---
title: "Triage multiple IOC entities"
method: POST
path: "/triage/contexts/{context_name}"
tags: ["Soar"]
---

# Triage multiple IOC entities

`POST /triage/contexts/{context_name}`

Evaluate up to 1,000 indicators against a specific risk context (malware, phishing, or c2) and return a boolean verdict based on context-specific sub-scores.

## Path parameters

- `context_name` string, required

## Query parameters

- `format` 'phantom'
- `metadata` boolean
- `threshold` integer
- `threshold_type` 'min' | 'max'

## Request body

- EnrichRequest — Entities to be enriched, grouped by type up to a total of 1000 IOCs.
  - `ip` string[] — IPs to enrich
  - `domain` string[] — Domains to enrich
  - `url` string[] — URLs to enrich
  - `hash` string[] — Hashes to enrich
  - `vulnerability` string[] — Vulnerabilities to enrich
  - `companybydomain` string[] — Companies to enrich, identified by their domain name.

## Response `200`

output

- TriageResponse — Triage results with automated verdicts for submitted entities based on configured risk thresholds.
  - `data` TriageResponseData, required — Data wrapper containing triage verdicts and enrichment results.
    - `triage` TriageData — Automated triage verdict for an entity based on risk threshold evaluation.
      - `threshold_type` 'min' | 'max'
      - `context` string
      - `verdict` boolean
      - `threshold` integer — Default value depends on the context
      - `scores` object
        - `min` integer
        - `max` integer
    - `results` object[] — Individual enrichment result for a single entity.
      - `risk` object, required
        - `score` number, required — Overall risk score for this entity (0-99).
        - `level` number, required — Risk level category (0=None, 1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
        - `context` object, required — Risk context data keyed by context name (e.g., phishing, c2, malware, public). Each key represents a risk context use case.
        - `rule` object, required — Aggregate risk rule data for this entity across all contexts.
          - `summary` object[] — Summary of triggered rules grouped by severity level.
            - `level` number, required — Severity level (1=Unusual, 2=Suspicious, 3=Malicious, 4=Very Malicious).
            - `count` number, required — Number of rules triggered at this severity level.
          - `mostCritical` string — Name of the most critical (highest severity) rule triggered.
          - `count` integer, required — Total number of risk rules triggered for this entity.
          - `maxCount` integer, required — Maximum number of risk rules available for this entity type.
          - `evidence` object — Evidence data keyed by rule identifier (e.g., spamSiteDetected, historicalThreatListMembership, defanged). Each key is a camelCase rule slug.
      - `entity` object, required
        - `id` string, required
        - `name` string, required
        - `type` string, required
        - `description` string
  - `counts` Counts, required — Pagination counts for list responses.
    - `returned` number, required
    - `total` number, required
  - `metadata` Metadata — Response metadata with additional context about the enrichment operation. Only included when the metadata query parameter is set to true.
    - `entries` object[] — Metadata entries providing additional context about the response data elements.
      - `key` string — The metadata key or field name.
      - `value` string — The metadata value or description.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)