — Bounding box region of the logotype within the screenshot. - … - `is_high_interest` boolean — Whether this logotype is considered high interest. - `reregistration` MaliciousSitesReregistration - `registrar` string - `registrar_name` string - `expiration` string, date-time - `screenshot_mentions` MaliciousSitesScreenshotMention[] - `url` string - `screenshot` string - `document` string - `analyzed` string, date-time - `mentioned_entities` MaliciousSitesMentionedEntity[] - `entity` object, required - … - `reference` string, required - `fragment` string, required - `mentioned_custom_keywords` MaliciousSitesMentionedCustomKeyword[] - `keyword` string, required - `reference` string, required - `fragment` string, required - `suggested_takedown` MaliciousSitesSuggestedTakedown — Suggested takedown assessment details. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string — Image identity of supporting screenshot evidence. - `phishing_verdicts` MaliciousSitesPhishingVerdict[] - `url` string, required - `source` string, required — Source identity for this verdict. - `risk_rule_id` string, required — The risk rule meta-attribute identity. - `risk_rule_description` string — Description of the risk rule. - `severity` 'unusual' | 'suspicious' | 'malicious' | 'very_malicious', required — Severity of the phishing verdict. - `brands` MaliciousSitesTargetedBrand[], required - `brand` string, required — Entity identity of the targeted brand. - `mentions` MaliciousSitesHtmlContentMention[] - … - `last_seen` string, date-time, required - `ttps` string[], required — MITRE ATT&CK identifiers, attack vectors, or malware. - `priority` string, required — Computed priority for this attacker context. - `created_at` string, date-time, required — When this attacker was first detected. - `assessments` MaliciousSitesAssessment[] — Malicious Sites assessments scoped to this attacker. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `assessments` MaliciousSitesAssessment[] — Aggregated Malicious Sites assessments for this alert. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `panel_evidence_dns` MaliciousSitesEvidenceDnsPanel — Detailed DNS data for the Malicious Sites domain. - `ip_list` MaliciousSitesResolvedRecord[], required - `entity` string — Record - `risk_score` integer — Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical' — Label indicating risk criticality for the entity - `record_type` string — The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[] — Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `mx_list` MaliciousSitesResolvedRecord[], required - `entity` string — Record - `risk_score` integer — Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical' — Label indicating risk criticality for the entity - `record_type` string — The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[] — Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `ns_list` MaliciousSitesResolvedRecord[], required - `entity` string — Record - `risk_score` integer — Risk score assigned to the entity - `criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical' — Label indicating risk criticality for the entity - `record_type` string — The Record Type, ex A, CNAME, MX or similar. - `assessments` MaliciousSitesAssessment[] — Malicious Sites assessments associated with the DNS record. - `name` 'Suggested Takedown' | 'Phishing/Scam' | 'Login Form' | 'High Interest Logo Detection' | 'Logo Detection' | 'Screenshot Mention' | 'Custom Keyword in Screenshot' | 'Parked / Ad Hosting Website' | 'Domain for Sale' | 'Typosquat' | 'Similar Domain' | 'Re-Registration' | 'Active Mail Server', required — Assessment title. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `panel_evidence_whois` MaliciousSitesEvidenceWhoisPanel — Detailed WHOIS data for the Malicious Sites domain. - `body` WhoIsAttributeItem[] - `provider` string, required - `entity` string, required - `attribute` 'attr:whois' | 'attr:whoisContacts', required - `value` object, required — Attribute value for attr:whoisContacts - `type` 'technicalContact' | 'registrant' | 'organization' | 'administrativeContact', required - `telephone` string - `street1` string - `state` string - `postalCode` string - `organization` string - `name` string - `fax` string - `email` string - `countryCode` string - `country` string - `city` string - `added` string, date-time - `removed` string, date-time - `panel_log_v2` object[] — Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. - `id` string, required - `author_id` string — Id of the author - `author_name` string — Full name of the author - `created` string, date-time, required - `changes` union[], required - union - AssigneeChangeV2 — This change applies to any alert type. - `old` Assignee - … - `new` Assignee - … - `type` 'assignee_change', required - CustomStatusChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `actions_taken` OnwardActionId[], required - PriorityChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - ReopenStrategyChange — This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - TitleChange — This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - EntitiesChangeV2 — This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'entities_change', required - RelatedEntitiesChangeV2 — This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'related_entities_change', required - DescriptionChange — This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - ExternalIdChange — Record of an external ID change on a case. - `type` 'external_id_change' - `old` string - `new` string - CommentChange — This change applies to any alert type. - `comment` string, required - `type` 'comment_change', required - ActionChange — This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - AssessmentIdsChange — This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - CustomOnwardActionsRemovedChange — This change applies to any alert type. - `removed_actions_taken` OnwardActionId[] - `type` 'onward_actions_removed_change' - CustomOnwardActionsAddedChange — This change applies to any alert type. - `added_actions_taken` OnwardActionId[] - `type` 'onward_actions_added_change' - DomainAbuseDnsChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` DnsRecordV2[], required - … - `added` DnsRecordV2[], required - … - `type` 'dns_change', required - DomainAbuseWhoisChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `old_record` WhoisRecordV2 - … - `new_record` WhoisRecordV2 - … - `removed_contacts` WhoisContactRecordV2[], required - … - `added_contacts` WhoisContactRecordV2[], required - … - `type` 'whois_change', required - DomainAbuseLogotypeChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'logotype_in_screenshot_change', required - DomainAbuseMaliciousDnsChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_dns_change', required - DomainAbuseReregistrationChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'reregistration_change', required - DomainAbuseMaliciousUrlChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousUrlRecord[], required - … - `added` MaliciousUrlRecord[], required - … - `type` 'malicious_url_change', required - DomainAbuseScreenshotMentionsChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `added` object[], required - … - `type` 'screenshot_mentions_change', required - DomainAbusePhishingMaliciousBehaviorChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `added` DomainAbusePhishingMaliciousBehaviorThreats, required - … - `removed` DomainAbusePhishingMaliciousBehaviorThreats - … - `type` 'phishing_malicious_behavior_change', required - DomainAbuseAttackerAddedChange — This change only applies to Domain Abuse alerts. - `attacker` string, required - `cause` 'manual' | 'typosquat' | 'similar_domains' — Domain Abuse attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `type` 'attacker_added_change', required - MaliciousSitesAttackerAddedChange — Attacker added change for Malicious Sites alerts. - `attacker` string, required — The attacker domain identity. - `cause` 'manual' | 'typosquat' | 'similar_domains' | 'logotype' | 'logotype_high_interest' | 'phishing_verdict' | 'screenshot_mention' | 'screenshot_custom_keyword' | 'login_form' | 'suggested_takedown' — Malicious Sites attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `logotypes` MaliciousSitesLogotype[] - … - `type` 'malicious_sites_attacker_added_change', required - MaliciousSitesDnsChange — DNS change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousSitesDnsChangeRecord[], required - … - `added` MaliciousSitesDnsChangeRecord[], required - … - `type` 'malicious_sites_dns_change', required - MaliciousSitesWhoisChange — Whois change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `old_record` MaliciousSitesWhoisRecord - … - `new_record` MaliciousSitesWhoisRecord - … - `removed_contacts` MaliciousSitesWhoisContactRecord[], required - … - `added_contacts` MaliciousSitesWhoisContactRecord[], required - … - `type` 'malicious_sites_whois_change', required - MaliciousSitesMaliciousDnsChange — Malicious DNS change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_sites_malicious_dns_change', required - MaliciousSitesReregistrationChange — Reregistration change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'malicious_sites_reregistration_change', required - MaliciousSitesMaliciousUrlChange — Malicious URL change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousSitesMaliciousUrlRecord[], required - … - `added` MaliciousSitesMaliciousUrlRecord[], required - … - `type` 'malicious_sites_malicious_url_change', required - MaliciousSitesForSaleChange — Indicates the domain is for sale. - `url` string, required - `image` string, required - `type` 'for_sale_change', required - MaliciousSitesParkedChange — Indicates the domain is parked. - `url` string, required - `image` string, required - `type` 'parked_change', required - MaliciousSitesLogoHashChange — Indicates logo(s) were detected on a URL via hash matching. - `url` string, required - `scan` string - `hashes` string[], required - `brands` string[] - `type` 'logo_hash_change', required - MaliciousSitesScreenshotMentionChange — Indicates mentions found in a screenshot. - `url` string, required - `scan` string, required - `screenshot` string, required - `mentions` string[], required - `texts` string[], required - `type` 'malicious_sites_screenshot_mention_change', required - MaliciousSitesPhishingVerdictChange — Indicates a phishing verdict was detected. - `domain` string - `url` string - `risk_rule` string, required - `ttps` string[], required - `brands` string[], required - `type` 'phishing_verdict_change', required - MaliciousSitesSuggestedTakedownChange — Indicates a takedown is suggested. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string - `type` 'suggested_takedown_change', required - MaliciousSitesLogoChange — This change only applies to Malicious Sites alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'malicious_sites_logo_change', required - VulnerabilityLifecycleChangeV2 — This change only applies to Vulnerability alerts. - `added` VulnerabilityAssessment - … - `removed` VulnerabilityAssessment - … - `triggered_by_risk_rule` object - … - `type` 'lifecycle_in_cve_change', required - CodeRepoLeakageEvidenceChangeV2 — This change only applies to Data Leakage on Code Repository alerts. - `added` CodeRepoLeakageEvidenceV2[], required - … - `type` 'evidence_change', required - ThirdPartyAssessmentChangeV2 — This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'tpr_assessment_change', required - ThirdPartyAssessmentChangeV3 — This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `assessment_name` string - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'assessment_change', required - FacilityEvidenceChange - `added` FacilityEvidence[], required - … - `type` 'evidence_changes', required - ClusterChangeAdded — Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert. - `cluster_id` string - `main_event` object - … - `other_event_ids` string[] - `type` 'cluster_change_added', required --- [API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)