Recorded Future Alert API

openapi: 3.1.1
info:
  title: Alert API
  version: 3.0.0
  description: 'The Alert API allows for interacting with Recorded Future Alerts and Alert rules.


    Please read the [documentation](https://docs.recordedfuture.com/reference/alerts-get-by-id) before using this API.

    '
  x-rf-service-id: service:alert-api
paths:
  /rule:
    servers:
    - url: api.recordedfuture.com/alert/v2
      description: V2 endpoints
      x-internal: false
    - url: api.recordedfuture.com/v2/alert
      description: V2 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Search for alert rules.
      tags:
      - Alert
      description: 'Search for alert rules based on a set of filters.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/FreetextQueryParameter'
      - $ref: '#/components/parameters/LimitQueryParameter'
      - $ref: '#/components/parameters/TaggedTextQueryParameter'
      responses:
        '200':
          description: List of alert rule definitions matching the search criteria
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertRuleSearchResponseV2'
  /search:
    servers:
    - url: api.recordedfuture.com/alert/v2
      description: V2 endpoints
      x-internal: false
    - url: api.recordedfuture.com/v2/alert
      description: V2 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Search for alerts
      tags:
      - Alert (deprecated)
      description: 'Search for alerts based on a set of filters.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/TriggeredQueryParameter'
      - $ref: '#/components/parameters/AssigneeQueryParameter'
      - $ref: '#/components/parameters/StatusQueryParameter'
      - $ref: '#/components/parameters/AlertRuleQueryParameter'
      - $ref: '#/components/parameters/FreetextQueryParameter'
      - $ref: '#/components/parameters/LimitQueryParameter'
      - $ref: '#/components/parameters/OffsetQueryParameter'
      - $ref: '#/components/parameters/TaggedTextQueryParameter'
      - $ref: '#/components/parameters/OrderByQueryParameter'
      - $ref: '#/components/parameters/DirectionQueryParameter'
      responses:
        '200':
          description: A list of alerts matching the search criteria
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertSearchResponseV2'
  /search/details:
    servers:
    - url: api.recordedfuture.com/alert/v2
      description: V2 endpoints
      x-internal: false
    - url: api.recordedfuture.com/v2/alert
      description: V2 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Search for alerts with extra details
      tags:
      - Alert (deprecated)
      description: 'Search for alerts based on a set of filters. This endpoint includes more data compared to the regular search endpoint.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/TriggeredQueryParameter'
      - $ref: '#/components/parameters/AssigneeQueryParameter'
      - $ref: '#/components/parameters/StatusQueryParameter'
      - $ref: '#/components/parameters/AlertRuleQueryParameter'
      - $ref: '#/components/parameters/FreetextQueryParameter'
      - $ref: '#/components/parameters/LimitQueryParameter'
      - $ref: '#/components/parameters/OffsetQueryParameter'
      - $ref: '#/components/parameters/TaggedTextQueryParameter'
      - $ref: '#/components/parameters/OrderByQueryParameter'
      - $ref: '#/components/parameters/DirectionQueryParameter'
      responses:
        '200':
          description: A list of alerts matching the search criteria with extra details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertSearchDetailsResponseV2'
  /update:
    servers:
    - url: api.recordedfuture.com/alert/v2
      description: V2 endpoints
      x-internal: false
    - url: api.recordedfuture.com/v2/alert
      description: V2 Proxy Redirect (Legacy)
      x-internal: false
    post:
      summary: Update one or several alerts
      tags:
      - Alert
      description: 'Updates one or several alerts. It''s possible to update assignee, status and a note tied to the triggered alert.


        There are two types of statuses, the recommended "statusInPortal" and the legacy "status". They are mapped, so changing one will change the other and it is not possible to update both independently.

        '
      security:
      - ApiKeyAuth: []
      requestBody:
        description: Alert properties to be updated
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertUpdateData'
      responses:
        '200':
          description: A partial view of the updated alert(s). If any alert update fails, errors will be included as well.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertUpdateResponse'
  /v3:
    servers:
    - url: api.recordedfuture.com/alert
      x-internal: false
    - url: api.recordedfuture.com/v3/alerts
      description: V3 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Search for alerts
      tags:
      - Alert V3
      description: 'Search for alerts based on a set of filters.


        Using the fields parameter the response can be set to include a set of fields. If no fields parameter is set, all available fields will be included in the response. For better performance it is recommended to use the fields parameter to limit the response to only return the fields you need.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/TriggeredQueryParameter'
      - $ref: '#/components/parameters/AssigneeQueryParameter'
      - $ref: '#/components/parameters/StatusInPortalQueryParameter'
      - $ref: '#/components/parameters/AlertRuleQueryParameter'
      - $ref: '#/components/parameters/FreetextQueryParameter'
      - $ref: '#/components/parameters/LimitQueryParameter'
      - $ref: '#/components/parameters/OffsetQueryParameter'
      - $ref: '#/components/parameters/TaggedTextQueryParameter'
      - $ref: '#/components/parameters/OrderByQueryParameter'
      - $ref: '#/components/parameters/DirectionQueryParameter'
      - $ref: '#/components/parameters/FieldsQueryParameter'
      responses:
        '200':
          description: 'A list of alerts matching the search criteria


            Using the fields parameter the response can be set to include a set of fields. If no fields parameter is set, all available fields will be included in the response. For better performance it is recommended to use the fields parameter to limit the response to only return the fields you need.

            '
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertSearchResponseV3'
  /v3/hits:
    servers:
    - url: api.recordedfuture.com/alert
      x-internal: false
    - url: api.recordedfuture.com/v3/alerts
      description: V3 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Fetch a flat collection of hits
      tags:
      - Alert V3
      description: 'Returns only a flat array of all hits (the Intelligence Cloud data that caused the alert to trigger) for one or several alerts.


        This endpoint will also include the alert ID and a numeric index for each hits object.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/AlertIdsQueryParameter'
      - $ref: '#/components/parameters/TaggedTextQueryParameter'
      responses:
        '200':
          description: A list of hits for the alert(s)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertHitsResponseV3'
  /v3/image:
    servers:
    - url: api.recordedfuture.com/alert
      x-internal: false
    - url: api.recordedfuture.com/v3/alerts
      description: V3 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Fetch raw image data
      tags:
      - Alert V3
      description: 'Fetch the raw image data of an image tied to an alert.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/ImageIdQueryParameter'
      responses:
        '200':
          description: The raw image data
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
  /v3/{alert_id}:
    servers:
    - url: api.recordedfuture.com/alert
      x-internal: false
    - url: api.recordedfuture.com/v3/alerts
      description: V3 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Fetch alert by id
      tags:
      - Alert V3
      description: 'Fetch an alert by id.


        Using the fields parameter the response can be set to include a set of fields. If no fields parameter is set, all available fields will be included in the response. For better performance it is recommended to use the fields parameter to limit the response to only return the fields you need.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/AlertIdQueryParameter'
      - $ref: '#/components/parameters/FieldsQueryParameter'
      - $ref: '#/components/parameters/TaggedTextQueryParameter'
      responses:
        '200':
          description: The current state of the alert
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertLookupResponseV3'
  /{alert_id}:
    servers:
    - url: api.recordedfuture.com/alert/v2
      description: V2 endpoints
      x-internal: false
    - url: api.recordedfuture.com/v2/alert
      description: V2 Proxy Redirect (Legacy)
      x-internal: false
    get:
      summary: Fetch alert by id
      tags:
      - Alert (deprecated)
      description: 'Fetch an alert by id. This endpoint includes all available fields in the response.

        '
      security:
      - ApiKeyAuth: []
      parameters:
      - $ref: '#/components/parameters/AlertIdQueryParameter'
      - $ref: '#/components/parameters/TaggedTextQueryParameter'
      responses:
        '200':
          description: The current state of the alert
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertLookupResponseV2'
components:
  parameters:
    AlertIdQueryParameter:
      in: path
      name: alert_id
      description: Id of alert to fetch
      schema:
        type: string
        example: 5PqsAw
      required: true
    TaggedTextQueryParameter:
      in: query
      name: taggedText
      description: Include text tags
      schema:
        type: boolean
        default: false
      required: false
    TriggeredQueryParameter:
      in: query
      name: triggered
      description: 'The triggered time itself has millisecond precision, but can be searched for using parameters of higher granularity on the form [x, y], which is interpreted as beginning of x until end of y.


        For example:

        * [2024-08-01, 2024-08-14] matches alerts triggered since beginning of 2024-08-01 to end of 2023-08-14

        * [2024-09-23 12:02, 2024-09-23 12:03] matches alerts triggered since beginning of 12:02 to end of 12:03, for example including an alert with triggered: 12:03:58.567


        The format of the time is either 2024-09-23 12:03:58.000 or 2024-09-23T12:03:58.000Z (the T and Z are optional). The precision used can range from a year down to milliseconds. On the form [x, y], x and y should have the same level of precision (e.g. date, minutes, milliseconds).

        Relative time expressions are also supported, such as -2d, which means two days prior to today and yesterday. As with absolute time references, both ends of the range still need to be specified. For example, to search for alerts that fired within the last 24 hrs, use triggered = [-24h,].

        Open-ended ranges is allowed, but will only exclude one single millisecond compared to a closed-ended range, and therefore only make sense to use when filtering on millisecond precision.


        For example:

        - [2024-09-23 12:03:58.000, 2024-09-23 12:03:58.567) will match an alert triggered at 12:03:58.567 but not an alert triggered at 12:03:58.568.

        '
      schema:
        type: string
        example: '2026-01-01'
      required: false
    AssigneeQueryParameter:
      in: query
      name: assignee
      description: 'Filter by a specific assigned user, using the email address associated with that user account, or use ''NONE'' to explicitly match against unassigned alerts.

        '
      schema:
        type: string
      required: false
    StatusQueryParameter:
      in: query
      name: status
      description: 'Filter by review status.

        '
      schema:
        type: string
        enum:
        - unassigned
        - assigned
        - pending
        - dismiss
        - no-action
        - actionable
        - tuning
      required: false
    AlertRuleQueryParameter:
      in: query
      name: alertRule
      description: 'Filter by alert rule id.

        '
      schema:
        type: string
      required: false
    FreetextQueryParameter:
      in: query
      name: freetext
      description: 'Filter by any text.

        '
      schema:
        type: string
      required: false
    LimitQueryParameter:
      in: query
      name: limit
      description: 'Maximum number of items to include

        '
      schema:
        type: integer
        format: int32
        minimum: 1
        maximum: 1000
        default: 10
      required: false
    OffsetQueryParameter:
      in: query
      name: from
      description: 'Offset search from previous result. The API may only return the first 1000 results, meaning that limit + from cannot exceed 1000.

        '
      schema:
        type: integer
        format: int32
        minimum: 1
        maximum: 1000
      required: false
    OrderByQueryParameter:
      in: query
      name: orderby
      description: Sort order
      schema:
        type: string
        enum:
        - triggered
      required: false
    DirectionQueryParameter:
      in: query
      name: direction
      description: Sort direction based on the triggered timestamp
      schema:
        type: string
        enum:
        - asc
        - desc
        default: desc
      required: false
    FieldsQueryParameter:
      in: query
      name: fields
      description: "Fields to include in the response. If no specific fields are requested, all available fields are included in the response.\n\nValues should be separated by comma.\n\nAvailable fields are:\n* ai_insights\n* enriched_entities \n* hits \n* id \n* log \n* owner_organisation_details \n* review\n* rule\n* title\n* triggered_by \n* type\n* url\n"
      schema:
        type: string
      required: false
    AlertIdsQueryParameter:
      in: query
      name: ids
      description: Alert ids separated by comma
      schema:
        type: string
        example: 5PqsAw
      required: true
    ImageIdQueryParameter:
      in: query
      name: id
      description: Image id
      schema:
        type: string
        example: img:0c11f825-a2ff-454f-aa1a-d7568eaf0a60
      required: true
    StatusInPortalQueryParameter:
      in: query
      name: statusInPortal
      description: 'Filter by review status.

        '
      schema:
        type: string
        enum:
        - New
        - Resolved
        - Pending
        - Dismissed
        - Flag for Tuning
      required: false
  schemas:
    AlertLookupResponseV2:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/AlertV2Detailed'
      required:
      - data
    Entity:
      type:
      - object
      - 'null'
      description: 'A Recorded Future entity reference. Returned as `null` if the requesting user does not have access to the entity.

        '
      properties:
        id:
          type: string
          description: Entity id
          example: idn:services.onlinebox.com
        name:
          type: string
          description: Entity display name
          example: services.onlinebox.com
        type:
          type: string
          description: 'Entity type


            Some examples are Malware, InternetDomainName, IpAddress, Hash and Company

            '
          example: InternetDomainName
        description:
          type: string
          description: Entity description. Only present when the entity has a description attribute.
      required:
      - id
      - name
      - type
    AiInsights:
      type: object
      description: 'Recorded Future AI summary of the alert. `text` and `comment` are mutually exclusive: when a summary is available `text` holds it and `comment` is `null`; otherwise `text` is `null` and `comment` explains why no summary is available.

        '
      properties:
        text:
          type:
          - string
          - 'null'
          description: The generated AI summary text. `null` when no summary is available.
          example: null
        comment:
          type:
          - string
          - 'null'
          description: 'Human-readable explanation shown when no summary text is available (for example "Summary is disabled for this alert." or "Summary timed out."). `null` when `text` is populated.

            '
          example: A summary has not yet been generated for this alert.
      required:
      - text
      - comment
    OwnerOrganisationDetails:
      type: object
      description: Details about the owner of the alert's rule and their organisation(s)
      properties:
        owner_id:
          type: string
          example: uhash:b2ai0ilv2p
          description: Id of the owning user. Only present when the owner is an individual user.
        owner_name:
          type: string
          example: Recorded Future
          description: Name of the owning user. Only present when the owner is an individual user.
        organisations:
          type: array
          description: Organisations the alert is shared with. May be empty.
          minItems: 0
          items:
            type: object
            properties:
              organisation_id:
                type: string
                example: uhash:b2ai0ilv2p
                description: Id of the organisation
              organisation_name:
                type: string
                example: Recorded Future
                description: Name of the organisation
            required:
            - organisation_id
            - organisation_name
        enterprise_id:
          type:
          - string
          - 'null'
          example: uhash:b2ai0ilv2p
          description: Id of the owner's enterprise
        enterprise_name:
          type:
          - string
          - 'null'
          example: Recorded Future
          description: Name of the owner's enterprise
      required:
      - organisations
      - enterprise_id
      - enterprise_name
    UseCaseDeprecation:
      type:
      - object
      - 'null'
      description: 'Deprecation notice for the rule''s use case. `null` unless the rule''s use case is deprecated and the notice is currently active.

        '
      properties:
        from:
          type:
          - string
          - 'null'
          format: date-time
          description: Date from which the use case is deprecated
        description:
          type: string
          description: Human-readable deprecation description
        links:
          type: object
          description: Related links keyed by label
          additionalProperties:
            type: string
    EntityPathNode:
      type: object
      description: A node in a trigger entity path
      properties:
        entity:
          $ref: '#/components/schemas/Entity'
        attribute:
          type: object
          properties:
            id:
              type: string
              description: Id of the attribute connecting this node to the next
              example: CyberAttack.method
          required:
          - id
        composite_path:
          type: array
          description: Only present for composite attribute paths
          items:
            type: string
      required:
      - entity
      - attribute
    TriggeredBy:
      type: object
      description: One triggering reference and the entity path(s) that matched the alert rule
      properties:
        reference_id:
          type: string
          description: Id of the reference that triggered the alert
          example: Gb8Xd8BQBsq
        entity_path:
          deprecated: true
          type: array
          description: 'Deprecated. The single, shortest matching entity path. Use `entity_paths` instead.

            '
          items:
            $ref: '#/components/schemas/EntityPathNode'
        entity_paths:
          type: array
          description: All relevant matching entity paths. Each path is an ordered array of nodes.
          items:
            type: array
            items:
              $ref: '#/components/schemas/EntityPathNode'
      required:
      - reference_id
      - entity_path
      - entity_paths
    RuleV2:
      type: object
      description: The alert rule that produced the alert
      properties:
        id:
          type: string
          example: WhkPbn
          description: Rule id
        name:
          type: string
          description: Rule title, or "No access to alert rule" if the rule cannot be accessed
          example: Identify Typosquats
        url:
          type: string
          description: Portal URL to view the rule
          example: https://app.recordedfuture.com/live/sc/ViewIdkobra_view_report_item_alert_editor?view_opts=%7B%22reportId%22%3A%22WhkPbn%22%2C%22bTitle%22%3Atrue%2C%22title%22%3A%22Identify+Typosquats%22%7D
        owner_id:
          type: string
          description: Id of the rule owner
          example: uhash:b2ai0ilv2p
        owner_name:
          type: string
          example: Recorded Future
          description: Name of the rule owner
        organisation_id:
          type: string
          example: uhash:b2ai0ilv2p
          description: Id of the rule owner organisation
        organisation_name:
          type: string
          example: Recorded Future
          description: Name of the rule owner organisation
        use_case_deprecation:
          $ref: '#/components/schemas/UseCaseDeprecation'
      required:
      - id
      - name
      - url
      - owner_id
      - owner_name
      - organisation_id
      - organisation_name
      - use_case_deprecation
    ReviewV2:
      type: object
      description: Triage/review information for the alert
      properties:
        status:
          deprecated: true
          type:
          - string
          - 'null'
          description: Deprecated legacy review status. Use `statusInPortal` instead. `null` when the alert has no review status.
          enum:
          - unassigned
          - assigned
          - pending
          - dismiss
          - no-action
          - actionable
          - tuning
          - null
          example: no-action
        statusInPortal:
          type: string
          description: Alert review status as shown in the portal. Defaults to "Unknown".
          enum:
          - New
          - Resolved
          - Pending
          - Dismissed
          - Flag for Tuning
          - Unknown
          example: New
        statusDate:
          type:
          - string
          - 'null'
          format: date-time
          description: When the status was last changed
        statusChangeBy:
          type:
          - string
          - 'null'
          example: testuser@recordedfuture.com
          description: Email of the user who last changed the status
        assignee:
          type:
          - string
          - 'null'
          example: null
          description: Email of the assigned user
        note:
          type:
          - string
          - 'null'
          example: Hello world
          description: Review note text
        noteAuthor:
          type:
          - string
          - 'null'
          example: testuser@recordedfuture.com
          description: Email of the note author
        noteDate:
          type:
          - string
          - 'null'
          format: date-time
          description: When the note was last updated
      required:
      - status
      - statusInPortal
      - statusDate
      - statusChangeBy
      - assignee
      - note
      - noteAuthor
      - noteDate
    EvidenceV2:
      type: object
      description: A single piece of risk evidence showing data that is triggering the risk rule
      properties:
        rule:
          type: string
          example: Recent Typosquat Similarity - DNS Sandwich
          description: Risk rule name
        criticality:
          type: integer
          example: 2
          format: int32
          minimum: 0
          maximum: 5
          description: Risk rule criticality score
        criticalityLabel:
          type: string
          example: Suspicious
          description: Risk rule criticality label
        evidenceString:
          type: string
          description: Text evidence for the risk rule
        mitigationString:
          type: string
          description: Mitigation text. Empty string when no mitigation is available.
        timestamp:
          type: string
          format: date-time
          description: Timestamp of evidence document creation
      required:
      - rule
      - criticality
      - criticalityLabel
      - evidenceString
      - mitigationString
      - timestamp
    ReferenceV2:
      type: object
      description: A reference (document fragment) supporting a risk rule or trend
      properties:
        id:
          type: string
          example: Gb8Xd8BQBsq
          description: Reference id
        fragment:
          type:
          - string
          - 'null'
          description: Text fragment summarizing the intelligence match
        language:
          type:
          - string
          - 'null'
          example: eng
          description: Language of the text fragment
        entities:
          type: array
          description: Entities tied to the reference
          items:
            $ref: '#/components/schemas/Entity'
        noteId:
          type:
          - string
          - 'null'
          description: Analyst note id. Only present for analyst note / Insikt Group sources.
        noteLink:
          type:
          - string
          - 'null'
          description: Portal link to the analyst note. Only present for analyst note / Insikt Group sources.
      required:
      - id
      - fragment
      - language
      - entities
    DocumentV2:
      type: object
      description: A source document that contributed to an entity's risk or trend
      properties:
        title:
          type:
          - string
          - 'null'
          description: Title of the document
        url:
          type:
          - string
          - 'null'
          description: URL of the document
        source:
          $ref: '#/components/schemas/Entity'
          description: Source entity of the document
        authors:
          type: array
          items:
            $ref: '#/components/schemas/Entity'
          description: Authors of the document
        references:
          type: array
          items:
            $ref: '#/components/schemas/ReferenceV2'
          description: References tied to the document
      required:
      - title
      - url
      - source
      - authors
      - references
    EntityRiskV2:
      description: 'Risk information for the entity. Empty for non-risk alerts; individual sub-fields may be `null`.

        '
      oneOf:
      - type: object
        maxProperties: 0
      - type: object
        properties:
          criticality:
            type:
            - integer
            - 'null'
            example: 2
            format: int32
            minimum: 0
            maximum: 5
            description: Criticality level of the entity
          criticalityLabel:
            type:
            - string
            - 'null'
            description: Criticality label of the entity
          score:
            type:
            - integer
            - 'null'
            minimum: 0
            maximum: 99
            description: Risk score of the entity
          evidence:
            type:
            - array
            - 'null'
            description: List of evidence related to the entity
            items:
              $ref: '#/components/schemas/EvidenceV2'
          documents:
            type:
            - array
            - 'null'
            description: List of documents related to the entity
            items:
              $ref: '#/components/schemas/DocumentV2'
    EntityTrendV2:
      description: 'Trend information for the entity. Empty object (`{}`) for non-trend alerts.

        '
      oneOf:
      - type: object
        maxProperties: 0
      - type: object
        properties:
          name:
            type:
            - string
            - 'null'
            example: Method
            description: The entity's role in the cyber trend
          strength:
            type: integer
            example: 3
            minimum: 0
            maximum: 5
            format: int32
            description: Trend signal strength
          strengthLabel:
            type: string
            example: Spike
            description: Trend strength label
          documents:
            type: array
            description: List of documents related to the entity
            items:
              $ref: '#/components/schemas/DocumentV2'
        required:
        - name
        - strength
        - strengthLabel
        - documents
    AlertEntityV2:
      type: object
      description: An entity involved in the alert, with its risk and/or trend context
      properties:
        entity:
          $ref: '#/components/schemas/Entity'
        risk:
          $ref: '#/components/schemas/EntityRiskV2'
        trend:
          $ref: '#/components/schemas/EntityTrendV2'
        documents:
          type: array
          description: Documents for event/reference alerts. Usually empty for signal alerts.
          minItems: 0
          items:
            $ref: '#/components/schemas/DocumentV2'
      required:
      - entity
      - risk
      - trend
      - documents
    AlertCountsV2:
      type: object
      description: Per-alert counts of the intelligence that triggered the alert
      properties:
        documents:
          type: integer
          format: int32
          description: Number of distinct documents among the visible references
          example: 6
        entities:
          type: integer
          format: int32
          description: Number of signals/entities
          example: 2
        references:
          type: integer
          format: int32
          description: Number of visible references
          example: 6
      required:
      - documents
      - entities
      - references
    AlertV2Summary:
      type: object
      description: Summary representation of an alert
      properties:
        id:
          type: string
          example: Kr2etl
          description: Alert id
        title:
          type: string
          example: Infrastructure and Brand Risk, Potential Typosquatting Watch List Domains...
          description: Alert title
        type:
          type: string
          description: Alert type
          enum:
          - ENTITY
          - EVENT
          - REFERENCE
          - OTHER
          example: ENTITY
        triggered:
          type: string
          format: date-time
          example: '2019-01-06T05:05:25.009Z'
          description: Timestamp of when the alert was triggered
        url:
          type: string
          description: Portal URL for the alert
          example: https://app.recordedfuture.com/live/sc/notification/?id=Kr2etl
        rule:
          $ref: '#/components/schemas/RuleV2'
        ai_insights:
          $ref: '#/components/schemas/AiInsights'
        review:
     

# --- truncated at 32 KB (55 KB total) ---
# Full source: https://artifacts.apis.io/recorded-future/openapi/recorded-future-alert-api-openapi.yml