---
title: "List URL risk rules"
method: GET
path: "/url/riskrules"
tags: ["URL"]
---

# List URL risk rules

`GET /url/riskrules`

Get the catalog of ~40 URL risk rules with criticality levels, entity counts, and MITRE ATT&CK codes.

## Response `200`

Result of operation

- ListRiskRulesResponse — Response containing risk rules for an entity type. Each rule includes its API name, description, criticality level, entity count, and framework code associations.
  - `data` object, required
    - `results` object[], required — Array of risk rule objects.
      - `name` string — API name of the risk rule, used as filter value in Search and Risk List endpoints (e.g., recentSshDictAttacker)
      - `description` string — Human-readable description of the risk rule
      - `criticalityLabel` '0' | 'Informational' | 'Unusual' | 'Suspicious' | 'Moderate' | 'Malicious' | 'High' | 'Very Malicious' | 'Very High' — Criticality level label. IOC entities use: Unusual, Suspicious, Malicious, Very Malicious. Company entities use: Informational, Moderate, High, Very High. A value of "0" indicates no risk.
      - `criticality` integer — Numeric criticality (0=No Risk, 1=Informational/Unusual, 2=Moderate/Suspicious, 3=High/Malicious, 4=Very High/Very Malicious). IOC and Company entity types use different label mappings for the same numeric levels.
      - `count` integer — Number of entities currently triggering this risk rule
      - `categories` object[] — Associated framework codes (e.g., MITRE ATT&CK techniques for IOC types, NIST/Functional Categories for Company).
        - `name` string — Framework code (e.g., T1595 for MITRE ATT&CK, ID.RA-4 for NIST)
        - `framework` string — Framework name (e.g., MITRE, NIST)
      - `relatedEntities` object[] — Related entities associated with this risk rule.

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)