{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://raw.githubusercontent.com/api-evangelist/recorded-future/main/json-schema/recorded-future-domain-abuse-response-schema.json", "title": "DomainAbuseResponse", "x-generated": "2026-10-20", "x-method": "derived", "x-generator": "derive-json-schema.py", "x-source": "openapi/recorded-future-playbook-alerts-api-openapi.yml#/components/schemas/DomainAbuseResponse", "type": "object", "required": [ "playbook_alert_id" ], "properties": { "playbook_alert_id": { "type": "string" }, "panel_status": { "$ref": "#/$defs/DomainAbuseStatusPanel" }, "panel_action": { "$ref": "#/$defs/PlaybookAlertActionPanel" }, "panel_evidence_summary": { "$ref": "#/$defs/DomainAbuseEvidenceSummaryPanel" }, "panel_evidence_dns": { "$ref": "#/$defs/DomainAbuseEvidenceDnsPanel" }, "panel_evidence_whois": { "$ref": "#/$defs/DomainAbuseEvidenceWhoisPanel" }, "panel_log": { "$ref": "#/$defs/PlaybookAlertLogPanel" }, "panel_log_v2": { "$ref": "#/$defs/PlaybookAlertLogPanelV2" } }, "$defs": { "ActionChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "type": "string" } }, "added": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "action_change" ] } }, "required": [ "type", "removed", "added" ] }, "AssessmentIdsChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "type": "string" } }, "added": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "assessment_ids_change" ] } }, "required": [ "type" ] }, "AssessmentSource": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "required": [ "id" ] }, "AssessmentWithSource": { "type": "object", "properties": { "id": { "type": "string" }, "level": { "type": "number" }, "source": { "$ref": "#/$defs/AssessmentSource" }, "title": { "type": "string" } }, "required": [ "id", "level", "source" ] }, "Assignee": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "required": [ "id" ] }, "AssigneeChange": { "type": "object", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "assignee_change" ] } }, "required": [ "type" ] }, "AssigneeChangeV2": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "$ref": "#/$defs/Assignee" }, "new": { "$ref": "#/$defs/Assignee" }, "type": { "type": "string", "enum": [ "assignee_change" ] } }, "required": [ "type" ] }, "ClusterChangeAdded": { "type": "object", "description": "Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert.\n", "properties": { "cluster_id": { "type": "string" }, "main_event": { "type": "object", "properties": { "event_id": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/$defs/FacilityAssessment" } }, "type": { "type": "string", "enum": [ "event_change_added" ] } }, "required": [ "event_id", "type" ] }, "other_event_ids": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "cluster_change_added" ] } }, "required": [ "type" ] }, "CodeRepoLeakageAssessment": { "type": "object", "properties": { "id": { "type": "string" }, "level": { "type": "number" }, "title": { "type": "string" }, "text_indicator": { "type": "string" }, "entity": { "type": "string" } }, "required": [ "id", "level" ] }, "CodeRepoLeakageAssessmentV2": { "type": "object", "properties": { "id": { "type": "string" }, "level": { "type": "number" }, "title": { "type": "string" }, "text_indicator": { "type": "string" }, "entity": { "$ref": "#/$defs/Entity" } }, "required": [ "id", "level" ] }, "CodeRepoLeakageChangeContext": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "code_repo_leakage" ] }, "changes": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/CodeRepoLeakageEvidenceChange" }, { "$ref": "#/$defs/AssessmentIdsChange" }, { "$ref": "#/$defs/AssigneeChange" }, { "$ref": "#/$defs/StatusChange" }, { "$ref": "#/$defs/PriorityChange" }, { "$ref": "#/$defs/ReopenStrategyChange" }, { "$ref": "#/$defs/TitleChange" }, { "$ref": "#/$defs/EntitiesChange" }, { "$ref": "#/$defs/RelatedEntitiesChange" }, { "$ref": "#/$defs/DescriptionChange" }, { "$ref": "#/$defs/ExternalIdChange" } ] } } }, "required": [ "type", "changes" ] }, "CodeRepoLeakageEvidence": { "type": "object", "properties": { "assessments": { "type": "array", "items": { "$ref": "#/$defs/CodeRepoLeakageAssessment" } }, "document_content": { "$ref": "#/$defs/DocumentContent" }, "ontology": { "type": "array", "items": { "$ref": "#/$defs/EntityPathMatch" } }, "target_entities": { "type": "array", "items": { "type": "string" } }, "watch_lists": { "type": "array", "items": { "type": "string" } } }, "required": [ "assessments", "document_content", "ontology", "target_entities", "watch_lists" ] }, "CodeRepoLeakageEvidenceChange": { "type": "object", "properties": { "added": { "type": "array", "items": { "$ref": "#/$defs/CodeRepoLeakageEvidence" } }, "type": { "type": "string", "enum": [ "evidence_changes" ] } }, "required": [ "added", "type" ] }, "CodeRepoLeakageEvidenceChangeV2": { "type": "object", "description": "This change only applies to Data Leakage on Code Repository alerts.", "properties": { "added": { "type": "array", "items": { "$ref": "#/$defs/CodeRepoLeakageEvidenceV2" } }, "type": { "type": "string", "enum": [ "evidence_change" ] } }, "required": [ "added", "type" ] }, "CodeRepoLeakageEvidenceV2": { "type": "object", "properties": { "assessments": { "type": "array", "items": { "$ref": "#/$defs/CodeRepoLeakageAssessmentV2" } }, "document": { "type": "object", "properties": { "id": { "type": "string" }, "content": { "type": "string" }, "owner_id": { "type": "string" }, "owner_name": { "type": "string" }, "published": { "type": "string", "format": "date-time" } }, "required": [ "id", "content", "owner_id", "published" ] }, "target_entities": { "type": "array", "items": { "$ref": "#/$defs/Entity" } }, "watch_lists": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" } }, "required": [ "id" ] } } }, "required": [ "assessments", "document", "target_entities", "watch_lists" ] }, "CommentChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "comment": { "type": "string" }, "type": { "type": "string", "enum": [ "comment_change" ] } }, "required": [ "type", "comment" ] }, "CustomOnwardActionsAddedChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "added_actions_taken": { "$ref": "#/$defs/PlaybookAlertOnwardActionList" }, "type": { "type": "string", "enum": [ "onward_actions_added_change" ] } } }, "CustomOnwardActionsRemovedChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed_actions_taken": { "$ref": "#/$defs/PlaybookAlertOnwardActionList" }, "type": { "type": "string", "enum": [ "onward_actions_removed_change" ] } } }, "CustomStatusChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "status_change" ] }, "actions_taken": { "$ref": "#/$defs/PlaybookAlertOnwardActionList" } }, "required": [ "type", "old", "new", "actions_taken" ] }, "DescriptionChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "description_change" ] } }, "required": [ "type" ] }, "DnsRecord": { "type": "object", "properties": { "type": { "type": "string" }, "entity": { "type": "string" } } }, "DnsRecordV2": { "type": "object", "properties": { "type": { "type": "string" }, "entity": { "$ref": "#/$defs/Entity" } } }, "DocumentContent": { "type": "object", "properties": { "id": { "type": "string" }, "tagged_content": { "type": "string" }, "content": { "type": "string" }, "url": { "type": "string" }, "owner": { "type": "string" }, "published": { "type": "string", "format": "date-time" } }, "required": [ "id", "tagged_content", "content", "url", "owner", "published" ] }, "DomainAbuseAttackerAddedChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "attacker": { "type": "string" }, "cause": { "$ref": "#/$defs/DomainAbuseCause" }, "manual_addition_user_id": { "type": "string" }, "manual_addition_user_name": { "type": "string" }, "typosquat_targets": { "type": "array", "items": { "type": "string" } }, "similar_domains_keywords": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "attacker_added_change" ] } }, "required": [ "attacker", "type" ] }, "DomainAbuseCause": { "type": "string", "description": "Domain Abuse attacker detection cause.", "enum": [ "manual", "typosquat", "similar_domains" ] }, "DomainAbuseChangeContext": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "domain_abuse" ] }, "changes": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/DomainAbuseAttackerAddedChange" }, { "$ref": "#/$defs/DomainAbuseDnsChange" }, { "$ref": "#/$defs/DomainAbuseWhoisChange" }, { "$ref": "#/$defs/DomainAbuseLogotypeChange" }, { "$ref": "#/$defs/DomainAbuseMaliciousDnsChange" }, { "$ref": "#/$defs/DomainAbuseMaliciousUrlChange" }, { "$ref": "#/$defs/DomainAbuseScreenshotMentionsChange" }, { "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorChange" }, { "$ref": "#/$defs/AssigneeChange" }, { "$ref": "#/$defs/StatusChange" }, { "$ref": "#/$defs/PriorityChange" }, { "$ref": "#/$defs/ReopenStrategyChange" }, { "$ref": "#/$defs/TitleChange" }, { "$ref": "#/$defs/EntitiesChange" }, { "$ref": "#/$defs/RelatedEntitiesChange" }, { "$ref": "#/$defs/DescriptionChange" }, { "$ref": "#/$defs/ExternalIdChange" } ] } } }, "required": [ "type", "changes" ] }, "DomainAbuseDnsChange": { "type": "object", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/DnsRecord" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/DnsRecord" } }, "type": { "type": "string", "enum": [ "dns_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "DomainAbuseDnsChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/DnsRecordV2" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/DnsRecordV2" } }, "type": { "type": "string", "enum": [ "dns_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "DomainAbuseEvidenceDnsPanel": { "type": "object", "description": "Detailed DNS data for the domain.\n", "properties": { "ip_list": { "$ref": "#/$defs/DomainAbuseResolvedRecordList" }, "mx_list": { "$ref": "#/$defs/DomainAbuseResolvedRecordList" }, "ns_list": { "$ref": "#/$defs/DomainAbuseResolvedRecordList" } }, "required": [ "ip_list", "mx_list", "ns_list" ] }, "DomainAbuseEvidenceSummaryPanel": { "type": "object", "description": "Summarized data describing the evidence behind the alert.\n", "properties": { "explanation": { "type": "string", "description": "A brief explanation of why this assessment was made." }, "cause": { "type": "string", "description": "The cause that triggered the alert creation." }, "resolved_record_list": { "$ref": "#/$defs/DomainAbuseResolvedRecordList" }, "screenshots": { "$ref": "#/$defs/PlaybookAlertImageList" }, "reregistration": { "$ref": "#/$defs/DomainAbuseReregistration" }, "screenshot_mentions": { "$ref": "#/$defs/DomainAbuseScreenshotMentions" }, "keywords_in_domain_name": { "type": "object", "description": "Keywords in domain name that may indicate malicious intent", "properties": { "security_keywords_in_domain_name": { "$ref": "#/$defs/DomainAbuseKeywordInDomainName" }, "payment_keywords_in_domain_name": { "$ref": "#/$defs/DomainAbuseKeywordInDomainName" } } }, "phishing_malicious_behavior": { "$ref": "#/$defs/DomainAbusePhishingMaliciousBehavior" } }, "required": [ "resolved_record_list", "screenshots" ] }, "DomainAbuseEvidenceWhoisPanel": { "type": "object", "description": "Detailed WHOIS data for the domain.\n", "properties": { "body": { "type": "array", "items": { "$ref": "#/$defs/WhoIsAttributeItem" } } } }, "DomainAbuseKeywordInDomainName": { "type": "array", "description": "The attacking domain name contains a specific word that might be troublesome", "items": { "type": "object", "properties": { "word": { "type": "string" }, "domain": { "type": "string" } } } }, "DomainAbuseLogotypeChange": { "type": "object", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/LogotypeInScreenshot" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/LogotypeInScreenshot" } }, "type": { "type": "string", "enum": [ "logotype_in_screenshot_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "DomainAbuseLogotypeChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/LogotypeInScreenshotV2" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/LogotypeInScreenshotV2" } }, "type": { "type": "string", "enum": [ "logotype_in_screenshot_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "DomainAbuseMaliciousDnsChange": { "type": "object", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/MaliciousDnsRecord" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/MaliciousDnsRecord" } }, "type": { "type": "string", "enum": [ "malicious_dns_change" ] } }, "required": [ "domain", "type", "removed", "added" ] }, "DomainAbuseMaliciousDnsChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/MaliciousDnsRecord" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/MaliciousDnsRecord" } }, "type": { "type": "string", "enum": [ "malicious_dns_change" ] } }, "required": [ "domain", "type", "removed", "added" ] }, "DomainAbuseMaliciousUrlChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/MaliciousUrlRecord" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/MaliciousUrlRecord" } }, "type": { "type": "string", "enum": [ "malicious_url_change" ] } }, "required": [ "domain", "removed", "added", "type" ] }, "DomainAbusePhishingMaliciousBehavior": { "type": "object", "properties": { "threatTypes": { "type": "array", "items": { "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreatType" } } } }, "DomainAbusePhishingMaliciousBehaviorChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "added": { "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreats" }, "removed": { "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreats" }, "type": { "type": "string", "enum": [ "phishing_malicious_behavior_change" ] } }, "required": [ "domain", "added", "type" ] }, "DomainAbusePhishingMaliciousBehaviorThreatType": { "type": "string", "description": "A kind of threat present in the domain.", "enum": [ "malware", "unwanted_software", "social_engineering", "social_engineering_extended_coverage" ] }, "DomainAbusePhishingMaliciousBehaviorThreats": { "type": "object", "properties": { "threat_types": { "type": "array", "items": { "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreatType" } } } }, "DomainAbuseReregistration": { "type": "object", "properties": { "registrar": { "type": "string" }, "registrar_name": { "type": "string" }, "expiration": { "type": "string", "format": "date-time" } } }, "DomainAbuseReregistrationChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "removed": { "$ref": "#/$defs/ReregistrationRecord" }, "added": { "$ref": "#/$defs/ReregistrationRecord" }, "type": { "type": "string", "enum": [ "reregistration_change" ] } }, "required": [ "domain", "type" ] }, "DomainAbuseResolvedRecordList": { "type": "array", "items": { "type": "object", "properties": { "entity": { "type": "string", "description": "Record" }, "risk_score": { "$ref": "#/$defs/PlaybookAlertEntityScore" }, "criticality": { "$ref": "#/$defs/PlaybookAlertEntityCriticality" }, "record_type": { "type": "string", "description": "The Record Type, ex A, CNAME, MX or similar." }, "context_list": { "$ref": "#/$defs/PlaybookAlertContextList" } } } }, "DomainAbuseScreenshotMentions": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" }, "screenshot": { "type": "string" }, "document": { "type": "string" }, "analyzed": { "type": "string", "format": "date-time" }, "mentioned_entities": { "type": "array", "items": { "type": "object", "properties": { "entity": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "type": { "type": "string" } }, "required": [ "id" ] }, "reference": { "type": "string" }, "fragment": { "type": "string" } }, "required": [ "entity", "reference", "fragment" ] } }, "mentioned_custom_keywords": { "type": "array", "items": { "type": "object", "properties": { "keyword": { "type": "string" }, "reference": { "type": "string" }, "fragment": { "type": "string" } }, "required": [ "keyword", "reference", "fragment" ] } } } } }, "DomainAbuseScreenshotMentionsChange": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "added": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" }, "screenshot_id": { "type": "string" }, "document": { "type": "string" }, "analyzed": { "type": "string", "format": "date-time" }, "mentioned_entities": { "type": "array", "items": { "$ref": "#/$defs/MentionedEntity" } }, "mentioned_texts": { "type": "array", "items": { "$ref": "#/$defs/MentionedText" } } }, "required": [ "url", "screenshot_id", "document", "analyzed", "mentioned_entities" ] } }, "type": { "type": "string", "enum": [ "screenshot_mentions_change" ] } }, "required": [ "domain", "added", "type" ] }, "DomainAbuseStatusPanel": { "type": "object", "description": "Data structure containing general information about the alert and it's associated domain (the entity).\n", "properties": { "status": { "$ref": "#/$defs/PlaybookAlertStatus" }, "priority": { "$ref": "#/$defs/PlaybookAlertPriority" }, "reopen": { "$ref": "#/$defs/PlaybookAlertReopenStrategy" }, "assignee_name": { "$ref": "#/$defs/PlaybookAlertAssigneeName" }, "assignee_id": { "$ref": "#/$defs/PlaybookAlertAssigneeId" }, "created": { "$ref": "#/$defs/PlaybookAlertCreated" }, "updated": { "$ref": "#/$defs/PlaybookAlertUpdated" }, "case_rule_id": { "$ref": "#/$defs/PlaybookAlertCaseRuleId" }, "case_rule_label": { "$ref": "#/$defs/PlaybookAlertCaseRuleLabel" }, "alert_rule": { "$ref": "#/$defs/PlaybookAlertAlertRule" }, "creator_name": { "$ref": "#/$defs/PlaybookAlertCreatorName" }, "creator_id": { "$ref": "#/$defs/PlaybookAlertCreatorId" }, "owner_id": { "$ref": "#/$defs/PlaybookAlertOwnerId" }, "owner_name": { "$ref": "#/$defs/PlaybookAlertOwnerName" }, "organisation_id": { "$ref": "#/$defs/PlaybookAlertOrganisationId" }, "organisation_name": { "$ref": "#/$defs/PlaybookAlertOrganisationName" }, "owner_organisation_details": { "$ref": "#/$defs/PlaybookAlertOwnerOrganisationDetails" }, "entity_id": { "type": "string", "description": "The domain suspected for Domain Abuse" }, "entity_name": { "type": "string", "description": "The domain suspected for Domain Abuse" }, "entity_criticality": { "$ref": "#/$defs/PlaybookAlertEntityCriticality" }, "risk_score": { "$ref": "#/$defs/PlaybookAlertEntityScore" }, "context_list": { "$ref": "#/$defs/PlaybookAlertContextList" }, "targets": { "description": "This is a list of targeted domains.", "type": "array", "items": { "type": "string" } }, "attackers": { "description": "A list of attacking domains grouped in this alert.", "type": "array", "items": { "type": "string" } }, "actions_taken": { "$ref": "#/$defs/PlaybookAlertOnwardActionList" } }, "required": [ "status", "priority", "created", "updated", "case_rule_id", "alert_rule", "context_list", "targets", "actions_taken" ] }, "DomainAbuseSyncChange": { "type": "object", "description": "The alert's assessments were re-synchronised.", "properties": { "domain": { "type": "string", "description": "The domain whose assessments were synchronised." }, "assessments_before": { "type": "array", "description": "Assessment ids held before the synchronisation.", "items": { "type": "string" } }, "assessments_after": { "type": "array", "description": "Assessment ids held after the synchronisation.", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "domain_abuse_sync_change" ] } }, "required": [ "domain", "assessments_before", "assessments_after", "type" ] }, "DomainAbuseWhoisChange": { "type": "object", "properties": { "domain": { "type": "string" }, "old": { "$ref": "#/$defs/WhoisRecord" }, "new": { "$ref": "#/$defs/WhoisRecord" }, "removed_contacts": { "type": "array", "items": { "$ref": "#/$defs/WhoisContactRecord" } }, "added_contacts": { "type": "array", "items": { "$ref": "#/$defs/WhoisContactRecord" } }, "type": { "type": "string", "enum": [ "whois_change" ] } }, "required": [ "type", "domain", "removed_contacts", "added_contacts" ] }, "DomainAbuseWhoisChangeV2": { "type": "object", "description": "This change only applies to Domain Abuse alerts.", "properties": { "domain": { "type": "string" }, "old_record": { "$ref": "#/$defs/WhoisRecordV2" }, "new_record": { "$ref": "#/$defs/WhoisRecordV2" }, "removed_contacts": { "type": "array", "items": { "$ref": "#/$defs/WhoisContactRecordV2" } }, "added_contacts": { "type": "array", "items": { "$ref": "#/$defs/WhoisContactRecordV2" } }, "type": { "type": "string", "enum": [ "whois_change" ] } }, "required": [ "type", "domain", "removed_contacts", "added_contacts" ] }, "DrpAsset.SubstringTerm": { "type": "object", "description": "Substring/pattern match, optionally constrained to a specific entity type.", "required": [ "type", "text", "position" ], "properties": { "type": { "type": "string", "enum": [ "substring" ] }, "text": { "type": "string", "description": "The term text to match." }, "position": { "type": "string", "description": "Where the text must occur within the matched value.", "enum": [ "prefix", "infix", "suffix" ] }, "entity_type_id": { "type": "string", "description": "Optional entity type to match against." } } }, "EntitiesChange": { "type": "object", "properties": { "removed": { "type": "array", "items": { "type": "string" } }, "added": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "entities_change" ] } }, "required": [ "type" ] }, "EntitiesChangeV2": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "$ref": "#/$defs/Entity" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/Entity" } }, "type": { "type": "string", "enum": [ "entities_change" ] } }, "required": [ "type", "removed", "added" ] }, "Entity": { "type": "object", "properties": { "id": { "type": "string" }, "type": { "type": "string" }, "name": { "type": "string" } }, "required": [ "id", "type" ] }, "EntityPathMatch": { "type": "object", "properties": { "path": { "type": "array", "items": { "type": "object", "properties": { "attribute": { "type": "string" }, "entity": { "type": "string" } }, "required": [ "attribute", "entity" ] } } } }, "ExternalIdChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "external_id_change" ] } }, "required": [ "type" ] }, "FacilityAssessment": { "type": "object", "description": "Facility assessment data", "properties": { "name": { "type": "string" }, "criticality": { "$ref": "#/$defs/PlaybookAlertPriority" } } }, "FacilityEvidence": { "type": "object", "properties": { "cluster_id": { "type": "string" }, "main_event": { "$ref": "#/$defs/FacilityMainEvent" }, "type": { "type": "string", "enum": [ "cluster_change_added" ] }, "other_event_ids": { "type": "array", "items": { "type": "string" } } } }, "FacilityEvidenceChange": { "type": "object", "properties": { "added": { "type": "array", "items": { "$ref": "#/$defs/FacilityEvidence" } }, "type": { "type": "string", "enum": [ "evidence_changes" ] } }, "required": [ "added", "type" ] }, "FacilityMainEvent": { "type": "object", "properties": { "event_id": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/$defs/FacilityAssessment" } }, "type": { "type": "string", "enum": [ "event_change_added" ] } } }, "FacilityRiskChangeContext": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "geopolitics_facility" ] }, "changes": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/FacilityEvidenceChange" }, { "$ref": "#/$defs/ClusterChangeAdded" }, { "$ref": "#/$defs/AssessmentIdsChange" }, { "$ref": "#/$defs/AssigneeChange" }, { "$ref": "#/$defs/StatusChange" }, { "$ref": "#/$defs/PriorityChange" }, { "$ref": "#/$defs/ReopenStrategyChange" }, { "$ref": "#/$defs/TitleChange" }, { "$ref": "#/$defs/EntitiesChange" }, { "$ref": "#/$defs/RelatedEntitiesChange" }, { "$ref": "#/$defs/DescriptionChange" }, { "$ref": "#/$defs/ExternalIdChange" } ] } } }, "required": [ "type", "changes" ] }, "ImageAvailability": { "type": "string", "description": "Image availability status", "enum": [ "Available", "NotFound", "NotDownloaded", "FlaggedForReview", "NotAvailableForLegalReasons", "ScanCompletedAsPositive" ] }, "LogotypeInScreenshot": { "type": "object", "properties": { "logotype": { "type": "string" }, "screenshot": { "type": "string" }, "url": { "type": "string" }, "region": { "type": "object", "properties": { "min_x": { "type": "number" }, "min_y": { "type": "number" }, "max_x": { "type": "number" }, "max_y": { "type": "number" } }, "required": [ "min_x", "min_y", "max_x", "max_y" ] } }, "required": [ "logotype", "screenshot", "url", "region" ] }, "LogotypeInScreenshotV2": { "type": "object", "properties": { "logotype_id": { "type": "string" }, "screenshot_id": { "type": "string" }, "url": { "type": "string" }, "screenshot_width": { "type": "integer", "description": "Width of the screenshot in pixels (when available)." }, "screenshot_height": { "type": "integer", "description": "Height of the screenshot in pixels (when available)." }, "region": { "description": "Bounding box of the detected logotype within the screenshot.", "type": "object", "properties": { "min_x": { "type": "integer" }, "min_y": { "type": "integer" }, "max_x": { "type": "integer" }, "max_y": { "type": "integer" } }, "required": [ "min_x", "min_y", "max_x", "max_y" ] }, "is_high_interest": { "type": "boolean", "description": "True if the logotype belongs to a high-interest brand list." } }, "required": [ "logotype_id", "screenshot_id", "url" ] }, "MaliciousDnsRecord": { "type": "object", "properties": { "id": { "type": "string" }, "assessments": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string" }, "level": { "type": "number" }, "title": { "type": "string" } }, "required": [ "id", "level" ] } } } }, "MaliciousSitesAiTriageChange": { "type": "object", "description": "Indicates an AI triage produced a verdict for the alert, carrying the resulting assessment, the model's rationale, and the scans it analyzed.\n", "properties": { "triage_id": { "type": "string", "description": "Identifier of the triage run that produced this verdict." }, "analyzed_scans": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesAnalyzedScan" } }, "assessment": { "$ref": "#/$defs/MaliciousSitesAssessment" }, "rationale": { "type": "string", "description": "The model's free-text explanation for the verdict." }, "type": { "type": "string", "enum": [ "malicious_sites_ai_triage_change" ] } }, "required": [ "triage_id", "type" ] }, "MaliciousSitesAlertCreatedChange": { "type": "object", "description": "Indicates the alert was created for an attacker.", "properties": { "attacker": { "type": "string", "description": "The attacker domain identity." }, "type": { "type": "string", "enum": [ "malicious_sites_alert_created_change" ] } }, "required": [ "attacker", "type" ] }, "MaliciousSitesAnalyzedScan": { "type": "object", "description": "A screenshot and the URL it was captured from, analyzed by the AI triage.", "properties": { "image": { "type": "string", "description": "The analyzed screenshot image identity." }, "url": { "type": "string", "description": "The URL the screenshot was captured from." } } }, "MaliciousSitesAssessment": { "type": "object", "description": "Malicious Sites assessment", "properties": { "name": { "type": "string", "description": "Assessment title.", "enum": [ "Suggested Takedown", "Phishing/Scam", "Login Form", "High Interest Logo Detection", "Logo Detection", "Screenshot Mention", "Custom Keyword in Screenshot", "Parked / Ad Hosting Website", "Domain for Sale", "Typosquat", "Similar Domain", "Re-Registration", "Active Mail Server", "Review Recommended", "AI Rejected" ] }, "priority": { "$ref": "#/$defs/PlaybookAlertPriority" } }, "required": [ "name", "priority" ] }, "MaliciousSitesAttackerAddedChange": { "type": "object", "description": "Attacker added change for Malicious Sites alerts.", "properties": { "attacker": { "type": "string", "description": "The attacker domain identity." }, "cause": { "$ref": "#/$defs/MaliciousSitesCause" }, "manual_addition_user_id": { "type": "string" }, "manual_addition_user_name": { "type": "string" }, "typosquat_targets": { "type": "array", "items": { "type": "string" } }, "similar_domains_keywords": { "type": "array", "items": { "type": "string" } }, "logotypes": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesLogotype" } }, "type": { "type": "string", "enum": [ "malicious_sites_attacker_added_change" ] } }, "required": [ "attacker", "type" ] }, "MaliciousSitesCause": { "type": "string", "description": "Malicious Sites attacker detection cause.", "enum": [ "manual", "typosquat", "similar_domains", "logotype", "logotype_high_interest", "phishing_verdict", "screenshot_mention", "screenshot_custom_keyword", "login_form", "suggested_takedown" ] }, "MaliciousSitesDetectionCreatedChange": { "type": "object", "description": "Indicates a detection was created for an attacker.", "properties": { "attacker": { "type": "string", "description": "The attacker domain identity." }, "detection_id": { "type": "string", "description": "Identifier of the detection that was created." }, "date": { "type": "string", "format": "date-time", "description": "When the detection was created." }, "type": { "type": "string", "enum": [ "malicious_sites_detection_created_change" ] } }, "required": [ "attacker", "detection_id", "date", "type" ] }, "MaliciousSitesDnsChange": { "type": "object", "description": "DNS change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity." }, "removed": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesDnsChangeRecord" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesDnsChangeRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_dns_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "MaliciousSitesDnsChangeRecord": { "type": "object", "properties": { "type": { "type": "string" }, "entity": { "$ref": "#/$defs/Entity" } } }, "MaliciousSitesForSaleChange": { "type": "object", "description": "Indicates the domain is for sale.", "properties": { "url": { "type": "string" }, "image": { "type": "string" }, "type": { "type": "string", "enum": [ "for_sale_change" ] } }, "required": [ "url", "image", "type" ] }, "MaliciousSitesLogoChange": { "type": "object", "description": "This change only applies to Malicious Sites alerts.", "properties": { "domain": { "type": "string" }, "removed": { "type": "array", "items": { "$ref": "#/$defs/LogotypeInScreenshotV2" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/LogotypeInScreenshotV2" } }, "type": { "type": "string", "enum": [ "malicious_sites_logo_change" ] } }, "required": [ "type", "domain", "removed", "added" ] }, "MaliciousSitesLogoHashChange": { "type": "object", "description": "Indicates logo(s) were detected on a URL via hash matching.", "properties": { "url": { "type": "string" }, "scan": { "type": "string" }, "hashes": { "type": "array", "items": { "type": "string" } }, "brands": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "logo_hash_change" ] } }, "required": [ "url", "hashes", "type" ] }, "MaliciousSitesLogotype": { "type": "object", "description": "A logotype detected in a screenshot of the attacker domain.", "properties": { "logotype_id": { "type": "string", "description": "Entity identity of the logotype." }, "screenshot_id": { "type": "string", "description": "Image identity of the screenshot containing the logotype." }, "url": { "type": "string", "description": "URL associated with the logotype." }, "screenshot_width": { "type": "integer", "description": "Width of the screenshot in pixels." }, "screenshot_height": { "type": "integer", "description": "Height of the screenshot in pixels." }, "region": { "$ref": "#/$defs/MaliciousSitesLogotypeRegion" }, "is_high_interest": { "type": "boolean", "description": "Whether this logotype is considered high interest." } }, "required": [ "logotype_id", "screenshot_id", "url" ] }, "MaliciousSitesLogotypeRegion": { "type": "object", "description": "Bounding box region of the logotype within the screenshot.", "properties": { "min_x": { "type": "integer", "description": "Minimum X coordinate of the bounding box." }, "min_y": { "type": "integer", "description": "Minimum Y coordinate of the bounding box." }, "max_x": { "type": "integer", "description": "Maximum X coordinate of the bounding box." }, "max_y": { "type": "integer", "description": "Maximum Y coordinate of the bounding box." } }, "required": [ "min_x", "min_y", "max_x", "max_y" ] }, "MaliciousSitesMaliciousDnsChange": { "type": "object", "description": "Malicious DNS change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity." }, "removed": { "type": "array", "items": { "$ref": "#/$defs/MaliciousDnsRecord" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/MaliciousDnsRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_malicious_dns_change" ] } }, "required": [ "domain", "type", "removed", "added" ] }, "MaliciousSitesMaliciousUrlChange": { "type": "object", "description": "Malicious URL change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity." }, "removed": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesMaliciousUrlRecord" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesMaliciousUrlRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_malicious_url_change" ] } }, "required": [ "domain", "removed", "added", "type" ] }, "MaliciousSitesMaliciousUrlRecord": { "type": "object", "properties": { "url": { "type": "string", "description": "The URL identity." }, "assessments": { "type": "array", "items": { "$ref": "#/$defs/AssessmentWithSource" } } } }, "MaliciousSitesMatchPathElement": { "type": "object", "description": "One element of a match path.", "properties": { "attribute": { "type": "string", "description": "The attribute linking this element to the previous one." }, "entities": { "type": "array", "items": { "type": "string", "description": "Entity identity." } } }, "required": [ "attribute", "entities" ] }, "MaliciousSitesParkedChange": { "type": "object", "description": "Indicates the domain is parked.", "properties": { "url": { "type": "string" }, "image": { "type": "string" }, "type": { "type": "string", "enum": [ "parked_change" ] } }, "required": [ "url", "image", "type" ] }, "MaliciousSitesPhishingVerdictChange": { "type": "object", "description": "Indicates a phishing verdict was detected.", "properties": { "domain": { "type": "string" }, "url": { "type": "string" }, "risk_rule": { "type": "string" }, "ttps": { "type": "array", "items": { "type": "string" } }, "brands": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "phishing_verdict_change" ] } }, "required": [ "risk_rule", "ttps", "brands", "type" ] }, "MaliciousSitesReregistrationChange": { "type": "object", "description": "Reregistration change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity." }, "removed": { "$ref": "#/$defs/ReregistrationRecord" }, "added": { "$ref": "#/$defs/ReregistrationRecord" }, "type": { "type": "string", "enum": [ "malicious_sites_reregistration_change" ] } }, "required": [ "domain", "type" ] }, "MaliciousSitesScreenshotMentionChange": { "type": "object", "description": "Indicates mentions found in a screenshot.", "properties": { "url": { "type": "string" }, "scan": { "type": "string" }, "screenshot": { "type": "string" }, "mentions": { "type": "array", "items": { "type": "string" } }, "texts": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "malicious_sites_screenshot_mention_change" ] } }, "required": [ "url", "scan", "screenshot", "mentions", "texts", "type" ] }, "MaliciousSitesSimilarDomainChange": { "type": "object", "description": "Indicates the attacker domain was detected as similar to the customer's watched keywords. Carries all matched keyword terms.\n", "properties": { "domain": { "type": "string", "description": "The attacker domain identity." }, "substring_terms": { "type": "array", "items": { "$ref": "#/$defs/DrpAsset.SubstringTerm" } }, "type": { "type": "string", "enum": [ "malicious_sites_similar_domain_change" ] } }, "required": [ "domain", "substring_terms", "type" ] }, "MaliciousSitesSuggestedTakedownChange": { "type": "object", "description": "Indicates a takedown is suggested.", "properties": { "has_phishing_verdict": { "type": "boolean" }, "has_high_interest_logo": { "type": "boolean" }, "has_login_form": { "type": "boolean" }, "screenshot": { "type": "string" }, "type": { "type": "string", "enum": [ "suggested_takedown_change" ] } }, "required": [ "has_phishing_verdict", "has_high_interest_logo", "has_login_form", "type" ] }, "MaliciousSitesSyncChange": { "type": "object", "description": "The alert's assessments were re-synchronised from its underlying detection. This change only applies to Malicious Sites alerts.\n", "properties": { "domain": { "type": "string", "description": "The domain whose assessments were synchronised." }, "assessments_before": { "type": "array", "description": "Assessment ids held before the synchronisation.", "items": { "type": "string" } }, "assessments_after": { "type": "array", "description": "Assessment ids held after the synchronisation.", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "malicious_sites_sync_change" ] } }, "required": [ "domain", "assessments_before", "assessments_after", "type" ] }, "MaliciousSitesTyposquatChange": { "type": "object", "description": "Indicates the attacker domain was detected as a typosquat of the customer's watched domains. Carries all matched target domains, each with the match paths explaining the detection.\n", "properties": { "domain": { "type": "string", "description": "The attacker domain identity." }, "targets": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesTyposquatTarget" } }, "type": { "type": "string", "enum": [ "malicious_sites_typosquat_change" ] } }, "required": [ "domain", "targets", "type" ] }, "MaliciousSitesTyposquatTarget": { "type": "object", "description": "A watched domain the attacker was matched against.", "properties": { "target": { "type": "string", "description": "The watched target domain identity." }, "match_paths": { "type": "array", "description": "Match paths explaining the detection. Each path is a chain of elements from the attacker to the monitored asset.\n", "items": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesMatchPathElement" } } } }, "required": [ "target" ] }, "MaliciousSitesWhoisChange": { "type": "object", "description": "Whois change for Malicious Sites alerts.", "properties": { "domain": { "type": "string", "description": "The domain identity." }, "old_record": { "$ref": "#/$defs/MaliciousSitesWhoisRecord" }, "new_record": { "$ref": "#/$defs/MaliciousSitesWhoisRecord" }, "removed_contacts": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesWhoisContactRecord" } }, "added_contacts": { "type": "array", "items": { "$ref": "#/$defs/MaliciousSitesWhoisContactRecord" } }, "type": { "type": "string", "enum": [ "malicious_sites_whois_change" ] } }, "required": [ "type", "domain", "removed_contacts", "added_contacts" ] }, "MaliciousSitesWhoisContactRecord": { "type": "object", "properties": { "type": { "type": "string" }, "telephone": { "type": "string" }, "street1": { "type": "string" }, "state": { "type": "string" }, "postal_code": { "type": "string" }, "organization": { "type": "string" }, "name": { "type": "string" }, "fax": { "type": "string" }, "email": { "type": "string" }, "country_code": { "type": "string" }, "country": { "type": "string" }, "city": { "type": "string" }, "created": { "type": "string", "format": "date-time" } } }, "MaliciousSitesWhoisRecord": { "type": "object", "properties": { "status": { "type": "string" }, "registrar_name": { "type": "string" }, "private_registration": { "type": "boolean" }, "name_servers": { "type": "array", "items": { "type": "string" } }, "contact_email": { "type": "string" }, "created": { "type": "string", "format": "date-time" }, "updated": { "type": "string", "format": "date-time" }, "expires": { "type": "string", "format": "date-time" } } }, "MaliciousUrlRecord": { "type": "object", "properties": { "url": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/$defs/AssessmentWithSource" } } } }, "MentionedEntity": { "type": "object", "properties": { "entity": { "$ref": "#/$defs/Entity" }, "reference": { "type": "string" }, "fragment": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/$defs/AssessmentWithSource" } } }, "required": [ "entity", "reference", "fragment" ] }, "MentionedText": { "type": "object", "properties": { "text": { "type": "string" }, "reference": { "type": "string" }, "fragment": { "type": "string" }, "assessments": { "type": "array", "items": { "$ref": "#/$defs/AssessmentWithSource" } } }, "required": [ "text", "reference", "fragment" ] }, "OnwardActionId": { "type": "string", "description": "The id for the type of action taken. The possible values can be found in the response from metadata/common in actions_by_category field. The action ids possible can grow over time\n" }, "PlaybookAlertActionPanel": { "deprecated": true, "type": "array", "description": "Deprecated and replaced by Onward actions\n", "items": { "type": "object", "properties": { "action": { "description": "The name of the action.", "type": "string" }, "updated": { "description": "When the action was last updated.", "type": "string", "format": "date-time" }, "assignee_name": { "$ref": "#/$defs/PlaybookAlertAssigneeName" }, "assignee_id": { "$ref": "#/$defs/PlaybookAlertAssigneeId" }, "status": { "$ref": "#/$defs/PlaybookAlertStatus" }, "description": { "type": "string", "description": "A short description of the action." }, "link": { "type": "string", "description": "A link associated with the action." } } } }, "PlaybookAlertAlertRule": { "type": "object", "properties": { "id": { "$ref": "#/$defs/PlaybookAlertRuleId" }, "label": { "$ref": "#/$defs/PlaybookAlertRuleLabel" }, "name": { "$ref": "#/$defs/PlaybookAlertRuleName" } }, "required": [ "id", "label" ] }, "PlaybookAlertAssigneeId": { "description": "ID of the assignee", "type": "string" }, "PlaybookAlertAssigneeName": { "description": "Full name of the assignee", "type": "string" }, "PlaybookAlertAuthorId": { "description": "Id of the author", "type": "string" }, "PlaybookAlertAuthorName": { "description": "Full name of the author", "type": "string" }, "PlaybookAlertCaseRuleId": { "description": "The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field)", "deprecated": true, "type": "string" }, "PlaybookAlertCaseRuleLabel": { "description": "The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user.\n (Deprecated, use 'alertRule.label' field)\n", "deprecated": true, "type": "string", "enum": [ "Domain Abuse", "Malicious Sites", "Cyber Vulnerability", "Data Leakage on Code Repository", "Compromised Bank Check", "Geopolitics Facility", "Novel Identity Exposure", "Third Party Risk", "Malware Report", "Dark Web Brand", "Social Media Impersonation" ] }, "PlaybookAlertContextList": { "description": "A list of malicious behavior types the entity is associated with.", "type": "array", "items": { "properties": { "context": { "type": "string", "enum": [ "Active Mail Server", "Default or Common Mail Server", "C&C Server", "Phishing Host", "Phishing / Malicious behavior", "Parked / Ad hosting website", "Domain for sale", "Logotype detected", "Domain reregistration", "Login Form", "Screenshot mention" ], "description": "Contexts are labels of malicious behavior types that can be associated with an entity." } } } }, "PlaybookAlertCreated": { "description": "The Creation time of the Playbook Alert", "type": "string", "format": "date-time" }, "PlaybookAlertCreatorId": { "description": "Id of the Creator of the Playbook Alert", "type": "string" }, "PlaybookAlertCreatorName": { "description": "Full name of the Creator of the Playbook Alert", "type": "string" }, "PlaybookAlertEnterpriseId": { "description": "Id of the Enterprise", "type": "string" }, "PlaybookAlertEnterpriseName": { "description": "Name of the Enterprise", "type": "string" }, "PlaybookAlertEntityCriticality": { "type": "string", "enum": [ "Low", "Medium", "High", "Critical", "Very Critical" ], "description": "Label indicating risk criticality for the entity" }, "PlaybookAlertEntityScore": { "type": "integer", "description": "Risk score assigned to the entity", "maximum": 99, "minimum": 0 }, "PlaybookAlertImage": { "description": "An image associated with the Playbook Alert", "type": "object", "properties": { "description": { "type": "string" }, "image_id": { "type": "string", "description": "The id of the image" }, "created": { "type": "string", "format": "date-time", "description": "When the image was created." }, "availability": { "$ref": "#/$defs/ImageAvailability" }, "tag": { "type": "string", "description": "Image analysis tag.", "enum": [ "Active Mail Server", "Default or Common Mail Server", "C&C Server", "Phishing Host", "Parked / Ad hosting website", "Domain for sale", "Logotype detected", "Domain reregistration", "Login Form", "Screenshot mention" ] } }, "required": [ "description", "created", "image_id", "availability" ] }, "PlaybookAlertImageList": { "description": "A list of images associated with the Playbook Alert", "type": "array", "items": { "$ref": "#/$defs/PlaybookAlertImage" } }, "PlaybookAlertLogPanel": { "type": "array", "description": "Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries. This version is deprecated and will be removed completely in future updates.\n", "deprecated": true, "items": { "type": "object", "properties": { "id": { "type": "string" }, "actor_name": { "$ref": "#/$defs/PlaybookAlertAuthorName" }, "actor_id": { "$ref": "#/$defs/PlaybookAlertAuthorId" }, "created": { "type": "string", "format": "date-time" }, "modified": { "type": "string", "format": "date-time" }, "action_priority": { "$ref": "#/$defs/PlaybookAlertPriority" }, "message": { "type": "string", "description": "Log message" }, "changes": { "$ref": "#/$defs/PlaybookAlertLogPanelChanges" }, "context": { "oneOf": [ { "$ref": "#/$defs/DomainAbuseChangeContext" }, { "$ref": "#/$defs/VulnerabilityChangeContext" }, { "$ref": "#/$defs/CodeRepoLeakageChangeContext" }, { "$ref": "#/$defs/ThirdPartyRiskChangeContext" }, { "$ref": "#/$defs/FacilityRiskChangeContext" } ] } } } }, "PlaybookAlertLogPanelChanges": { "type": "object", "deprecated": true, "properties": { "assignee_change": { "$ref": "#/$defs/AssigneeChange" }, "status_change": { "$ref": "#/$defs/StatusChange" }, "priority_change": { "$ref": "#/$defs/PriorityChange" }, "reopen_strategy_change": { "$ref": "#/$defs/ReopenStrategyChange" }, "title_change": { "$ref": "#/$defs/TitleChange" }, "entities_change": { "$ref": "#/$defs/EntitiesChange" }, "related_entities_change": { "$ref": "#/$defs/RelatedEntitiesChange" }, "description_change": { "$ref": "#/$defs/DescriptionChange" }, "external_id_change": { "$ref": "#/$defs/ExternalIdChange" }, "actions_change": { "$ref": "#/$defs/ActionChange" }, "assessment_ids_change": { "$ref": "#/$defs/AssessmentIdsChange" } } }, "PlaybookAlertLogPanelV2": { "type": "array", "description": "Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries.\n", "items": { "type": "object", "properties": { "id": { "type": "string" }, "author_id": { "$ref": "#/$defs/PlaybookAlertAuthorId" }, "author_name": { "$ref": "#/$defs/PlaybookAlertAuthorName" }, "created": { "type": "string", "format": "date-time" }, "changes": { "type": "array", "items": { "oneOf": [ { "$ref": "#/$defs/AssigneeChangeV2" }, { "$ref": "#/$defs/CustomStatusChange" }, { "$ref": "#/$defs/PriorityChange" }, { "$ref": "#/$defs/ReopenStrategyChange" }, { "$ref": "#/$defs/TitleChange" }, { "$ref": "#/$defs/EntitiesChangeV2" }, { "$ref": "#/$defs/RelatedEntitiesChangeV2" }, { "$ref": "#/$defs/DescriptionChange" }, { "$ref": "#/$defs/ExternalIdChange" }, { "$ref": "#/$defs/CommentChange" }, { "$ref": "#/$defs/ActionChange" }, { "$ref": "#/$defs/AssessmentIdsChange" }, { "$ref": "#/$defs/CustomOnwardActionsRemovedChange" }, { "$ref": "#/$defs/CustomOnwardActionsAddedChange" }, { "$ref": "#/$defs/DomainAbuseDnsChangeV2" }, { "$ref": "#/$defs/DomainAbuseWhoisChangeV2" }, { "$ref": "#/$defs/DomainAbuseLogotypeChangeV2" }, { "$ref": "#/$defs/DomainAbuseMaliciousDnsChangeV2" }, { "$ref": "#/$defs/DomainAbuseReregistrationChange" }, { "$ref": "#/$defs/DomainAbuseMaliciousUrlChange" }, { "$ref": "#/$defs/DomainAbuseScreenshotMentionsChange" }, { "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorChange" }, { "$ref": "#/$defs/DomainAbuseAttackerAddedChange" }, { "$ref": "#/$defs/DomainAbuseSyncChange" }, { "$ref": "#/$defs/MaliciousSitesAttackerAddedChange" }, { "$ref": "#/$defs/MaliciousSitesDnsChange" }, { "$ref": "#/$defs/MaliciousSitesWhoisChange" }, { "$ref": "#/$defs/MaliciousSitesMaliciousDnsChange" }, { "$ref": "#/$defs/MaliciousSitesReregistrationChange" }, { "$ref": "#/$defs/MaliciousSitesMaliciousUrlChange" }, { "$ref": "#/$defs/MaliciousSitesForSaleChange" }, { "$ref": "#/$defs/MaliciousSitesParkedChange" }, { "$ref": "#/$defs/MaliciousSitesLogoHashChange" }, { "$ref": "#/$defs/MaliciousSitesScreenshotMentionChange" }, { "$ref": "#/$defs/MaliciousSitesPhishingVerdictChange" }, { "$ref": "#/$defs/MaliciousSitesSuggestedTakedownChange" }, { "$ref": "#/$defs/MaliciousSitesLogoChange" }, { "$ref": "#/$defs/MaliciousSitesTyposquatChange" }, { "$ref": "#/$defs/MaliciousSitesSimilarDomainChange" }, { "$ref": "#/$defs/MaliciousSitesAiTriageChange" }, { "$ref": "#/$defs/MaliciousSitesAlertCreatedChange" }, { "$ref": "#/$defs/MaliciousSitesDetectionCreatedChange" }, { "$ref": "#/$defs/MaliciousSitesSyncChange" }, { "$ref": "#/$defs/VulnerabilityLifecycleChangeV2" }, { "$ref": "#/$defs/CodeRepoLeakageEvidenceChangeV2" }, { "$ref": "#/$defs/ThirdPartyAssessmentChangeV2" }, { "$ref": "#/$defs/ThirdPartyAssessmentChangeV3" }, { "$ref": "#/$defs/FacilityEvidenceChange" }, { "$ref": "#/$defs/ClusterChangeAdded" } ] } } }, "required": [ "id", "created", "changes" ] } }, "PlaybookAlertOnwardActionList": { "type": "array", "items": { "$ref": "#/$defs/OnwardActionId" } }, "PlaybookAlertOrganisation": { "type": "object", "properties": { "organisation_id": { "$ref": "#/$defs/PlaybookAlertOrganisationId2" }, "organisation_name": { "$ref": "#/$defs/PlaybookAlertOrganisationName2" } } }, "PlaybookAlertOrganisationId": { "description": "Id of the Organisation", "type": "string", "deprecated": true }, "PlaybookAlertOrganisationId2": { "description": "Id of the Organisation", "type": "string" }, "PlaybookAlertOrganisationName": { "description": "Name of the Organisation", "type": "string", "deprecated": true }, "PlaybookAlertOrganisationName2": { "description": "Name of the Organisation", "type": "string" }, "PlaybookAlertOwnerId": { "description": "Id of the owner", "type": "string", "deprecated": true }, "PlaybookAlertOwnerName": { "description": "Name of the owner", "type": "string", "deprecated": true }, "PlaybookAlertOwnerOrganisationDetails": { "type": "object", "properties": { "organisations": { "type": "array", "items": { "$ref": "#/$defs/PlaybookAlertOrganisation" } }, "enterprise_id": { "$ref": "#/$defs/PlaybookAlertEnterpriseId" }, "enterprise_name": { "$ref": "#/$defs/PlaybookAlertEnterpriseName" } } }, "PlaybookAlertPriority": { "type": "string", "enum": [ "High", "Moderate", "Informational" ], "description": "The priority of the Playbook Alert." }, "PlaybookAlertReopenStrategy": { "type": "string", "description": "Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved.\n\nThe following combinations of status/reopen are allowed:\n\n* Dismissed -> Never\n* Resolved -> Never\n* Resolved -> SignificantUpdates\n", "enum": [ "Never", "SignificantUpdates" ] }, "PlaybookAlertRuleId": { "description": "The Rule ID that created the Playbook Alert (without the 'report:' prefix)", "type": "string" }, "PlaybookAlertRuleLabel": { "description": "The Rule label that created the Playbook Alert. `Undefined` option can be returned in case the rule data is missing.\n", "type": "string", "enum": [ "DomainAbuse", "MaliciousSites", "CyberVulnerability", "DataLeakageOnCodeRepository", "CompromisedBankCheck", "GeopoliticsFacility", "NovelIdentityExposure", "ThirdPartyRisk", "MalwareReport", "DarkWebBrand", "SocmedImpersonation", "Undefined" ] }, "PlaybookAlertRuleName": { "description": "The Rule name (if defined) that created the Playbook Alert", "type": "string" }, "PlaybookAlertStatus": { "type": "string", "enum": [ "New", "InProgress", "Dismissed", "Resolved" ], "description": "The status of the Playbook Alert." }, "PlaybookAlertUpdated": { "description": "The Update time of the Playbook Alert", "type": "string", "format": "date-time" }, "PriorityChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "priority_change" ] } }, "required": [ "type", "old", "new" ] }, "RelatedEntitiesChange": { "type": "object", "properties": { "removed": { "type": "array", "items": { "type": "string" } }, "added": { "type": "array", "items": { "type": "string" } }, "type": { "type": "string", "enum": [ "related_entities_change" ] } }, "required": [ "type" ] }, "RelatedEntitiesChangeV2": { "type": "object", "description": "This change applies to any alert type.", "properties": { "removed": { "type": "array", "items": { "$ref": "#/$defs/Entity" } }, "added": { "type": "array", "items": { "$ref": "#/$defs/Entity" } }, "type": { "type": "string", "enum": [ "related_entities_change" ] } }, "required": [ "type", "removed", "added" ] }, "ReopenStrategyChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "reopen_strategy_change" ] } }, "required": [ "type" ] }, "ReregistrationRecord": { "type": "object", "properties": { "registrar": { "type": "string" }, "registrar_name": { "type": "string" }, "iana_id": { "type": "string" }, "expiration": { "type": "string", "format": "date-time" } } }, "StatusChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "status_change" ] } }, "required": [ "type", "old", "new" ] }, "ThirdPartyAssessmentChange": { "type": "object", "properties": { "risk_attribute": { "type": "string" }, "assessment_name": { "type": "string" }, "type": { "type": "string", "enum": [ "tpr_assessment_change" ] }, "added": { "$ref": "#/$defs/ThirdPartyRiskEvidenceChange" }, "removed": { "$ref": "#/$defs/ThirdPartyRiskEvidenceChange" } }, "required": [ "risk_attribute", "type" ] }, "ThirdPartyAssessmentChangeV2": { "type": "object", "description": "This change only applies to Third Party Risk alerts.", "properties": { "risk_attribute": { "type": "string" }, "added": { "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2" }, "removed": { "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2" }, "type": { "type": "string", "enum": [ "tpr_assessment_change" ] } }, "required": [ "risk_attribute", "type" ] }, "ThirdPartyAssessmentChangeV3": { "type": "object", "description": "This change only applies to Third Party Risk alerts.", "properties": { "risk_attribute": { "type": "string" }, "assessment_name": { "type": "string" }, "added": { "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2" }, "removed": { "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2" }, "type": { "type": "string", "enum": [ "assessment_change" ] } }, "required": [ "risk_attribute", "type" ] }, "ThirdPartyRiskChangeContext": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "third_party_risk" ] }, "changes": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/ThirdPartyAssessmentChange" }, { "$ref": "#/$defs/AssigneeChange" }, { "$ref": "#/$defs/StatusChange" }, { "$ref": "#/$defs/PriorityChange" }, { "$ref": "#/$defs/ReopenStrategyChange" }, { "$ref": "#/$defs/TitleChange" }, { "$ref": "#/$defs/EntitiesChange" }, { "$ref": "#/$defs/RelatedEntitiesChange" }, { "$ref": "#/$defs/DescriptionChange" }, { "$ref": "#/$defs/ExternalIdChange" } ] } } }, "required": [ "type", "changes" ] }, "ThirdPartyRiskEvidenceChange": { "type": "object", "properties": { "level": { "type": "integer" }, "evidence_string": { "type": "string" }, "added": { "type": "string", "format": "date-time", "description": "Timestamp when this evidence first appeared." }, "removed": { "type": "string", "format": "date-time", "description": "Timestamp when this evidence was removed." } }, "required": [ "level" ] }, "ThirdPartyRiskEvidenceChangeV2": { "type": "object", "properties": { "level": { "type": "integer" }, "evidence_string": { "type": "string" }, "timestamp": { "type": "string", "format": "date-time" } }, "required": [ "level" ] }, "TitleChange": { "type": "object", "description": "This change applies to any alert type.", "properties": { "old": { "type": "string" }, "new": { "type": "string" }, "type": { "type": "string", "enum": [ "title_change" ] } }, "required": [ "type" ] }, "VulnerabilityAssessment": { "type": "object", "properties": { "id": { "type": "string" }, "level": { "type": "number" }, "title": { "type": "string" } }, "required": [ "id", "level" ] }, "VulnerabilityChangeContext": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "cyber_vulnerability" ] }, "changes": { "type": "array", "items": { "anyOf": [ { "$ref": "#/$defs/VulnerabilityLifecycleChange" }, { "$ref": "#/$defs/AssigneeChange" }, { "$ref": "#/$defs/StatusChange" }, { "$ref": "#/$defs/PriorityChange" }, { "$ref": "#/$defs/ReopenStrategyChange" }, { "$ref": "#/$defs/TitleChange" }, { "$ref": "#/$defs/EntitiesChange" }, { "$ref": "#/$defs/RelatedEntitiesChange" }, { "$ref": "#/$defs/DescriptionChange" }, { "$ref": "#/$defs/ExternalIdChange" } ] } } }, "required": [ "type", "changes" ] }, "VulnerabilityLifecycleChange": { "type": "object", "properties": { "added": { "$ref": "#/$defs/VulnerabilityAssessment" }, "removed": { "$ref": "#/$defs/VulnerabilityAssessment" }, "triggered_by_risk_rule": { "type": "string" }, "type": { "type": "string", "enum": [ "lifecycle_in_cve_change" ] } }, "required": [ "type" ] }, "VulnerabilityLifecycleChangeV2": { "type": "object", "description": "This change only applies to Vulnerability alerts.", "properties": { "added": { "$ref": "#/$defs/VulnerabilityAssessment" }, "removed": { "$ref": "#/$defs/VulnerabilityAssessment" }, "triggered_by_risk_rule": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "description": { "type": "string" }, "evidence_string": { "type": "string" }, "machine_name": { "type": "string", "enum": [ "recentMalwareActivity", "vendorCritical", "nistCritical", "malwareActivity", "recentPocVerifiedRemote", "historicMalwareActivity", "recentAnalystNote", "vendorHigh", "nistHigh", "recentPocVerified", "vendorMedium", "nistMedium", "recentLikelyExploitDevelopment", "recentScannerUptake", "linkedToRecentExploitKit", "linkedToRecentRAT", "linkedToRecentRansomware", "linkedToRecentIntrusionMethod", "noCvssScore", "pocVerifiedRemote", "recentPocUnverified", "pocVerified", "vendorLow", "nistLow", "likelyExploitDevelopment", "linkedToRecentCyberExploit", "linkedToCyberExploit", "scannerUptake", "linkedToExploitKit", "linkedToRAT", "linkedToRansomware", "linkedToIntrusionMethod", "recentRelatedNote", "analystNote", "relatedNote", "awaitingCvssScore", "pocUnverified", "cyberSignalCritical", "cyberSignalHigh", "cyberSignalMedium" ] }, "timestamp": { "type": "string", "format": "date-time" } }, "required": [ "id" ] }, "type": { "type": "string", "enum": [ "lifecycle_in_cve_change" ] } }, "required": [ "type" ] }, "WhoIsAttributeItem": { "type": "object", "properties": { "provider": { "type": "string" }, "entity": { "type": "string" }, "attribute": { "type": "string", "enum": [ "attr:whois", "attr:whoisContacts" ] }, "value": { "oneOf": [ { "type": "object", "description": "Attribute value for attr:whois", "not": { "required": [ "type" ] }, "properties": { "status": { "type": "string" }, "registrarName": { "type": "string" }, "privateRegistration": { "type": "boolean" }, "nameServers": { "type": "array", "items": { "type": "string" } }, "contactEmail": { "type": "string", "format": "email" }, "createdDate": { "type": "string", "format": "date-time" }, "updatedDate": { "type": "string", "format": "date-time" }, "expiresDate": { "type": "string", "format": "date-time" } } }, { "type": "object", "description": "Attribute value for attr:whoisContacts", "properties": { "type": { "type": "string", "enum": [ "technicalContact", "registrant", "organization", "administrativeContact" ] }, "telephone": { "type": "string" }, "street1": { "type": "string" }, "state": { "type": "string" }, "postalCode": { "type": "string" }, "organization": { "type": "string" }, "name": { "type": "string" }, "fax": { "type": "string" }, "email": { "type": "string" }, "countryCode": { "type": "string" }, "country": { "type": "string" }, "city": { "type": "string" } }, "required": [ "type" ] } ] }, "added": { "type": "string", "format": "date-time" }, "removed": { "type": "string", "format": "date-time" } }, "required": [ "provider", "entity", "attribute", "value" ] }, "WhoisContactRecord": { "type": "object", "properties": { "type": { "type": "string" }, "telephone": { "type": "string" }, "street1": { "type": "string" }, "state": { "type": "string" }, "postal_code": { "type": "string" }, "organization": { "type": "string" }, "name": { "type": "string" }, "fax": { "type": "string" }, "email": { "type": "string" }, "country_code": { "type": "string" }, "country": { "type": "string" }, "city": { "type": "string" }, "created": { "type": "string", "format": "date-time" } }, "required": [ "type" ] }, "WhoisContactRecordV2": { "type": "object", "properties": { "type": { "type": "string" }, "telephone": { "type": "string" }, "street1": { "type": "string" }, "state": { "type": "string" }, "postal_code": { "type": "string" }, "organization": { "type": "string" }, "name": { "type": "string" }, "fax": { "type": "string" }, "email": { "type": "string" }, "country_code": { "type": "string" }, "country": { "type": "string" }, "city": { "type": "string" }, "created": { "type": "string", "format": "date-time" } }, "required": [ "type" ] }, "WhoisRecord": { "type": "object", "properties": { "status": { "type": "string" }, "registrar_name": { "type": "string" }, "private_registration": { "type": "boolean" }, "name_servers": { "type": "array", "items": { "type": "string" } }, "contact_email": { "type": "string" }, "created": { "type": "string", "format": "date-time" } }, "required": [ "name_servers" ] }, "WhoisRecordV2": { "type": "object", "properties": { "status": { "type": "string" }, "registrar_name": { "type": "string" }, "private_registration": { "type": "boolean" }, "name_servers": { "type": "array", "items": { "type": "string" } }, "contact_email": { "type": "string" }, "created": { "type": "string", "format": "date-time" } }, "required": [ "name_servers" ] } } }