v1
latestOpenAPI 3.1.12026-07-242899061.7 MBMalicious Sites
Playbook Alerts: Malicious Sites Create
Manually create a Malicious Sites Playbook Alert for the supplied attacker domain. The alert is created with the cause manual and the creator is taken from the authenticated request.
If the attacker matches the main attacker of an existing alert, the attacker is added to that alert instead of creating a new one.
Provide exactly one of rule or organization to select the use case configuration the alert is created under.
post/malicious_sites/create
Request body
Example request
{
"attacker": "idn:mail.google.mail.pl",
"rule": "report:rule1",
"organization": "uhash:40wXmPVONA",
"options": {
"targets": [
"idn:google.com"
],
"assignee": "uhash:40wXmPVONA",
"status": "Resolved"
}
}Response
The Malicious Sites alert was created or extended, or the alert already exists.
Example response
{
"status": {
"status_code": "Ok",
"status_message": "Ok"
},
"outcome": "alert_created",
"playbook_alert_id": "task:34da3a87-87ed-4ccd-8ca3-437167acdb76"
}