{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/recorded-future/main/json-schema/recorded-future-malicious-sites-response-schema.json",
  "title": "MaliciousSitesResponse",
  "x-generated": "2026-10-20",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/recorded-future-playbook-alerts-api-openapi.yml#/components/schemas/MaliciousSitesResponse",
  "type": "object",
  "required": [
    "playbook_alert_id"
  ],
  "properties": {
    "playbook_alert_id": {
      "type": "string"
    },
    "panel_status": {
      "$ref": "#/$defs/MaliciousSitesStatusPanel"
    },
    "panel_evidence_summary": {
      "$ref": "#/$defs/MaliciousSitesEvidenceSummaryPanel"
    },
    "panel_evidence_dns": {
      "$ref": "#/$defs/MaliciousSitesEvidenceDnsPanel"
    },
    "panel_evidence_whois": {
      "$ref": "#/$defs/MaliciousSitesEvidenceWhoisPanel"
    },
    "panel_triage": {
      "$ref": "#/$defs/MaliciousSitesTriagePanel"
    },
    "panel_log_v2": {
      "$ref": "#/$defs/PlaybookAlertLogPanelV2"
    }
  },
  "$defs": {
    "ActionChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "action_change"
          ]
        }
      },
      "required": [
        "type",
        "removed",
        "added"
      ]
    },
    "AssessmentIdsChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "assessment_ids_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "AssessmentSource": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "id"
      ]
    },
    "AssessmentWithSource": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "level": {
          "type": "number"
        },
        "source": {
          "$ref": "#/$defs/AssessmentSource"
        },
        "title": {
          "type": "string"
        }
      },
      "required": [
        "id",
        "level",
        "source"
      ]
    },
    "Assignee": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "id"
      ]
    },
    "AssigneeChangeV2": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "$ref": "#/$defs/Assignee"
        },
        "new": {
          "$ref": "#/$defs/Assignee"
        },
        "type": {
          "type": "string",
          "enum": [
            "assignee_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "ClusterChangeAdded": {
      "type": "object",
      "description": "Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert.\n",
      "properties": {
        "cluster_id": {
          "type": "string"
        },
        "main_event": {
          "type": "object",
          "properties": {
            "event_id": {
              "type": "string"
            },
            "assessments": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/FacilityAssessment"
              }
            },
            "type": {
              "type": "string",
              "enum": [
                "event_change_added"
              ]
            }
          },
          "required": [
            "event_id",
            "type"
          ]
        },
        "other_event_ids": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "cluster_change_added"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "CodeRepoLeakageAssessmentV2": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "level": {
          "type": "number"
        },
        "title": {
          "type": "string"
        },
        "text_indicator": {
          "type": "string"
        },
        "entity": {
          "$ref": "#/$defs/Entity"
        }
      },
      "required": [
        "id",
        "level"
      ]
    },
    "CodeRepoLeakageEvidenceChangeV2": {
      "type": "object",
      "description": "This change only applies to Data Leakage on Code Repository alerts.",
      "properties": {
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/CodeRepoLeakageEvidenceV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "evidence_change"
          ]
        }
      },
      "required": [
        "added",
        "type"
      ]
    },
    "CodeRepoLeakageEvidenceV2": {
      "type": "object",
      "properties": {
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/CodeRepoLeakageAssessmentV2"
          }
        },
        "document": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string"
            },
            "content": {
              "type": "string"
            },
            "owner_id": {
              "type": "string"
            },
            "owner_name": {
              "type": "string"
            },
            "published": {
              "type": "string",
              "format": "date-time"
            }
          },
          "required": [
            "id",
            "content",
            "owner_id",
            "published"
          ]
        },
        "target_entities": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "watch_lists": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "name": {
                "type": "string"
              }
            },
            "required": [
              "id"
            ]
          }
        }
      },
      "required": [
        "assessments",
        "document",
        "target_entities",
        "watch_lists"
      ]
    },
    "CommentChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "comment": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "comment_change"
          ]
        }
      },
      "required": [
        "type",
        "comment"
      ]
    },
    "CustomOnwardActionsAddedChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "added_actions_taken": {
          "$ref": "#/$defs/PlaybookAlertOnwardActionList"
        },
        "type": {
          "type": "string",
          "enum": [
            "onward_actions_added_change"
          ]
        }
      }
    },
    "CustomOnwardActionsRemovedChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed_actions_taken": {
          "$ref": "#/$defs/PlaybookAlertOnwardActionList"
        },
        "type": {
          "type": "string",
          "enum": [
            "onward_actions_removed_change"
          ]
        }
      }
    },
    "CustomStatusChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "status_change"
          ]
        },
        "actions_taken": {
          "$ref": "#/$defs/PlaybookAlertOnwardActionList"
        }
      },
      "required": [
        "type",
        "old",
        "new",
        "actions_taken"
      ]
    },
    "DescriptionChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "description_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "DnsRecordV2": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string"
        },
        "entity": {
          "$ref": "#/$defs/Entity"
        }
      }
    },
    "DomainAbuseAttackerAddedChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "attacker": {
          "type": "string"
        },
        "cause": {
          "$ref": "#/$defs/DomainAbuseCause"
        },
        "manual_addition_user_id": {
          "type": "string"
        },
        "manual_addition_user_name": {
          "type": "string"
        },
        "typosquat_targets": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "similar_domains_keywords": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "attacker_added_change"
          ]
        }
      },
      "required": [
        "attacker",
        "type"
      ]
    },
    "DomainAbuseCause": {
      "type": "string",
      "description": "Domain Abuse attacker detection cause.",
      "enum": [
        "manual",
        "typosquat",
        "similar_domains"
      ]
    },
    "DomainAbuseDnsChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DnsRecordV2"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DnsRecordV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "dns_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed",
        "added"
      ]
    },
    "DomainAbuseLogotypeChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogotypeInScreenshotV2"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogotypeInScreenshotV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "logotype_in_screenshot_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed",
        "added"
      ]
    },
    "DomainAbuseMaliciousDnsChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousDnsRecord"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousDnsRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_dns_change"
          ]
        }
      },
      "required": [
        "domain",
        "type",
        "removed",
        "added"
      ]
    },
    "DomainAbuseMaliciousUrlChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousUrlRecord"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousUrlRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_url_change"
          ]
        }
      },
      "required": [
        "domain",
        "removed",
        "added",
        "type"
      ]
    },
    "DomainAbusePhishingMaliciousBehaviorChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "added": {
          "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreats"
        },
        "removed": {
          "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreats"
        },
        "type": {
          "type": "string",
          "enum": [
            "phishing_malicious_behavior_change"
          ]
        }
      },
      "required": [
        "domain",
        "added",
        "type"
      ]
    },
    "DomainAbusePhishingMaliciousBehaviorThreatType": {
      "type": "string",
      "description": "A kind of threat present in the domain.",
      "enum": [
        "malware",
        "unwanted_software",
        "social_engineering",
        "social_engineering_extended_coverage"
      ]
    },
    "DomainAbusePhishingMaliciousBehaviorThreats": {
      "type": "object",
      "properties": {
        "threat_types": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreatType"
          }
        }
      }
    },
    "DomainAbuseReregistrationChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "$ref": "#/$defs/ReregistrationRecord"
        },
        "added": {
          "$ref": "#/$defs/ReregistrationRecord"
        },
        "type": {
          "type": "string",
          "enum": [
            "reregistration_change"
          ]
        }
      },
      "required": [
        "domain",
        "type"
      ]
    },
    "DomainAbuseScreenshotMentionsChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "added": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "url": {
                "type": "string"
              },
              "screenshot_id": {
                "type": "string"
              },
              "document": {
                "type": "string"
              },
              "analyzed": {
                "type": "string",
                "format": "date-time"
              },
              "mentioned_entities": {
                "type": "array",
                "items": {
                  "$ref": "#/$defs/MentionedEntity"
                }
              },
              "mentioned_texts": {
                "type": "array",
                "items": {
                  "$ref": "#/$defs/MentionedText"
                }
              }
            },
            "required": [
              "url",
              "screenshot_id",
              "document",
              "analyzed",
              "mentioned_entities"
            ]
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "screenshot_mentions_change"
          ]
        }
      },
      "required": [
        "domain",
        "added",
        "type"
      ]
    },
    "DomainAbuseSyncChange": {
      "type": "object",
      "description": "The alert's assessments were re-synchronised.",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain whose assessments were synchronised."
        },
        "assessments_before": {
          "type": "array",
          "description": "Assessment ids held before the synchronisation.",
          "items": {
            "type": "string"
          }
        },
        "assessments_after": {
          "type": "array",
          "description": "Assessment ids held after the synchronisation.",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "domain_abuse_sync_change"
          ]
        }
      },
      "required": [
        "domain",
        "assessments_before",
        "assessments_after",
        "type"
      ]
    },
    "DomainAbuseWhoisChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "old_record": {
          "$ref": "#/$defs/WhoisRecordV2"
        },
        "new_record": {
          "$ref": "#/$defs/WhoisRecordV2"
        },
        "removed_contacts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/WhoisContactRecordV2"
          }
        },
        "added_contacts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/WhoisContactRecordV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "whois_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed_contacts",
        "added_contacts"
      ]
    },
    "DrpAsset.ClientDomain": {
      "type": "object",
      "description": "A domain on the customer's Domain Watch List.",
      "required": [
        "type",
        "domain_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "client_domain"
          ]
        },
        "domain_id": {
          "type": "string",
          "description": "Identity of the watched domain."
        }
      }
    },
    "DrpAsset.CodeRepoKeyword": {
      "type": "object",
      "description": "A keyword used for code-repository matching.",
      "required": [
        "type",
        "term"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "code_repo_keyword"
          ]
        },
        "term": {
          "$ref": "#/$defs/DrpAsset.DrpTerm"
        }
      }
    },
    "DrpAsset.Company": {
      "type": "object",
      "description": "A company on the customer's Brand Names Watch List.",
      "required": [
        "type",
        "company_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "company"
          ]
        },
        "company_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.DrpAsset": {
      "description": "A protected DRP asset (a oneOf union of asset subtypes). The `type` property selects the concrete subtype.\n",
      "oneOf": [
        {
          "$ref": "#/$defs/DrpAsset.ClientDomain"
        },
        {
          "$ref": "#/$defs/DrpAsset.SimilarDomainTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.ScreenshotOcrKeyword"
        },
        {
          "$ref": "#/$defs/DrpAsset.CodeRepoKeyword"
        },
        {
          "$ref": "#/$defs/DrpAsset.Logotype"
        },
        {
          "$ref": "#/$defs/DrpAsset.ImageHash"
        },
        {
          "$ref": "#/$defs/DrpAsset.Company"
        },
        {
          "$ref": "#/$defs/DrpAsset.Organization"
        },
        {
          "$ref": "#/$defs/DrpAsset.Product"
        },
        {
          "$ref": "#/$defs/DrpAsset.Executive"
        }
      ]
    },
    "DrpAsset.DrpTerm": {
      "description": "A search term used by a DRP asset (a oneOf union of term subtypes). See text search modes (linguistic, exact, substring/pattern). The `type` property selects the subtype.\n",
      "oneOf": [
        {
          "$ref": "#/$defs/DrpAsset.SubstringTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.LanguageTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.ExactTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.FreetextTerm"
        }
      ]
    },
    "DrpAsset.ExactTerm": {
      "type": "object",
      "description": "Strict exact-text match.",
      "required": [
        "type",
        "text"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "exact"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        }
      }
    },
    "DrpAsset.Executive": {
      "type": "object",
      "description": "A protected executive identity.",
      "required": [
        "type",
        "executive_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "executive"
          ]
        },
        "executive_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.FreetextTerm": {
      "type": "object",
      "description": "Free-text match.",
      "required": [
        "type",
        "text"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "freetext"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        }
      }
    },
    "DrpAsset.ImageHash": {
      "type": "object",
      "description": "A watched image (logo) hash matched on the attacker domain.",
      "required": [
        "type",
        "hash_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "image_hash"
          ]
        },
        "hash_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.LanguageTerm": {
      "type": "object",
      "description": "Linguistic match that includes other words sharing the same word stem.",
      "required": [
        "type",
        "text",
        "language"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "language"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        },
        "language": {
          "type": "string",
          "description": "Language used for stem matching (e.g. `eng`)."
        }
      }
    },
    "DrpAsset.Logotype": {
      "type": "object",
      "description": "A watched logotype detected on the attacker domain.",
      "required": [
        "type",
        "logotype_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "logotype"
          ]
        },
        "logotype_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.Organization": {
      "type": "object",
      "description": "An organization on the customer's Brand Names Watch List.",
      "required": [
        "type",
        "organization_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "organization"
          ]
        },
        "organization_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.Product": {
      "type": "object",
      "description": "A product on the customer's Brand Names Watch List.",
      "required": [
        "type",
        "product_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "product"
          ]
        },
        "product_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.ScreenshotOcrKeyword": {
      "type": "object",
      "description": "A keyword matched in OCR-extracted screenshot text.",
      "required": [
        "type",
        "term"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "screenshot_ocr_keyword"
          ]
        },
        "term": {
          "$ref": "#/$defs/DrpAsset.DrpTerm"
        }
      }
    },
    "DrpAsset.SimilarDomainTerm": {
      "type": "object",
      "description": "A similar-domain search term.",
      "required": [
        "type",
        "term"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "similar_domain_term"
          ]
        },
        "term": {
          "$ref": "#/$defs/DrpAsset.DrpTerm"
        }
      }
    },
    "DrpAsset.SubstringTerm": {
      "type": "object",
      "description": "Substring/pattern match, optionally constrained to a specific entity type.",
      "required": [
        "type",
        "text",
        "position"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "substring"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        },
        "position": {
          "type": "string",
          "description": "Where the text must occur within the matched value.",
          "enum": [
            "prefix",
            "infix",
            "suffix"
          ]
        },
        "entity_type_id": {
          "type": "string",
          "description": "Optional entity type to match against."
        }
      }
    },
    "EntitiesChangeV2": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "entities_change"
          ]
        }
      },
      "required": [
        "type",
        "removed",
        "added"
      ]
    },
    "Entity": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "type": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "id",
        "type"
      ]
    },
    "ExternalIdChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "external_id_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "FacilityAssessment": {
      "type": "object",
      "description": "Facility assessment data",
      "properties": {
        "name": {
          "type": "string"
        },
        "criticality": {
          "$ref": "#/$defs/PlaybookAlertPriority"
        }
      }
    },
    "FacilityEvidence": {
      "type": "object",
      "properties": {
        "cluster_id": {
          "type": "string"
        },
        "main_event": {
          "$ref": "#/$defs/FacilityMainEvent"
        },
        "type": {
          "type": "string",
          "enum": [
            "cluster_change_added"
          ]
        },
        "other_event_ids": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "FacilityEvidenceChange": {
      "type": "object",
      "properties": {
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/FacilityEvidence"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "evidence_changes"
          ]
        }
      },
      "required": [
        "added",
        "type"
      ]
    },
    "FacilityMainEvent": {
      "type": "object",
      "properties": {
        "event_id": {
          "type": "string"
        },
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/FacilityAssessment"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "event_change_added"
          ]
        }
      }
    },
    "ImageAvailability": {
      "type": "string",
      "description": "Image availability status",
      "enum": [
        "Available",
        "NotFound",
        "NotDownloaded",
        "FlaggedForReview",
        "NotAvailableForLegalReasons",
        "ScanCompletedAsPositive"
      ]
    },
    "LogotypeInScreenshotV2": {
      "type": "object",
      "properties": {
        "logotype_id": {
          "type": "string"
        },
        "screenshot_id": {
          "type": "string"
        },
        "url": {
          "type": "string"
        },
        "screenshot_width": {
          "type": "integer",
          "description": "Width of the screenshot in pixels (when available)."
        },
        "screenshot_height": {
          "type": "integer",
          "description": "Height of the screenshot in pixels (when available)."
        },
        "region": {
          "description": "Bounding box of the detected logotype within the screenshot.",
          "type": "object",
          "properties": {
            "min_x": {
              "type": "integer"
            },
            "min_y": {
              "type": "integer"
            },
            "max_x": {
              "type": "integer"
            },
            "max_y": {
              "type": "integer"
            }
          },
          "required": [
            "min_x",
            "min_y",
            "max_x",
            "max_y"
          ]
        },
        "is_high_interest": {
          "type": "boolean",
          "description": "True if the logotype belongs to a high-interest brand list."
        }
      },
      "required": [
        "logotype_id",
        "screenshot_id",
        "url"
      ]
    },
    "MaliciousDnsRecord": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "assessments": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "level": {
                "type": "number"
              },
              "title": {
                "type": "string"
              }
            },
            "required": [
              "id",
              "level"
            ]
          }
        }
      }
    },
    "MaliciousSitesAiTriageChange": {
      "type": "object",
      "description": "Indicates an AI triage produced a verdict for the alert, carrying the resulting assessment, the model's rationale, and the scans it analyzed.\n",
      "properties": {
        "triage_id": {
          "type": "string",
          "description": "Identifier of the triage run that produced this verdict."
        },
        "analyzed_scans": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAnalyzedScan"
          }
        },
        "assessment": {
          "$ref": "#/$defs/MaliciousSitesAssessment"
        },
        "rationale": {
          "type": "string",
          "description": "The model's free-text explanation for the verdict."
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_ai_triage_change"
          ]
        }
      },
      "required": [
        "triage_id",
        "type"
      ]
    },
    "MaliciousSitesAlertCreatedChange": {
      "type": "object",
      "description": "Indicates the alert was created for an attacker.",
      "properties": {
        "attacker": {
          "type": "string",
          "description": "The attacker domain identity."
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_alert_created_change"
          ]
        }
      },
      "required": [
        "attacker",
        "type"
      ]
    },
    "MaliciousSitesAnalyzedScan": {
      "type": "object",
      "description": "A screenshot and the URL it was captured from, analyzed by the AI triage.",
      "properties": {
        "image": {
          "type": "string",
          "description": "The analyzed screenshot image identity."
        },
        "url": {
          "type": "string",
          "description": "The URL the screenshot was captured from."
        }
      }
    },
    "MaliciousSitesAssessment": {
      "type": "object",
      "description": "Malicious Sites assessment",
      "properties": {
        "name": {
          "type": "string",
          "description": "Assessment title.",
          "enum": [
            "Suggested Takedown",
            "Phishing/Scam",
            "Login Form",
            "High Interest Logo Detection",
            "Logo Detection",
            "Screenshot Mention",
            "Custom Keyword in Screenshot",
            "Parked / Ad Hosting Website",
            "Domain for Sale",
            "Typosquat",
            "Similar Domain",
            "Re-Registration",
            "Active Mail Server",
            "Review Recommended",
            "AI Rejected"
          ]
        },
        "priority": {
          "$ref": "#/$defs/PlaybookAlertPriority"
        }
      },
      "required": [
        "name",
        "priority"
      ]
    },
    "MaliciousSitesAttacker": {
      "type": "object",
      "description": "Full domain context for a single attacker domain, with all evidence and assessments scoped to that attacker.",
      "properties": {
        "attacker": {
          "type": "string",
          "description": "The attacker domain identity."
        },
        "targets": {
          "type": "array",
          "description": "Targeted domains for this attacker.",
          "items": {
            "type": "string"
          }
        },
        "assets": {
          "type": "array",
          "description": "The protected Digital Risk Protection (DRP) assets — drawn from the customer's watch lists — that this attacker matched against (e.g. a watched domain, company, logotype, or search term). Each entry is a subtype of `DrpAsset`.\n",
          "items": {
            "$ref": "#/$defs/DrpAsset.DrpAsset"
          }
        },
        "cause": {
          "$ref": "#/$defs/MaliciousSitesCause"
        },
        "malicious_dns_records": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesDnsRecord"
          }
        },
        "logotypes": {
          "type": "array",
          "description": "Logotype items for this attacker.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesLogotype"
          }
        },
        "screenshots": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesScreenshot"
          }
        },
        "reregistration": {
          "$ref": "#/$defs/MaliciousSitesReregistration"
        },
        "screenshot_mentions": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesScreenshotMention"
          }
        },
        "suggested_takedown": {
          "$ref": "#/$defs/MaliciousSitesSuggestedTakedown"
        },
        "phishing_verdicts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesPhishingVerdict"
          }
        },
        "priority": {
          "type": "string",
          "description": "Computed priority for this attacker context."
        },
        "created_at": {
          "type": "string",
          "format": "date-time",
          "description": "When this attacker was first detected."
        },
        "assessments": {
          "type": "array",
          "description": "Malicious Sites assessments scoped to this attacker.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAssessment"
          }
        }
      },
      "required": [
        "attacker",
        "cause",
        "priority",
        "created_at"
      ]
    },
    "MaliciousSitesAttackerAddedChange": {
      "type": "object",
      "description": "Attacker added change for Malicious Sites alerts.",
      "properties": {
        "attacker": {
          "type": "string",
          "description": "The attacker domain identity."
        },
        "cause": {
          "$ref": "#/$defs/MaliciousSitesCause"
        },
        "manual_addition_user_id": {
          "type": "string"
        },
        "manual_addition_user_name": {
          "type": "string"
        },
        "typosquat_targets": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "similar_domains_keywords": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "logotypes": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesLogotype"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_attacker_added_change"
          ]
        }
      },
      "required": [
        "attacker",
        "type"
      ]
    },
    "MaliciousSitesCause": {
      "type": "string",
      "description": "Malicious Sites attacker detection cause.",
      "enum": [
        "manual",
        "typosquat",
        "similar_domains",
        "logotype",
        "logotype_high_interest",
        "phishing_verdict",
        "screenshot_mention",
        "screenshot_custom_keyword",
        "login_form",
        "suggested_takedown"
      ]
    },
    "MaliciousSitesDetectionCreatedChange": {
      "type": "object",
      "description": "Indicates a detection was created for an attacker.",
      "properties": {
        "attacker": {
          "type": "string",
          "description": "The attacker domain identity."
        },
        "detection_id": {
          "type": "string",
          "description": "Identifier of the detection that was created."
        },
        "date": {
          "type": "string",
          "format": "date-time",
          "description": "When the detection was created."
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_detection_created_change"
          ]
        }
      },
      "required": [
        "attacker",
        "detection_id",
        "date",
        "type"
      ]
    },
    "MaliciousSitesDnsChange": {
      "type": "object",
      "description": "DNS change for Malicious Sites alerts.",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain identity."
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesDnsChangeRecord"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesDnsChangeRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_dns_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed",
        "added"
      ]
    },
    "MaliciousSitesDnsChangeRecord": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string"
        },
        "entity": {
          "$ref": "#/$defs/Entity"
        }
      }
    },
    "MaliciousSitesDnsRecord": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "Entity identity of the DNS record."
        },
        "assessments": {
          "type": "array",
          "description": "Malicious Sites assessments associated with the DNS record.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAssessment"
          }
        },
        "date": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "MaliciousSitesEvidenceDnsPanel": {
      "type": "object",
      "description": "Detailed DNS data for the Malicious Sites domain.\n",
      "properties": {
        "ip_list": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesResolvedRecord"
          }
        },
        "mx_list": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesResolvedRecord"
          }
        },
        "ns_list": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesResolvedRecord"
          }
        }
      },
      "required": [
        "ip_list",
        "mx_list",
        "ns_list"
      ]
    },
    "MaliciousSitesEvidenceSummaryPanel": {
      "type": "object",
      "description": "Summarized data describing the evidence behind the Malicious Sites alert.\n",
      "properties": {
        "explanation": {
          "type": "string",
          "description": "A brief explanation of why this assessment was made."
        },
        "cause": {
          "type": "string",
          "description": "The cause that triggered the alert creation."
        },
        "resolved_record_list": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesResolvedRecord"
          }
        },
        "reregistration": {
          "$ref": "#/$defs/MaliciousSitesReregistration"
        },
        "suggested_takedown": {
          "$ref": "#/$defs/MaliciousSitesSuggestedTakedown"
        },
        "attackers": {
          "type": "array",
          "description": "Attacker domains details.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAttacker"
          }
        },
        "assessments": {
          "type": "array",
          "description": "Aggregated Malicious Sites assessments for this alert.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAssessment"
          }
        }
      }
    },
    "MaliciousSitesEvidenceWhoisPanel": {
      "type": "object",
      "description": "Detailed WHOIS data for the Malicious Sites domain.\n",
      "properties": {
        "body": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/WhoIsAttributeItem"
          }
        }
      }
    },
    "MaliciousSitesForSaleChange": {
      "type": "object",
      "description": "Indicates the domain is for sale.",
      "properties": {
        "url": {
          "type": "string"
        },
        "image": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "for_sale_change"
          ]
        }
      },
      "required": [
        "url",
        "image",
        "type"
      ]
    },
    "MaliciousSitesHtmlContentMention": {
      "type": "object",
      "properties": {
        "source": {
          "type": "string",
          "description": "Source type of the mention (e.g. html, text)."
        },
        "value": {
          "type": "string",
          "description": "The mentioned value (URL or text)."
        }
      },
      "required": [
        "source",
        "value"
      ]
    },
    "MaliciousSitesLogoChange": {
      "type": "object",
      "description": "This change only applies to Malicious Sites alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogotypeInScreenshotV2"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogotypeInScreenshotV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_logo_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed",
        "added"
      ]
    },
    "MaliciousSitesLogoHashChange": {
      "type": "object",
      "description": "Indicates logo(s) were detected on a URL via hash matching.",
      "properties": {
        "url": {
          "type": "string"
        },
        "scan": {
          "type": "string"
        },
        "hashes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "brands": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "logo_hash_change"
          ]
        }
      },
      "required": [
        "url",
        "hashes",
        "type"
      ]
    },
    "MaliciousSitesLogotype": {
      "type": "object",
      "description": "A logotype detected in a screenshot of the attacker domain.",
      "properties": {
        "logotype_id": {
          "type": "string",
          "description": "Entity identity of the logotype."
        },
        "screenshot_id": {
          "type": "string",
          "description": "Image identity of the screenshot containing the logotype."
        },
        "url": {
          "type": "string",
          "description": "URL associated with the logotype."
        },
        "screenshot_width": {
          "type": "integer",
          "description": "Width of the screenshot in pixels."
        },
        "screenshot_height": {
          "type": "integer",
          "description": "Height of the screenshot in pixels."
        },
        "region": {
          "$ref": "#/$defs/MaliciousSitesLogotypeRegion"
        },
        "is_high_interest": {
          "type": "boolean",
          "description": "Whether this logotype is considered high interest."
        }
      },
      "required": [
        "logotype_id",
        "screenshot_id",
        "url"
      ]
    },
    "MaliciousSitesLogotypeRegion": {
      "type": "object",
      "description": "Bounding box region of the logotype within the screenshot.",
      "properties": {
        "min_x": {
          "type": "integer",
          "description": "Minimum X coordinate of the bounding box."
        },
        "min_y": {
          "type": "integer",
          "description": "Minimum Y coordinate of the bounding box."
        },
        "max_x": {
          "type": "integer",
          "description": "Maximum X coordinate of the bounding box."
        },
        "max_y": {
          "type": "integer",
          "description": "Maximum Y coordinate of the bounding box."
        }
      },
      "required": [
        "min_x",
        "min_y",
        "max_x",
        "max_y"
      ]
    },
    "MaliciousSitesMaliciousDnsChange": {
      "type": "object",
      "description": "Malicious DNS change for Malicious Sites alerts.",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain identity."
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousDnsRecord"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousDnsRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_malicious_dns_change"
          ]
        }
      },
      "required": [
        "domain",
        "type",
        "removed",
        "added"
      ]
    },
    "MaliciousSitesMaliciousUrlChange": {
      "type": "object",
      "description": "Malicious URL change for Malicious Sites alerts.",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain identity."
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesMaliciousUrlRecord"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesMaliciousUrlRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_malicious_url_change"
          ]
        }
      },
      "required": [
        "domain",
        "removed",
        "added",
        "type"
      ]
    },
    "MaliciousSitesMaliciousUrlRecord": {
      "type": "object",
      "properties": {
        "url": {
          "type": "string",
          "description": "The URL identity."
        },
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/AssessmentWithSource"
          }
        }
      }
    },
    "MaliciousSitesMatchPathElement": {
      "type": "object",
      "description": "One element of a match path.",
      "properties": {
        "attribute": {
          "type": "string",
          "description": "The attribute linking this element to the previous one."
        },
        "entities": {
          "type": "array",
          "items": {
            "type": "string",
            "description": "Entity identity."
          }
        }
      },
      "required": [
        "attribute",
        "entities"
      ]
    },
    "MaliciousSitesMentionedCustomKeyword": {
      "type": "object",
      "properties": {
        "keyword": {
          "type": "string"
        },
        "reference": {
          "type": "string"
        },
        "fragment": {
          "type": "string"
        }
      },
      "required": [
        "keyword",
        "reference",
        "fragment"
      ]
    },
    "MaliciousSitesMentionedEntity": {
      "type": "object",
      "properties": {
        "entity": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string"
            },
            "name": {
              "type": "string"
            },
            "type": {
              "type": "string"
            }
          },
          "required": [
            "id"
          ]
        },
        "reference": {
          "type": "string"
        },
        "fragment": {
          "type": "string"
        }
      },
      "required": [
        "entity",
        "reference",
        "fragment"
      ]
    },
    "MaliciousSitesParkedChange": {
      "type": "object",
      "description": "Indicates the domain is parked.",
      "properties": {
        "url": {
          "type": "string"
        },
        "image": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "parked_change"
          ]
        }
      },
      "required": [
        "url",
        "image",
        "type"
      ]
    },
    "MaliciousSitesPhishingVerdict": {
      "type": "object",
      "description": "A phishing verdict assessment.",
      "properties": {
        "url": {
          "type": "string"
        },
        "source": {
          "type": "string",
          "description": "Source identity for this verdict."
        },
        "risk_rule_id": {
          "type": "string",
          "description": "The risk rule meta-attribute identity."
        },
        "risk_rule_description": {
          "type": "string",
          "description": "Description of the risk rule."
        },
        "severity": {
          "type": "string",
          "description": "Severity of the phishing verdict.",
          "enum": [
            "unusual",
            "suspicious",
            "malicious",
            "very_malicious"
          ]
        },
        "brands": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesTargetedBrand"
          }
        },
        "last_seen": {
          "type": "string",
          "format": "date-time"
        },
        "ttps": {
          "type": "array",
          "description": "MITRE ATT&CK identifiers, attack vectors, or malware.",
          "items": {
            "type": "string"
          }
        }
      },
      "required": [
        "url",
        "source",
        "risk_rule_id",
        "severity",
        "brands",
        "last_seen",
        "ttps"
      ]
    },
    "MaliciousSitesPhishingVerdictChange": {
      "type": "object",
      "description": "Indicates a phishing verdict was detected.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "url": {
          "type": "string"
        },
        "risk_rule": {
          "type": "string"
        },
        "ttps": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "brands": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "phishing_verdict_change"
          ]
        }
      },
      "required": [
        "risk_rule",
        "ttps",
        "brands",
        "type"
      ]
    },
    "MaliciousSitesReregistration": {
      "type": "object",
      "properties": {
        "registrar": {
          "type": "string"
        },
        "registrar_name": {
          "type": "string"
        },
        "iana_id": {
          "type": "integer"
        },
        "expiration": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "MaliciousSitesReregistrationChange": {
      "type": "object",
      "description": "Reregistration change for Malicious Sites alerts.",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain identity."
        },
        "removed": {
          "$ref": "#/$defs/ReregistrationRecord"
        },
        "added": {
          "$ref": "#/$defs/ReregistrationRecord"
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_reregistration_change"
          ]
        }
      },
      "required": [
        "domain",
        "type"
      ]
    },
    "MaliciousSitesResolvedRecord": {
      "type": "object",
      "properties": {
        "entity": {
          "type": "string",
          "description": "Record"
        },
        "risk_score": {
          "$ref": "#/$defs/PlaybookAlertEntityScore"
        },
        "criticality": {
          "$ref": "#/$defs/PlaybookAlertEntityCriticality"
        },
        "record_type": {
          "type": "string",
          "description": "The Record Type, ex A, CNAME, MX or similar."
        },
        "assessments": {
          "type": "array",
          "description": "Malicious Sites assessments associated with the DNS record.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAssessment"
          }
        }
      }
    },
    "MaliciousSitesScreenshot": {
      "type": "object",
      "description": "A screenshot associated with a Malicious Sites alert, including detected logotypes.",
      "properties": {
        "description": {
          "type": "string"
        },
        "image_id": {
          "type": "string",
          "description": "Image identity of the screenshot."
        },
        "created": {
          "type": "string",
          "format": "date-time",
          "description": "When the screenshot was taken."
        },
        "availability": {
          "$ref": "#/$defs/ImageAvailability"
        },
        "tag": {
          "type": "string",
          "description": "Assessment tag for the screenshot.",
          "enum": [
            "Suggested Takedown",
            "Phishing/Scam",
            "Login Form",
            "High Interest Logo Detection",
            "Logo Detection",
            "Screenshot Mention",
            "Custom Keyword in Screenshot",
            "Parked / Ad Hosting Website",
            "Domain for Sale",
            "Typosquat",
            "Similar Domain",
            "Re-Registration",
            "Active Mail Server"
          ]
        },
        "logotypes": {
          "type": "array",
          "description": "Logotypes detected in this screenshot.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesLogotype"
          }
        }
      },
      "required": [
        "description",
        "image_id",
        "created",
        "availability"
      ]
    },
    "MaliciousSitesScreenshotMention": {
      "type": "object",
      "properties": {
        "url": {
          "type": "string"
        },
        "screenshot": {
          "type": "string"
        },
        "document": {
          "type": "string"
        },
        "analyzed": {
          "type": "string",
          "format": "date-time"
        },
        "mentioned_entities": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesMentionedEntity"
          }
        },
        "mentioned_custom_keywords": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesMentionedCustomKeyword"
          }
        }
      }
    },
    "MaliciousSitesScreenshotMentionChange": {
      "type": "object",
      "description": "Indicates mentions found in a screenshot.",
      "properties": {
        "url": {
          "type": "string"
        },
        "scan": {
          "type": "string"
        },
        "screenshot": {
          "type": "string"
        },
        "mentions": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "texts": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_screenshot_mention_change"
          ]
        }
      },
      "required": [
        "url",
        "scan",
        "screenshot",
        "mentions",
        "texts",
        "type"
      ]
    },
    "MaliciousSitesSimilarDomainChange": {
      "type": "object",
      "description": "Indicates the attacker domain was detected as similar to the customer's watched keywords. Carries all matched keyword terms.\n",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The attacker domain identity."
        },
        "substring_terms": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DrpAsset.SubstringTerm"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_similar_domain_change"
          ]
        }
      },
      "required": [
        "domain",
        "substring_terms",
        "type"
      ]
    },
    "MaliciousSitesStatusPanel": {
      "type": "object",
      "description": "Data structure containing general information about the Malicious Sites alert and its associated domain (the entity).\n",
      "properties": {
        "status": {
          "$ref": "#/$defs/PlaybookAlertStatus"
        },
        "priority": {
          "$ref": "#/$defs/PlaybookAlertPriority"
        },
        "reopen": {
          "$ref": "#/$defs/PlaybookAlertReopenStrategy"
        },
        "assignee_name": {
          "$ref": "#/$defs/PlaybookAlertAssigneeName"
        },
        "assignee_id": {
          "$ref": "#/$defs/PlaybookAlertAssigneeId"
        },
        "created": {
          "$ref": "#/$defs/PlaybookAlertCreated"
        },
        "updated": {
          "$ref": "#/$defs/PlaybookAlertUpdated"
        },
        "case_rule_id": {
          "$ref": "#/$defs/PlaybookAlertCaseRuleId"
        },
        "case_rule_label": {
          "$ref": "#/$defs/PlaybookAlertCaseRuleLabel"
        },
        "alert_rule": {
          "$ref": "#/$defs/PlaybookAlertAlertRule"
        },
        "creator_name": {
          "$ref": "#/$defs/PlaybookAlertCreatorName"
        },
        "creator_id": {
          "$ref": "#/$defs/PlaybookAlertCreatorId"
        },
        "owner_id": {
          "$ref": "#/$defs/PlaybookAlertOwnerId"
        },
        "owner_name": {
          "$ref": "#/$defs/PlaybookAlertOwnerName"
        },
        "organisation_id": {
          "$ref": "#/$defs/PlaybookAlertOrganisationId"
        },
        "organisation_name": {
          "$ref": "#/$defs/PlaybookAlertOrganisationName"
        },
        "owner_organisation_details": {
          "$ref": "#/$defs/PlaybookAlertOwnerOrganisationDetails"
        },
        "entity_id": {
          "type": "string",
          "description": "The domain suspected for Malicious Sites"
        },
        "entity_name": {
          "type": "string",
          "description": "The domain suspected for Malicious Sites"
        },
        "entity_criticality": {
          "$ref": "#/$defs/PlaybookAlertEntityCriticality"
        },
        "risk_score": {
          "$ref": "#/$defs/PlaybookAlertEntityScore"
        },
        "assessments": {
          "type": "array",
          "description": "Malicious Sites assessments associated with the alert entity.",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAssessment"
          }
        },
        "targets": {
          "description": "This is a list of targeted domains.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "attackers": {
          "description": "A list of attacking domains grouped in this alert.",
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "actions_taken": {
          "$ref": "#/$defs/PlaybookAlertOnwardActionList"
        }
      },
      "required": [
        "status",
        "priority",
        "created",
        "updated",
        "case_rule_id",
        "alert_rule",
        "assessments",
        "targets",
        "actions_taken"
      ]
    },
    "MaliciousSitesSuggestedTakedown": {
      "type": "object",
      "description": "Suggested takedown assessment details.",
      "properties": {
        "has_phishing_verdict": {
          "type": "boolean"
        },
        "has_high_interest_logo": {
          "type": "boolean"
        },
        "has_login_form": {
          "type": "boolean"
        },
        "screenshot": {
          "type": "string",
          "description": "Image identity of supporting screenshot evidence."
        }
      },
      "required": [
        "has_phishing_verdict",
        "has_high_interest_logo",
        "has_login_form"
      ]
    },
    "MaliciousSitesSuggestedTakedownChange": {
      "type": "object",
      "description": "Indicates a takedown is suggested.",
      "properties": {
        "has_phishing_verdict": {
          "type": "boolean"
        },
        "has_high_interest_logo": {
          "type": "boolean"
        },
        "has_login_form": {
          "type": "boolean"
        },
        "screenshot": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "suggested_takedown_change"
          ]
        }
      },
      "required": [
        "has_phishing_verdict",
        "has_high_interest_logo",
        "has_login_form",
        "type"
      ]
    },
    "MaliciousSitesSyncChange": {
      "type": "object",
      "description": "The alert's assessments were re-synchronised from its underlying detection. This change only applies to Malicious Sites alerts.\n",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain whose assessments were synchronised."
        },
        "assessments_before": {
          "type": "array",
          "description": "Assessment ids held before the synchronisation.",
          "items": {
            "type": "string"
          }
        },
        "assessments_after": {
          "type": "array",
          "description": "Assessment ids held after the synchronisation.",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_sync_change"
          ]
        }
      },
      "required": [
        "domain",
        "assessments_before",
        "assessments_after",
        "type"
      ]
    },
    "MaliciousSitesTargetedBrand": {
      "type": "object",
      "properties": {
        "brand": {
          "type": "string",
          "description": "Entity identity of the targeted brand."
        },
        "mentions": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesHtmlContentMention"
          }
        }
      },
      "required": [
        "brand"
      ]
    },
    "MaliciousSitesTriagePanel": {
      "type": "object",
      "description": "The current AI-triage verdict for the alert: the resulting assessment, the model's rationale, and the scans it analyzed.\n",
      "properties": {
        "triage_id": {
          "type": "string",
          "description": "Identifier of the triage run that produced this verdict."
        },
        "assessment": {
          "$ref": "#/$defs/MaliciousSitesAssessment"
        },
        "rationale": {
          "type": "string",
          "description": "The model's free-text explanation for the verdict."
        },
        "analyzed_scans": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAnalyzedScan"
          }
        },
        "date": {
          "type": "string",
          "format": "date-time",
          "description": "When the triage verdict was produced."
        }
      },
      "required": [
        "triage_id"
      ]
    },
    "MaliciousSitesTyposquatChange": {
      "type": "object",
      "description": "Indicates the attacker domain was detected as a typosquat of the customer's watched domains. Carries all matched target domains, each with the match paths explaining the detection.\n",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The attacker domain identity."
        },
        "targets": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesTyposquatTarget"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_typosquat_change"
          ]
        }
      },
      "required": [
        "domain",
        "targets",
        "type"
      ]
    },
    "MaliciousSitesTyposquatTarget": {
      "type": "object",
      "description": "A watched domain the attacker was matched against.",
      "properties": {
        "target": {
          "type": "string",
          "description": "The watched target domain identity."
        },
        "match_paths": {
          "type": "array",
          "description": "Match paths explaining the detection. Each path is a chain of elements from the attacker to the monitored asset.\n",
          "items": {
            "type": "array",
            "items": {
              "$ref": "#/$defs/MaliciousSitesMatchPathElement"
            }
          }
        }
      },
      "required": [
        "target"
      ]
    },
    "MaliciousSitesWhoisChange": {
      "type": "object",
      "description": "Whois change for Malicious Sites alerts.",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain identity."
        },
        "old_record": {
          "$ref": "#/$defs/MaliciousSitesWhoisRecord"
        },
        "new_record": {
          "$ref": "#/$defs/MaliciousSitesWhoisRecord"
        },
        "removed_contacts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesWhoisContactRecord"
          }
        },
        "added_contacts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesWhoisContactRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_sites_whois_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed_contacts",
        "added_contacts"
      ]
    },
    "MaliciousSitesWhoisContactRecord": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string"
        },
        "telephone": {
          "type": "string"
        },
        "street1": {
          "type": "string"
        },
        "state": {
          "type": "string"
        },
        "postal_code": {
          "type": "string"
        },
        "organization": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "fax": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "country_code": {
          "type": "string"
        },
        "country": {
          "type": "string"
        },
        "city": {
          "type": "string"
        },
        "created": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "MaliciousSitesWhoisRecord": {
      "type": "object",
      "properties": {
        "status": {
          "type": "string"
        },
        "registrar_name": {
          "type": "string"
        },
        "private_registration": {
          "type": "boolean"
        },
        "name_servers": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "contact_email": {
          "type": "string"
        },
        "created": {
          "type": "string",
          "format": "date-time"
        },
        "updated": {
          "type": "string",
          "format": "date-time"
        },
        "expires": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "MaliciousUrlRecord": {
      "type": "object",
      "properties": {
        "url": {
          "type": "string"
        },
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/AssessmentWithSource"
          }
        }
      }
    },
    "MentionedEntity": {
      "type": "object",
      "properties": {
        "entity": {
          "$ref": "#/$defs/Entity"
        },
        "reference": {
          "type": "string"
        },
        "fragment": {
          "type": "string"
        },
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/AssessmentWithSource"
          }
        }
      },
      "required": [
        "entity",
        "reference",
        "fragment"
      ]
    },
    "MentionedText": {
      "type": "object",
      "properties": {
        "text": {
          "type": "string"
        },
        "reference": {
          "type": "string"
        },
        "fragment": {
          "type": "string"
        },
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/AssessmentWithSource"
          }
        }
      },
      "required": [
        "text",
        "reference",
        "fragment"
      ]
    },
    "OnwardActionId": {
      "type": "string",
      "description": "The id for the type of action taken. The possible values can be found in the response from metadata/common in actions_by_category field. The action ids possible can grow over time\n"
    },
    "PlaybookAlertAlertRule": {
      "type": "object",
      "properties": {
        "id": {
          "$ref": "#/$defs/PlaybookAlertRuleId"
        },
        "label": {
          "$ref": "#/$defs/PlaybookAlertRuleLabel"
        },
        "name": {
          "$ref": "#/$defs/PlaybookAlertRuleName"
        }
      },
      "required": [
        "id",
        "label"
      ]
    },
    "PlaybookAlertAssigneeId": {
      "description": "ID of the assignee",
      "type": "string"
    },
    "PlaybookAlertAssigneeName": {
      "description": "Full name of the assignee",
      "type": "string"
    },
    "PlaybookAlertAuthorId": {
      "description": "Id of the author",
      "type": "string"
    },
    "PlaybookAlertAuthorName": {
      "description": "Full name of the author",
      "type": "string"
    },
    "PlaybookAlertCaseRuleId": {
      "description": "The Rule that created the Playbook Alert (Deprecated, use 'alertRule.id' field)",
      "deprecated": true,
      "type": "string"
    },
    "PlaybookAlertCaseRuleLabel": {
      "description": "The type of Rule that created the Playbook Alert. For all rule types the label is one for the enum below, except 'malware_report' rule type where the label is the name of the rule given by user.\n (Deprecated, use 'alertRule.label' field)\n",
      "deprecated": true,
      "type": "string",
      "enum": [
        "Domain Abuse",
        "Malicious Sites",
        "Cyber Vulnerability",
        "Data Leakage on Code Repository",
        "Compromised Bank Check",
        "Geopolitics Facility",
        "Novel Identity Exposure",
        "Third Party Risk",
        "Malware Report",
        "Dark Web Brand",
        "Social Media Impersonation"
      ]
    },
    "PlaybookAlertCreated": {
      "description": "The Creation time of the Playbook Alert",
      "type": "string",
      "format": "date-time"
    },
    "PlaybookAlertCreatorId": {
      "description": "Id of the Creator of the Playbook Alert",
      "type": "string"
    },
    "PlaybookAlertCreatorName": {
      "description": "Full name of the Creator of the Playbook Alert",
      "type": "string"
    },
    "PlaybookAlertEnterpriseId": {
      "description": "Id of the Enterprise",
      "type": "string"
    },
    "PlaybookAlertEnterpriseName": {
      "description": "Name of the Enterprise",
      "type": "string"
    },
    "PlaybookAlertEntityCriticality": {
      "type": "string",
      "enum": [
        "Low",
        "Medium",
        "High",
        "Critical",
        "Very Critical"
      ],
      "description": "Label indicating risk criticality for the entity"
    },
    "PlaybookAlertEntityScore": {
      "type": "integer",
      "description": "Risk score assigned to the entity",
      "maximum": 99,
      "minimum": 0
    },
    "PlaybookAlertLogPanelV2": {
      "type": "array",
      "description": "Detailed view of manual or automated changes to the alert and underlying data. Entries are returned sorted by `created` descending (most recent first), and the panel is capped at the 20 most recent entries.\n",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "type": "string"
          },
          "author_id": {
            "$ref": "#/$defs/PlaybookAlertAuthorId"
          },
          "author_name": {
            "$ref": "#/$defs/PlaybookAlertAuthorName"
          },
          "created": {
            "type": "string",
            "format": "date-time"
          },
          "changes": {
            "type": "array",
            "items": {
              "oneOf": [
                {
                  "$ref": "#/$defs/AssigneeChangeV2"
                },
                {
                  "$ref": "#/$defs/CustomStatusChange"
                },
                {
                  "$ref": "#/$defs/PriorityChange"
                },
                {
                  "$ref": "#/$defs/ReopenStrategyChange"
                },
                {
                  "$ref": "#/$defs/TitleChange"
                },
                {
                  "$ref": "#/$defs/EntitiesChangeV2"
                },
                {
                  "$ref": "#/$defs/RelatedEntitiesChangeV2"
                },
                {
                  "$ref": "#/$defs/DescriptionChange"
                },
                {
                  "$ref": "#/$defs/ExternalIdChange"
                },
                {
                  "$ref": "#/$defs/CommentChange"
                },
                {
                  "$ref": "#/$defs/ActionChange"
                },
                {
                  "$ref": "#/$defs/AssessmentIdsChange"
                },
                {
                  "$ref": "#/$defs/CustomOnwardActionsRemovedChange"
                },
                {
                  "$ref": "#/$defs/CustomOnwardActionsAddedChange"
                },
                {
                  "$ref": "#/$defs/DomainAbuseDnsChangeV2"
                },
                {
                  "$ref": "#/$defs/DomainAbuseWhoisChangeV2"
                },
                {
                  "$ref": "#/$defs/DomainAbuseLogotypeChangeV2"
                },
                {
                  "$ref": "#/$defs/DomainAbuseMaliciousDnsChangeV2"
                },
                {
                  "$ref": "#/$defs/DomainAbuseReregistrationChange"
                },
                {
                  "$ref": "#/$defs/DomainAbuseMaliciousUrlChange"
                },
                {
                  "$ref": "#/$defs/DomainAbuseScreenshotMentionsChange"
                },
                {
                  "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorChange"
                },
                {
                  "$ref": "#/$defs/DomainAbuseAttackerAddedChange"
                },
                {
                  "$ref": "#/$defs/DomainAbuseSyncChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesAttackerAddedChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesDnsChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesWhoisChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesMaliciousDnsChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesReregistrationChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesMaliciousUrlChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesForSaleChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesParkedChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesLogoHashChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesScreenshotMentionChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesPhishingVerdictChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesSuggestedTakedownChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesLogoChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesTyposquatChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesSimilarDomainChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesAiTriageChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesAlertCreatedChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesDetectionCreatedChange"
                },
                {
                  "$ref": "#/$defs/MaliciousSitesSyncChange"
                },
                {
                  "$ref": "#/$defs/VulnerabilityLifecycleChangeV2"
                },
                {
                  "$ref": "#/$defs/CodeRepoLeakageEvidenceChangeV2"
                },
                {
                  "$ref": "#/$defs/ThirdPartyAssessmentChangeV2"
                },
                {
                  "$ref": "#/$defs/ThirdPartyAssessmentChangeV3"
                },
                {
                  "$ref": "#/$defs/FacilityEvidenceChange"
                },
                {
                  "$ref": "#/$defs/ClusterChangeAdded"
                }
              ]
            }
          }
        },
        "required": [
          "id",
          "created",
          "changes"
        ]
      }
    },
    "PlaybookAlertOnwardActionList": {
      "type": "array",
      "items": {
        "$ref": "#/$defs/OnwardActionId"
      }
    },
    "PlaybookAlertOrganisation": {
      "type": "object",
      "properties": {
        "organisation_id": {
          "$ref": "#/$defs/PlaybookAlertOrganisationId2"
        },
        "organisation_name": {
          "$ref": "#/$defs/PlaybookAlertOrganisationName2"
        }
      }
    },
    "PlaybookAlertOrganisationId": {
      "description": "Id of the Organisation",
      "type": "string",
      "deprecated": true
    },
    "PlaybookAlertOrganisationId2": {
      "description": "Id of the Organisation",
      "type": "string"
    },
    "PlaybookAlertOrganisationName": {
      "description": "Name of the Organisation",
      "type": "string",
      "deprecated": true
    },
    "PlaybookAlertOrganisationName2": {
      "description": "Name of the Organisation",
      "type": "string"
    },
    "PlaybookAlertOwnerId": {
      "description": "Id of the owner",
      "type": "string",
      "deprecated": true
    },
    "PlaybookAlertOwnerName": {
      "description": "Name of the owner",
      "type": "string",
      "deprecated": true
    },
    "PlaybookAlertOwnerOrganisationDetails": {
      "type": "object",
      "properties": {
        "organisations": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/PlaybookAlertOrganisation"
          }
        },
        "enterprise_id": {
          "$ref": "#/$defs/PlaybookAlertEnterpriseId"
        },
        "enterprise_name": {
          "$ref": "#/$defs/PlaybookAlertEnterpriseName"
        }
      }
    },
    "PlaybookAlertPriority": {
      "type": "string",
      "enum": [
        "High",
        "Moderate",
        "Informational"
      ],
      "description": "The priority of the Playbook Alert."
    },
    "PlaybookAlertReopenStrategy": {
      "type": "string",
      "description": "Reopen strategies can only be applied to alerts with a status of Dismissed or Resolved.\n\nThe following combinations of status/reopen are allowed:\n\n* Dismissed -> Never\n* Resolved -> Never\n* Resolved -> SignificantUpdates\n",
      "enum": [
        "Never",
        "SignificantUpdates"
      ]
    },
    "PlaybookAlertRuleId": {
      "description": "The Rule ID that created the Playbook Alert (without the 'report:' prefix)",
      "type": "string"
    },
    "PlaybookAlertRuleLabel": {
      "description": "The Rule label that created the Playbook Alert. `Undefined` option can be returned in case  the rule data is missing.\n",
      "type": "string",
      "enum": [
        "DomainAbuse",
        "MaliciousSites",
        "CyberVulnerability",
        "DataLeakageOnCodeRepository",
        "CompromisedBankCheck",
        "GeopoliticsFacility",
        "NovelIdentityExposure",
        "ThirdPartyRisk",
        "MalwareReport",
        "DarkWebBrand",
        "SocmedImpersonation",
        "Undefined"
      ]
    },
    "PlaybookAlertRuleName": {
      "description": "The Rule name (if defined) that created the Playbook Alert",
      "type": "string"
    },
    "PlaybookAlertStatus": {
      "type": "string",
      "enum": [
        "New",
        "InProgress",
        "Dismissed",
        "Resolved"
      ],
      "description": "The status of the Playbook Alert."
    },
    "PlaybookAlertUpdated": {
      "description": "The Update time of the Playbook Alert",
      "type": "string",
      "format": "date-time"
    },
    "PriorityChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "priority_change"
          ]
        }
      },
      "required": [
        "type",
        "old",
        "new"
      ]
    },
    "RelatedEntitiesChangeV2": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "related_entities_change"
          ]
        }
      },
      "required": [
        "type",
        "removed",
        "added"
      ]
    },
    "ReopenStrategyChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "reopen_strategy_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "ReregistrationRecord": {
      "type": "object",
      "properties": {
        "registrar": {
          "type": "string"
        },
        "registrar_name": {
          "type": "string"
        },
        "iana_id": {
          "type": "string"
        },
        "expiration": {
          "type": "string",
          "format": "date-time"
        }
      }
    },
    "ThirdPartyAssessmentChangeV2": {
      "type": "object",
      "description": "This change only applies to Third Party Risk alerts.",
      "properties": {
        "risk_attribute": {
          "type": "string"
        },
        "added": {
          "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2"
        },
        "removed": {
          "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2"
        },
        "type": {
          "type": "string",
          "enum": [
            "tpr_assessment_change"
          ]
        }
      },
      "required": [
        "risk_attribute",
        "type"
      ]
    },
    "ThirdPartyAssessmentChangeV3": {
      "type": "object",
      "description": "This change only applies to Third Party Risk alerts.",
      "properties": {
        "risk_attribute": {
          "type": "string"
        },
        "assessment_name": {
          "type": "string"
        },
        "added": {
          "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2"
        },
        "removed": {
          "$ref": "#/$defs/ThirdPartyRiskEvidenceChangeV2"
        },
        "type": {
          "type": "string",
          "enum": [
            "assessment_change"
          ]
        }
      },
      "required": [
        "risk_attribute",
        "type"
      ]
    },
    "ThirdPartyRiskEvidenceChangeV2": {
      "type": "object",
      "properties": {
        "level": {
          "type": "integer"
        },
        "evidence_string": {
          "type": "string"
        },
        "timestamp": {
          "type": "string",
          "format": "date-time"
        }
      },
      "required": [
        "level"
      ]
    },
    "TitleChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "title_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "VulnerabilityAssessment": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "level": {
          "type": "number"
        },
        "title": {
          "type": "string"
        }
      },
      "required": [
        "id",
        "level"
      ]
    },
    "VulnerabilityLifecycleChangeV2": {
      "type": "object",
      "description": "This change only applies to Vulnerability alerts.",
      "properties": {
        "added": {
          "$ref": "#/$defs/VulnerabilityAssessment"
        },
        "removed": {
          "$ref": "#/$defs/VulnerabilityAssessment"
        },
        "triggered_by_risk_rule": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string"
            },
            "name": {
              "type": "string"
            },
            "description": {
              "type": "string"
            },
            "evidence_string": {
              "type": "string"
            },
            "machine_name": {
              "type": "string",
              "enum": [
                "recentMalwareActivity",
                "vendorCritical",
                "nistCritical",
                "malwareActivity",
                "recentPocVerifiedRemote",
                "historicMalwareActivity",
                "recentAnalystNote",
                "vendorHigh",
                "nistHigh",
                "recentPocVerified",
                "vendorMedium",
                "nistMedium",
                "recentLikelyExploitDevelopment",
                "recentScannerUptake",
                "linkedToRecentExploitKit",
                "linkedToRecentRAT",
                "linkedToRecentRansomware",
                "linkedToRecentIntrusionMethod",
                "noCvssScore",
                "pocVerifiedRemote",
                "recentPocUnverified",
                "pocVerified",
                "vendorLow",
                "nistLow",
                "likelyExploitDevelopment",
                "linkedToRecentCyberExploit",
                "linkedToCyberExploit",
                "scannerUptake",
                "linkedToExploitKit",
                "linkedToRAT",
                "linkedToRansomware",
                "linkedToIntrusionMethod",
                "recentRelatedNote",
                "analystNote",
                "relatedNote",
                "awaitingCvssScore",
                "pocUnverified",
                "cyberSignalCritical",
                "cyberSignalHigh",
                "cyberSignalMedium"
              ]
            },
            "timestamp": {
              "type": "string",
              "format": "date-time"
            }
          },
          "required": [
            "id"
          ]
        },
        "type": {
          "type": "string",
          "enum": [
            "lifecycle_in_cve_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "WhoIsAttributeItem": {
      "type": "object",
      "properties": {
        "provider": {
          "type": "string"
        },
        "entity": {
          "type": "string"
        },
        "attribute": {
          "type": "string",
          "enum": [
            "attr:whois",
            "attr:whoisContacts"
          ]
        },
        "value": {
          "oneOf": [
            {
              "type": "object",
              "description": "Attribute value for attr:whois",
              "not": {
                "required": [
                  "type"
                ]
              },
              "properties": {
                "status": {
                  "type": "string"
                },
                "registrarName": {
                  "type": "string"
                },
                "privateRegistration": {
                  "type": "boolean"
                },
                "nameServers": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "contactEmail": {
                  "type": "string",
                  "format": "email"
                },
                "createdDate": {
                  "type": "string",
                  "format": "date-time"
                },
                "updatedDate": {
                  "type": "string",
                  "format": "date-time"
                },
                "expiresDate": {
                  "type": "string",
                  "format": "date-time"
                }
              }
            },
            {
              "type": "object",
              "description": "Attribute value for attr:whoisContacts",
              "properties": {
                "type": {
                  "type": "string",
                  "enum": [
                    "technicalContact",
                    "registrant",
                    "organization",
                    "administrativeContact"
                  ]
                },
                "telephone": {
                  "type": "string"
                },
                "street1": {
                  "type": "string"
                },
                "state": {
                  "type": "string"
                },
                "postalCode": {
                  "type": "string"
                },
                "organization": {
                  "type": "string"
                },
                "name": {
                  "type": "string"
                },
                "fax": {
                  "type": "string"
                },
                "email": {
                  "type": "string"
                },
                "countryCode": {
                  "type": "string"
                },
                "country": {
                  "type": "string"
                },
                "city": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ]
            }
          ]
        },
        "added": {
          "type": "string",
          "format": "date-time"
        },
        "removed": {
          "type": "string",
          "format": "date-time"
        }
      },
      "required": [
        "provider",
        "entity",
        "attribute",
        "value"
      ]
    },
    "WhoisContactRecordV2": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string"
        },
        "telephone": {
          "type": "string"
        },
        "street1": {
          "type": "string"
        },
        "state": {
          "type": "string"
        },
        "postal_code": {
          "type": "string"
        },
        "organization": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "fax": {
          "type": "string"
        },
        "email": {
          "type": "string"
        },
        "country_code": {
          "type": "string"
        },
        "country": {
          "type": "string"
        },
        "city": {
          "type": "string"
        },
        "created": {
          "type": "string",
          "format": "date-time"
        }
      },
      "required": [
        "type"
      ]
    },
    "WhoisRecordV2": {
      "type": "object",
      "properties": {
        "status": {
          "type": "string"
        },
        "registrar_name": {
          "type": "string"
        },
        "private_registration": {
          "type": "boolean"
        },
        "name_servers": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "contact_email": {
          "type": "string"
        },
        "created": {
          "type": "string",
          "format": "date-time"
        }
      },
      "required": [
        "name_servers"
      ]
    }
  }
}