--- title: "Bulk Vulnerability alert lookup" method: POST path: "/vulnerability" tags: ["Vulnerability"] --- # Bulk Vulnerability alert lookup `POST /vulnerability` Perform a detailed lookup of data panels for several alerts at once. ## Request body - object - `playbook_alert_ids` string[], required — The unique ids of the triggered Playbook Alerts. Maximum number of ids in a single request is 250. - `panels` string[] — Request inclusion of detailed Case data, grouped into a set of panels. If left unset, all panels will be returned. ## Response `200` Data for the requested panels. - object - `status` PlaybookAlertStatusResponse - `status_code` 'Ok' | 'Error' — Status describing the result of the request. - `status_message` string — Text describing the status, suitable for displaying an error. - `data` VulnerabilityResponse[] - `playbook_alert_id` string, required - `panel_status` VulnerabilityStatusPanel — Data structure containing general information about the alert and it's associated vulnerability (the entity). - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required — The status of the Playbook Alert. - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert. - `reopen` 'Never' | 'SignificantUpdates' — Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved. The following combinations of status/reopen are allowed: * Dismissed -> Never * Resolved -> Never * Resolved -> SignificantUpdates - `assignee_name` string — Full name of the assignee - `assignee_id` string — ID of the assignee - `created` string, date-time, required — The Creation time of the Playbook Alert - `updated` string, date-time, required — The Update time of the Playbook Alert - `case_rule_id` string, required — The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field) - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' — The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field) - `alert_rule` PlaybookAlertAlertRule, required - `id` string, required — The Rule ID that created the Playbook Alert (without the 'report:' prefix) - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'Undefined', required — The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing. - `name` string — The Rule name (if defined) that created the Playbook Alert - `creator_name` string — Full name of the Creator of the Playbook Alert - `creator_id` string — Id of the Creator of the Playbook Alert - `owner_id` string — Id of the owner - `owner_name` string — Name of the owner - `organisation_id` string — Id of the Organisation - `organisation_name` string — Name of the Organisation - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails - `organisations` PlaybookAlertOrganisation[] - `organisation_id` string — Id of the Organisation - `organisation_name` string — Name of the Organisation - `enterprise_id` string — Id of the Enterprise - `enterprise_name` string — Name of the Enterprise - `entity_id` string — The CVE related to the Vulnerability - `entity_name` string — The CVE related to the Vulnerability - `entity_criticality` 'Low' | 'Medium' | 'High' | 'Critical' | 'Very Critical' — Label indicating risk criticality for the entity - `risk_score` integer — Risk score assigned to the entity - `lifecycle_stage` 'Exploited' | 'Exploit Likely' | 'Proof of Concept' | 'Disclosure' — The current lifecycle stage of the Playbook Alert - `targets` ResolvedEntity[], required — Targets affected by the vulnerability, based on watchlists - `id` string, required - `type` string, required - `name` string, required - `actions_taken` OnwardActionId[], required - `panel_evidence_summary` VulnerabilityEvidenceSummaryPanel — Summarized data describing the evidence behind the alert. - `summary` VulnerabilitySummary, required - `targets` ResolvedEntity[] — Targets affected by the vulnerability, based on watchlists - `id` string, required - `type` string, required - `name` string, required - `lifecycle_stage` 'Exploited' | 'Exploit Likely' | 'Proof of Concept' | 'Disclosure' — The current lifecycle stage of the Playbook Alert - `risk_rules` VulnerabilityRiskRule[] — A list of triggered risk rules for this vulnerability. - `rule` string - `description` string - `affected_products` VulnerabilityAffectedProduct[], required — Detailed list of affected products - `name` string - `insikt_notes` InsiktNote[], required — Note by the Insikt research team pertaining to the vulnerability. - `id` string, required - `title` string - `published` string, date-time - `topic` string - `fragment` string — A fragment of the Insikt note text - `panel_log` object[] — Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. This version is deprecated and will be removed completely in future updates. - `id` string - `actor_name` string — Full name of the author - `actor_id` string — Id of the author - `created` string, date-time - `modified` string, date-time - `action_priority` 'High' | 'Moderate' | 'Informational' — The priority of the Playbook Alert. - `message` string — Log message - `changes` PlaybookAlertLogPanelChanges - `assignee_change` AssigneeChange - `old` string - `new` string - `type` 'assignee_change', required - `status_change` StatusChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `priority_change` PriorityChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - `reopen_strategy_change` ReopenStrategyChange — This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - `title_change` TitleChange — This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - `entities_change` EntitiesChange - `removed` string[] - `added` string[] - `type` 'entities_change', required - `related_entities_change` RelatedEntitiesChange - `removed` string[] - `added` string[] - `type` 'related_entities_change', required - `description_change` DescriptionChange — This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - `external_id_change` ExternalIdChange — Record of an external ID change on a case. - `type` 'external_id_change' - `old` string - `new` string - `actions_change` ActionChange — This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - `assessment_ids_change` AssessmentIdsChange — This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - `context` union - DomainAbuseChangeContext - `type` 'domain_abuse', required - `changes` union[], required - union - … - VulnerabilityChangeContext - `type` 'cyber_vulnerability', required - `changes` union[], required - union - … - CodeRepoLeakageChangeContext - `type` 'code_repo_leakage', required - `changes` union[], required - union - … - ThirdPartyRiskChangeContext - `type` 'third_party_risk', required - `changes` union[], required - union - … - FacilityRiskChangeContext - `type` 'geopolitics_facility', required - `changes` union[], required - union - … - `panel_log_v2` object[] — Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. - `id` string, required - `author_id` string — Id of the author - `author_name` string — Full name of the author - `created` string, date-time, required - `changes` union[], required - union - AssigneeChangeV2 — This change applies to any alert type. - `old` Assignee - … - `new` Assignee - … - `type` 'assignee_change', required - CustomStatusChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'status_change', required - `actions_taken` OnwardActionId[], required - PriorityChange — This change applies to any alert type. - `old` string, required - `new` string, required - `type` 'priority_change', required - ReopenStrategyChange — This change applies to any alert type. - `old` string - `new` string - `type` 'reopen_strategy_change', required - TitleChange — This change applies to any alert type. - `old` string - `new` string - `type` 'title_change', required - EntitiesChangeV2 — This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'entities_change', required - RelatedEntitiesChangeV2 — This change applies to any alert type. - `removed` Entity[], required - … - `added` Entity[], required - … - `type` 'related_entities_change', required - DescriptionChange — This change applies to any alert type. - `old` string - `new` string - `type` 'description_change', required - ExternalIdChange — Record of an external ID change on a case. - `type` 'external_id_change' - `old` string - `new` string - CommentChange — This change applies to any alert type. - `comment` string, required - `type` 'comment_change', required - ActionChange — This change applies to any alert type. - `removed` string[], required - `added` string[], required - `type` 'action_change', required - AssessmentIdsChange — This change applies to any alert type. - `removed` string[] - `added` string[] - `type` 'assessment_ids_change', required - CustomOnwardActionsRemovedChange — This change applies to any alert type. - `removed_actions_taken` OnwardActionId[] - `type` 'onward_actions_removed_change' - CustomOnwardActionsAddedChange — This change applies to any alert type. - `added_actions_taken` OnwardActionId[] - `type` 'onward_actions_added_change' - DomainAbuseDnsChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` DnsRecordV2[], required - … - `added` DnsRecordV2[], required - … - `type` 'dns_change', required - DomainAbuseWhoisChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `old_record` WhoisRecordV2 - … - `new_record` WhoisRecordV2 - … - `removed_contacts` WhoisContactRecordV2[], required - … - `added_contacts` WhoisContactRecordV2[], required - … - `type` 'whois_change', required - DomainAbuseLogotypeChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'logotype_in_screenshot_change', required - DomainAbuseMaliciousDnsChangeV2 — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_dns_change', required - DomainAbuseReregistrationChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'reregistration_change', required - DomainAbuseMaliciousUrlChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `removed` MaliciousUrlRecord[], required - … - `added` MaliciousUrlRecord[], required - … - `type` 'malicious_url_change', required - DomainAbuseScreenshotMentionsChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `added` object[], required - … - `type` 'screenshot_mentions_change', required - DomainAbusePhishingMaliciousBehaviorChange — This change only applies to Domain Abuse alerts. - `domain` string, required - `added` DomainAbusePhishingMaliciousBehaviorThreats, required - … - `removed` DomainAbusePhishingMaliciousBehaviorThreats - … - `type` 'phishing_malicious_behavior_change', required - DomainAbuseAttackerAddedChange — This change only applies to Domain Abuse alerts. - `attacker` string, required - `cause` 'manual' | 'typosquat' | 'similar_domains' — Domain Abuse attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `type` 'attacker_added_change', required - MaliciousSitesAttackerAddedChange — Attacker added change for Malicious Sites alerts. - `attacker` string, required — The attacker domain identity. - `cause` 'manual' | 'typosquat' | 'similar_domains' | 'logotype' | 'logotype_high_interest' | 'phishing_verdict' | 'screenshot_mention' | 'screenshot_custom_keyword' | 'login_form' | 'suggested_takedown' — Malicious Sites attacker detection cause. - `manual_addition_user_id` string - `manual_addition_user_name` string - `typosquat_targets` string[] - `similar_domains_keywords` string[] - `logotypes` MaliciousSitesLogotype[] - … - `type` 'malicious_sites_attacker_added_change', required - MaliciousSitesDnsChange — DNS change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousSitesDnsChangeRecord[], required - … - `added` MaliciousSitesDnsChangeRecord[], required - … - `type` 'malicious_sites_dns_change', required - MaliciousSitesWhoisChange — Whois change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `old_record` MaliciousSitesWhoisRecord - … - `new_record` MaliciousSitesWhoisRecord - … - `removed_contacts` MaliciousSitesWhoisContactRecord[], required - … - `added_contacts` MaliciousSitesWhoisContactRecord[], required - … - `type` 'malicious_sites_whois_change', required - MaliciousSitesMaliciousDnsChange — Malicious DNS change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousDnsRecord[], required - … - `added` MaliciousDnsRecord[], required - … - `type` 'malicious_sites_malicious_dns_change', required - MaliciousSitesReregistrationChange — Reregistration change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` ReregistrationRecord - … - `added` ReregistrationRecord - … - `type` 'malicious_sites_reregistration_change', required - MaliciousSitesMaliciousUrlChange — Malicious URL change for Malicious Sites alerts. - `domain` string, required — The domain identity. - `removed` MaliciousSitesMaliciousUrlRecord[], required - … - `added` MaliciousSitesMaliciousUrlRecord[], required - … - `type` 'malicious_sites_malicious_url_change', required - MaliciousSitesForSaleChange — Indicates the domain is for sale. - `url` string, required - `image` string, required - `type` 'for_sale_change', required - MaliciousSitesParkedChange — Indicates the domain is parked. - `url` string, required - `image` string, required - `type` 'parked_change', required - MaliciousSitesLogoHashChange — Indicates logo(s) were detected on a URL via hash matching. - `url` string, required - `scan` string - `hashes` string[], required - `brands` string[] - `type` 'logo_hash_change', required - MaliciousSitesScreenshotMentionChange — Indicates mentions found in a screenshot. - `url` string, required - `scan` string, required - `screenshot` string, required - `mentions` string[], required - `texts` string[], required - `type` 'malicious_sites_screenshot_mention_change', required - MaliciousSitesPhishingVerdictChange — Indicates a phishing verdict was detected. - `domain` string - `url` string - `risk_rule` string, required - `ttps` string[], required - `brands` string[], required - `type` 'phishing_verdict_change', required - MaliciousSitesSuggestedTakedownChange — Indicates a takedown is suggested. - `has_phishing_verdict` boolean, required - `has_high_interest_logo` boolean, required - `has_login_form` boolean, required - `screenshot` string - `type` 'suggested_takedown_change', required - MaliciousSitesLogoChange — This change only applies to Malicious Sites alerts. - `domain` string, required - `removed` LogotypeInScreenshotV2[], required - … - `added` LogotypeInScreenshotV2[], required - … - `type` 'malicious_sites_logo_change', required - VulnerabilityLifecycleChangeV2 — This change only applies to Vulnerability alerts. - `added` VulnerabilityAssessment - … - `removed` VulnerabilityAssessment - … - `triggered_by_risk_rule` object - … - `type` 'lifecycle_in_cve_change', required - CodeRepoLeakageEvidenceChangeV2 — This change only applies to Data Leakage on Code Repository alerts. - `added` CodeRepoLeakageEvidenceV2[], required - … - `type` 'evidence_change', required - ThirdPartyAssessmentChangeV2 — This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'tpr_assessment_change', required - ThirdPartyAssessmentChangeV3 — This change only applies to Third Party Risk alerts. - `risk_attribute` string, required - `assessment_name` string - `added` ThirdPartyRiskEvidenceChangeV2 - … - `removed` ThirdPartyRiskEvidenceChangeV2 - … - `type` 'assessment_change', required - FacilityEvidenceChange - `added` FacilityEvidence[], required - … - `type` 'evidence_changes', required - ClusterChangeAdded — Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert. - `cluster_id` string - `main_event` object - … - `other_event_ids` string[] - `type` 'cluster_change_added', required --- [API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)