---
title: "Bulk Malware Report alert lookup"
method: POST
path: "/malware_report"
tags: ["Malware Intelligence"]
---

# Bulk Malware Report alert lookup

`POST /malware_report`

Retrieve detailed information about multiple Malware Report notifications with data grouped into UI-ready panels.

## Request body

- object
  - `playbook_alert_ids` string[], required — The unique ids of the triggered Playbook Alerts. Maximum number of ids in a single request is 250.
  - `panels` string[] — Request inclusion of detailed facility alert data, grouped into a set of panels. If left unset, all panels will be returned.

## Response `200`

Data for the requested panels.

- object
  - `status` PlaybookAlertStatusResponse
    - `status_code` 'Ok' | 'Error' — Status describing the result of the request.
    - `status_message` string — Text describing the status, suitable for displaying an error.
  - `data` MalwareReportResponse[]
    - `playbook_alert_id` string, required
    - `panel_status` MalwareReportStatusPanel — Data structure containing general information about the alert and it's associated entity.
      - `status` 'New' | 'InProgress' | 'Dismissed' | 'Resolved', required — The status of the Playbook Alert.
      - `priority` 'High' | 'Moderate' | 'Informational', required — The priority of the Playbook Alert.
      - `assignee_name` string — Full name of the assignee
      - `assignee_id` string — ID of the assignee
      - `created` string, date-time, required — The Creation time of the Playbook Alert
      - `updated` string, date-time, required — The Update time of the Playbook Alert
      - `case_rule_id` string, required — The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field)
      - `case_rule_label` 'Domain Abuse' | 'Malicious Sites' | 'Cyber Vulnerability' | 'Data Leakage on Code Repository' | 'Compromised Bank Check' | 'Geopolitics Facility' | 'Novel Identity Exposure' | 'Third Party Risk' | 'Malware Report' — The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user. (Deprecated, use 'alertRule.label' field)
      - `alert_rule` PlaybookAlertAlertRule, required
        - `id` string, required — The Rule ID that created the Playbook Alert (without the 'report:' prefix)
        - `label` 'DomainAbuse' | 'MaliciousSites' | 'CyberVulnerability' | 'DataLeakageOnCodeRepository' | 'CompromisedBankCheck' | 'GeopoliticsFacility' | 'NovelIdentityExposure' | 'ThirdPartyRisk' | 'MalwareReport' | 'Undefined', required — The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing.
        - `name` string — The Rule name (if defined) that created the Playbook Alert
      - `creator_name` string — Full name of the Creator of the Playbook Alert
      - `creator_id` string — Id of the Creator of the Playbook Alert
      - `owner_id` string — Id of the owner
      - `owner_name` string — Name of the owner
      - `organisation_id` string — Id of the Organisation
      - `organisation_name` string — Name of the Organisation
      - `owner_organisation_details` PlaybookAlertOwnerOrganisationDetails
        - `organisations` PlaybookAlertOrganisation[]
          - `organisation_id` string — Id of the Organisation
          - `organisation_name` string — Name of the Organisation
        - `enterprise_id` string — Id of the Enterprise
        - `enterprise_name` string — Name of the Enterprise
    - `panel_evidence_summary` MalwareReportSummaryPanel — Summarized data describing the notification
      - `notification_title` string, required — Title of notification
      - `report_limit_reached` boolean, required — If maximum number of reports per notification has been matched
      - `number_of_reports` integer, required — Number of matched malware reports included in notification
      - `matched_hashes` MalwareReportHash[], required — List of matched hashes, with details
        - `sha256` string, required — The SHA-256 hash
        - `is_enterprise_submission` boolean, required — Hash comes from sample submitted by your enterprise
        - `risk_score` integer, required — Risk score assigned to the hash entity
        - `report_overviews` MalwareReportOverview[], required
          - `report_id` string, required — Id of malware report
          - `sandbox_score` integer, required — Sandbox score assigned to the report
          - `tags` string[], required — List of all tags of the malware report
      - `detected_malwares` MalwareReportFamilyCount[], required — List of malwares families and counts for matched reports
        - `name` string, required — Family tag from sandbox
        - `count` integer, required — number of matched reports with this tag
      - `sandbox_scores` MalwareReportScoreCount[], required — List of sandbox scores and counts for matched reports
        - `score` integer, required — Sandbox score value
        - `count` integer, required — number of reports in notification with this score

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)