---
title: "Lookup all available risk contexts"
method: GET
path: "/triage/contexts"
tags: ["Soar"]
---

# Lookup all available risk contexts

`GET /triage/contexts`

Retrieve configuration for the malware, phishing, and c2 risk contexts, including default thresholds used by the triage endpoint.

## Response `200`

output

- ContextResponse — Response wrapper for triage context operations.
  - `malware` Context — A triage context configuration defining risk thresholds and data group settings for automated triage decisions.
    - `default_threshold` integer — Default threshold to determinate verdict
    - `description` string
    - `datagroup` object — Includes information on all data groups available for this context
  - `phishing` Context — A triage context configuration defining risk thresholds and data group settings for automated triage decisions.
    - `default_threshold` integer — Default threshold to determinate verdict
    - `description` string
    - `datagroup` object — Includes information on all data groups available for this context
  - `c2` Context — A triage context configuration defining risk thresholds and data group settings for automated triage decisions.
    - `default_threshold` integer — Default threshold to determinate verdict
    - `description` string
    - `datagroup` object — Includes information on all data groups available for this context

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)