AlertSearchDetailsResponseV2

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/recorded-future/main/json-schema/recorded-future-alert-search-details-response-v2-schema.json",
  "title": "AlertSearchDetailsResponseV2",
  "x-generated": "2026-10-20",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/recorded-future-alert-api-openapi.yml#/components/schemas/AlertSearchDetailsResponseV2",
  "type": "object",
  "properties": {
    "data": {
      "type": "object",
      "properties": {
        "results": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/AlertV2Detailed"
          }
        }
      },
      "required": [
        "results"
      ]
    },
    "counts": {
      "$ref": "#/$defs/Counts"
    }
  },
  "required": [
    "data",
    "counts"
  ],
  "$defs": {
    "AiInsights": {
      "type": "object",
      "description": "Recorded Future AI summary of the alert. `text` and `comment` are mutually exclusive: when a summary is available `text` holds it and `comment` is `null`; otherwise `text` is `null` and `comment` explains why no summary is available.\n",
      "properties": {
        "text": {
          "type": [
            "string",
            "null"
          ],
          "description": "The generated AI summary text. `null` when no summary is available."
        },
        "comment": {
          "type": [
            "string",
            "null"
          ],
          "description": "Human-readable explanation shown when no summary text is available (for example \"Summary is disabled for this alert.\" or \"Summary timed out.\"). `null` when `text` is populated.\n"
        }
      },
      "required": [
        "text",
        "comment"
      ]
    },
    "AlertCountsV2": {
      "type": "object",
      "description": "Per-alert counts of the intelligence that triggered the alert",
      "properties": {
        "documents": {
          "type": "integer",
          "format": "int32",
          "description": "Number of distinct documents among the visible references"
        },
        "entities": {
          "type": "integer",
          "format": "int32",
          "description": "Number of signals/entities"
        },
        "references": {
          "type": "integer",
          "format": "int32",
          "description": "Number of visible references"
        }
      },
      "required": [
        "documents",
        "entities",
        "references"
      ]
    },
    "AlertEntityV2": {
      "type": "object",
      "description": "An entity involved in the alert, with its risk and/or trend context",
      "properties": {
        "entity": {
          "$ref": "#/$defs/Entity"
        },
        "risk": {
          "$ref": "#/$defs/EntityRiskV2"
        },
        "trend": {
          "$ref": "#/$defs/EntityTrendV2"
        },
        "documents": {
          "type": "array",
          "description": "Documents for event/reference alerts. Usually empty for signal alerts.",
          "minItems": 0,
          "items": {
            "$ref": "#/$defs/DocumentV2"
          }
        }
      },
      "required": [
        "entity",
        "risk",
        "trend",
        "documents"
      ]
    },
    "AlertV2Detailed": {
      "description": "Detailed representation of an alert (V2 lookup and search/details endpoints). Extends the summary with the triggering intelligence.\n",
      "allOf": [
        {
          "$ref": "#/$defs/AlertV2Summary"
        },
        {
          "type": "object",
          "properties": {
            "counts": {
              "$ref": "#/$defs/AlertCountsV2"
            },
            "entities": {
              "type": "array",
              "description": "A list of entities tied to the alert",
              "items": {
                "$ref": "#/$defs/AlertEntityV2"
              }
            },
            "triggered_by": {
              "type": "array",
              "description": "A list of entity path chains showing which entities matched which rules/lists",
              "items": {
                "$ref": "#/$defs/TriggeredBy"
              }
            }
          },
          "required": [
            "counts",
            "entities",
            "triggered_by"
          ]
        }
      ]
    },
    "AlertV2Summary": {
      "type": "object",
      "description": "Summary representation of an alert",
      "properties": {
        "id": {
          "type": "string",
          "description": "Alert id"
        },
        "title": {
          "type": "string",
          "description": "Alert title"
        },
        "type": {
          "type": "string",
          "description": "Alert type",
          "enum": [
            "ENTITY",
            "EVENT",
            "REFERENCE",
            "OTHER"
          ]
        },
        "triggered": {
          "type": "string",
          "format": "date-time",
          "description": "Timestamp of when the alert was triggered"
        },
        "url": {
          "type": "string",
          "description": "Portal URL for the alert"
        },
        "rule": {
          "$ref": "#/$defs/RuleV2"
        },
        "ai_insights": {
          "$ref": "#/$defs/AiInsights"
        },
        "review": {
          "$ref": "#/$defs/ReviewV2"
        },
        "owner_organisation_details": {
          "$ref": "#/$defs/OwnerOrganisationDetails"
        }
      },
      "required": [
        "id",
        "title",
        "type",
        "triggered",
        "url",
        "rule",
        "ai_insights",
        "review",
        "owner_organisation_details"
      ]
    },
    "Counts": {
      "type": "object",
      "properties": {
        "returned": {
          "type": "integer",
          "format": "int64",
          "description": "Number of alerts returned"
        },
        "total": {
          "type": "integer",
          "format": "int64",
          "description": "Total number of alerts matching the query"
        }
      },
      "required": [
        "returned",
        "total"
      ]
    },
    "DocumentV2": {
      "type": "object",
      "description": "A source document that contributed to an entity's risk or trend",
      "properties": {
        "title": {
          "type": [
            "string",
            "null"
          ],
          "description": "Title of the document"
        },
        "url": {
          "type": [
            "string",
            "null"
          ],
          "description": "URL of the document"
        },
        "source": {
          "$ref": "#/$defs/Entity",
          "description": "Source entity of the document"
        },
        "authors": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          },
          "description": "Authors of the document"
        },
        "references": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/ReferenceV2"
          },
          "description": "References tied to the document"
        }
      },
      "required": [
        "title",
        "url",
        "source",
        "authors",
        "references"
      ]
    },
    "Entity": {
      "type": [
        "object",
        "null"
      ],
      "description": "A Recorded Future entity reference. Returned as `null` if the requesting user does not have access to the entity.\n",
      "properties": {
        "id": {
          "type": "string",
          "description": "Entity id"
        },
        "name": {
          "type": "string",
          "description": "Entity display name"
        },
        "type": {
          "type": "string",
          "description": "Entity type\n\nSome examples are Malware, InternetDomainName, IpAddress, Hash and Company\n"
        },
        "description": {
          "type": "string",
          "description": "Entity description. Only present when the entity has a description attribute."
        }
      },
      "required": [
        "id",
        "name",
        "type"
      ]
    },
    "EntityPathNode": {
      "type": "object",
      "description": "A node in a trigger entity path",
      "properties": {
        "entity": {
          "$ref": "#/$defs/Entity"
        },
        "attribute": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string",
              "description": "Id of the attribute connecting this node to the next"
            }
          },
          "required": [
            "id"
          ]
        },
        "composite_path": {
          "type": "array",
          "description": "Only present for composite attribute paths",
          "items": {
            "type": "string"
          }
        }
      },
      "required": [
        "entity",
        "attribute"
      ]
    },
    "EntityRiskV2": {
      "description": "Risk information for the entity. Empty for non-risk alerts; individual sub-fields may be `null`.\n",
      "oneOf": [
        {
          "type": "object",
          "maxProperties": 0
        },
        {
          "type": "object",
          "properties": {
            "criticality": {
              "type": [
                "integer",
                "null"
              ],
              "format": "int32",
              "minimum": 0,
              "maximum": 5,
              "description": "Criticality level of the entity"
            },
            "criticalityLabel": {
              "type": [
                "string",
                "null"
              ],
              "description": "Criticality label of the entity"
            },
            "score": {
              "type": [
                "integer",
                "null"
              ],
              "minimum": 0,
              "maximum": 99,
              "description": "Risk score of the entity"
            },
            "evidence": {
              "type": [
                "array",
                "null"
              ],
              "description": "List of evidence related to the entity",
              "items": {
                "$ref": "#/$defs/EvidenceV2"
              }
            },
            "documents": {
              "type": [
                "array",
                "null"
              ],
              "description": "List of documents related to the entity",
              "items": {
                "$ref": "#/$defs/DocumentV2"
              }
            }
          }
        }
      ]
    },
    "EntityTrendV2": {
      "description": "Trend information for the entity. Empty object (`{}`) for non-trend alerts.\n",
      "oneOf": [
        {
          "type": "object",
          "maxProperties": 0
        },
        {
          "type": "object",
          "properties": {
            "name": {
              "type": [
                "string",
                "null"
              ],
              "description": "The entity's role in the cyber trend"
            },
            "strength": {
              "type": "integer",
              "minimum": 0,
              "maximum": 5,
              "format": "int32",
              "description": "Trend signal strength"
            },
            "strengthLabel": {
              "type": "string",
              "description": "Trend strength label"
            },
            "documents": {
              "type": "array",
              "description": "List of documents related to the entity",
              "items": {
                "$ref": "#/$defs/DocumentV2"
              }
            }
          },
          "required": [
            "name",
            "strength",
            "strengthLabel",
            "documents"
          ]
        }
      ]
    },
    "EvidenceV2": {
      "type": "object",
      "description": "A single piece of risk evidence showing data that is triggering the risk rule",
      "properties": {
        "rule": {
          "type": "string",
          "description": "Risk rule name"
        },
        "criticality": {
          "type": "integer",
          "format": "int32",
          "minimum": 0,
          "maximum": 5,
          "description": "Risk rule criticality score"
        },
        "criticalityLabel": {
          "type": "string",
          "description": "Risk rule criticality label"
        },
        "evidenceString": {
          "type": "string",
          "description": "Text evidence for the risk rule"
        },
        "mitigationString": {
          "type": "string",
          "description": "Mitigation text. Empty string when no mitigation is available."
        },
        "timestamp": {
          "type": "string",
          "format": "date-time",
          "description": "Timestamp of evidence document creation"
        }
      },
      "required": [
        "rule",
        "criticality",
        "criticalityLabel",
        "evidenceString",
        "mitigationString",
        "timestamp"
      ]
    },
    "OwnerOrganisationDetails": {
      "type": "object",
      "description": "Details about the owner of the alert's rule and their organisation(s)",
      "properties": {
        "owner_id": {
          "type": "string",
          "description": "Id of the owning user. Only present when the owner is an individual user."
        },
        "owner_name": {
          "type": "string",
          "description": "Name of the owning user. Only present when the owner is an individual user."
        },
        "organisations": {
          "type": "array",
          "description": "Organisations the alert is shared with. May be empty.",
          "minItems": 0,
          "items": {
            "type": "object",
            "properties": {
              "organisation_id": {
                "type": "string",
                "description": "Id of the organisation"
              },
              "organisation_name": {
                "type": "string",
                "description": "Name of the organisation"
              }
            },
            "required": [
              "organisation_id",
              "organisation_name"
            ]
          }
        },
        "enterprise_id": {
          "type": [
            "string",
            "null"
          ],
          "description": "Id of the owner's enterprise"
        },
        "enterprise_name": {
          "type": [
            "string",
            "null"
          ],
          "description": "Name of the owner's enterprise"
        }
      },
      "required": [
        "organisations",
        "enterprise_id",
        "enterprise_name"
      ]
    },
    "ReferenceV2": {
      "type": "object",
      "description": "A reference (document fragment) supporting a risk rule or trend",
      "properties": {
        "id": {
          "type": "string",
          "description": "Reference id"
        },
        "fragment": {
          "type": [
            "string",
            "null"
          ],
          "description": "Text fragment summarizing the intelligence match"
        },
        "language": {
          "type": [
            "string",
            "null"
          ],
          "description": "Language of the text fragment"
        },
        "entities": {
          "type": "array",
          "description": "Entities tied to the reference",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "noteId": {
          "type": [
            "string",
            "null"
          ],
          "description": "Analyst note id. Only present for analyst note / Insikt Group sources."
        },
        "noteLink": {
          "type": [
            "string",
            "null"
          ],
          "description": "Portal link to the analyst note. Only present for analyst note / Insikt Group sources."
        }
      },
      "required": [
        "id",
        "fragment",
        "language",
        "entities"
      ]
    },
    "ReviewV2": {
      "type": "object",
      "description": "Triage/review information for the alert",
      "properties": {
        "status": {
          "deprecated": true,
          "type": [
            "string",
            "null"
          ],
          "description": "Deprecated legacy review status. Use `statusInPortal` instead. `null` when the alert has no review status.",
          "enum": [
            "unassigned",
            "assigned",
            "pending",
            "dismiss",
            "no-action",
            "actionable",
            "tuning",
            null
          ]
        },
        "statusInPortal": {
          "type": "string",
          "description": "Alert review status as shown in the portal. Defaults to \"Unknown\".",
          "enum": [
            "New",
            "Resolved",
            "Pending",
            "Dismissed",
            "Flag for Tuning",
            "Unknown"
          ]
        },
        "statusDate": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time",
          "description": "When the status was last changed"
        },
        "statusChangeBy": {
          "type": [
            "string",
            "null"
          ],
          "description": "Email of the user who last changed the status"
        },
        "assignee": {
          "type": [
            "string",
            "null"
          ],
          "description": "Email of the assigned user"
        },
        "note": {
          "type": [
            "string",
            "null"
          ],
          "description": "Review note text"
        },
        "noteAuthor": {
          "type": [
            "string",
            "null"
          ],
          "description": "Email of the note author"
        },
        "noteDate": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time",
          "description": "When the note was last updated"
        }
      },
      "required": [
        "status",
        "statusInPortal",
        "statusDate",
        "statusChangeBy",
        "assignee",
        "note",
        "noteAuthor",
        "noteDate"
      ]
    },
    "RuleV2": {
      "type": "object",
      "description": "The alert rule that produced the alert",
      "properties": {
        "id": {
          "type": "string",
          "description": "Rule id"
        },
        "name": {
          "type": "string",
          "description": "Rule title, or \"No access to alert rule\" if the rule cannot be accessed"
        },
        "url": {
          "type": "string",
          "description": "Portal URL to view the rule"
        },
        "owner_id": {
          "type": "string",
          "description": "Id of the rule owner"
        },
        "owner_name": {
          "type": "string",
          "description": "Name of the rule owner"
        },
        "organisation_id": {
          "type": "string",
          "description": "Id of the rule owner organisation"
        },
        "organisation_name": {
          "type": "string",
          "description": "Name of the rule owner organisation"
        },
        "use_case_deprecation": {
          "$ref": "#/$defs/UseCaseDeprecation"
        }
      },
      "required": [
        "id",
        "name",
        "url",
        "owner_id",
        "owner_name",
        "organisation_id",
        "organisation_name",
        "use_case_deprecation"
      ]
    },
    "TriggeredBy": {
      "type": "object",
      "description": "One triggering reference and the entity path(s) that matched the alert rule",
      "properties": {
        "reference_id": {
          "type": "string",
          "description": "Id of the reference that triggered the alert"
        },
        "entity_path": {
          "deprecated": true,
          "type": "array",
          "description": "Deprecated. The single, shortest matching entity path. Use `entity_paths` instead.\n",
          "items": {
            "$ref": "#/$defs/EntityPathNode"
          }
        },
        "entity_paths": {
          "type": "array",
          "description": "All relevant matching entity paths. Each path is an ordered array of nodes.",
          "items": {
            "type": "array",
            "items": {
              "$ref": "#/$defs/EntityPathNode"
            }
          }
        }
      },
      "required": [
        "reference_id",
        "entity_path",
        "entity_paths"
      ]
    },
    "UseCaseDeprecation": {
      "type": [
        "object",
        "null"
      ],
      "description": "Deprecation notice for the rule's use case. `null` unless the rule's use case is deprecated and the notice is currently active.\n",
      "properties": {
        "from": {
          "type": [
            "string",
            "null"
          ],
          "format": "date-time",
          "description": "Date from which the use case is deprecated"
        },
        "description": {
          "type": "string",
          "description": "Human-readable deprecation description"
        },
        "links": {
          "type": "object",
          "description": "Related links keyed by label",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    }
  }
}