MaliciousSitesResponse

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/recorded-future/main/json-schema/recorded-future-malicious-sites-response-schema.json",
  "title": "MaliciousSitesResponse",
  "x-generated": "2026-10-20",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/recorded-future-playbook-alerts-api-openapi.yml#/components/schemas/MaliciousSitesResponse",
  "type": "object",
  "required": [
    "playbook_alert_id"
  ],
  "properties": {
    "playbook_alert_id": {
      "type": "string"
    },
    "panel_status": {
      "$ref": "#/$defs/MaliciousSitesStatusPanel"
    },
    "panel_evidence_summary": {
      "$ref": "#/$defs/MaliciousSitesEvidenceSummaryPanel"
    },
    "panel_evidence_dns": {
      "$ref": "#/$defs/MaliciousSitesEvidenceDnsPanel"
    },
    "panel_evidence_whois": {
      "$ref": "#/$defs/MaliciousSitesEvidenceWhoisPanel"
    },
    "panel_triage": {
      "$ref": "#/$defs/MaliciousSitesTriagePanel"
    },
    "panel_log_v2": {
      "$ref": "#/$defs/PlaybookAlertLogPanelV2"
    }
  },
  "$defs": {
    "ActionChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "action_change"
          ]
        }
      },
      "required": [
        "type",
        "removed",
        "added"
      ]
    },
    "AssessmentIdsChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "assessment_ids_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "AssessmentSource": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "id"
      ]
    },
    "AssessmentWithSource": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "level": {
          "type": "number"
        },
        "source": {
          "$ref": "#/$defs/AssessmentSource"
        },
        "title": {
          "type": "string"
        }
      },
      "required": [
        "id",
        "level",
        "source"
      ]
    },
    "Assignee": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "id"
      ]
    },
    "AssigneeChangeV2": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "$ref": "#/$defs/Assignee"
        },
        "new": {
          "$ref": "#/$defs/Assignee"
        },
        "type": {
          "type": "string",
          "enum": [
            "assignee_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "ClusterChangeAdded": {
      "type": "object",
      "description": "Geopolitics Facility cluster change describing a new cluster of related events that became associated with the alert.\n",
      "properties": {
        "cluster_id": {
          "type": "string"
        },
        "main_event": {
          "type": "object",
          "properties": {
            "event_id": {
              "type": "string"
            },
            "assessments": {
              "type": "array",
              "items": {
                "$ref": "#/$defs/FacilityAssessment"
              }
            },
            "type": {
              "type": "string",
              "enum": [
                "event_change_added"
              ]
            }
          },
          "required": [
            "event_id",
            "type"
          ]
        },
        "other_event_ids": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "cluster_change_added"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "CodeRepoLeakageAssessmentV2": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "level": {
          "type": "number"
        },
        "title": {
          "type": "string"
        },
        "text_indicator": {
          "type": "string"
        },
        "entity": {
          "$ref": "#/$defs/Entity"
        }
      },
      "required": [
        "id",
        "level"
      ]
    },
    "CodeRepoLeakageEvidenceChangeV2": {
      "type": "object",
      "description": "This change only applies to Data Leakage on Code Repository alerts.",
      "properties": {
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/CodeRepoLeakageEvidenceV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "evidence_change"
          ]
        }
      },
      "required": [
        "added",
        "type"
      ]
    },
    "CodeRepoLeakageEvidenceV2": {
      "type": "object",
      "properties": {
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/CodeRepoLeakageAssessmentV2"
          }
        },
        "document": {
          "type": "object",
          "properties": {
            "id": {
              "type": "string"
            },
            "content": {
              "type": "string"
            },
            "owner_id": {
              "type": "string"
            },
            "owner_name": {
              "type": "string"
            },
            "published": {
              "type": "string",
              "format": "date-time"
            }
          },
          "required": [
            "id",
            "content",
            "owner_id",
            "published"
          ]
        },
        "target_entities": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "watch_lists": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "name": {
                "type": "string"
              }
            },
            "required": [
              "id"
            ]
          }
        }
      },
      "required": [
        "assessments",
        "document",
        "target_entities",
        "watch_lists"
      ]
    },
    "CommentChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "comment": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "comment_change"
          ]
        }
      },
      "required": [
        "type",
        "comment"
      ]
    },
    "CustomOnwardActionsAddedChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "added_actions_taken": {
          "$ref": "#/$defs/PlaybookAlertOnwardActionList"
        },
        "type": {
          "type": "string",
          "enum": [
            "onward_actions_added_change"
          ]
        }
      }
    },
    "CustomOnwardActionsRemovedChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed_actions_taken": {
          "$ref": "#/$defs/PlaybookAlertOnwardActionList"
        },
        "type": {
          "type": "string",
          "enum": [
            "onward_actions_removed_change"
          ]
        }
      }
    },
    "CustomStatusChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "status_change"
          ]
        },
        "actions_taken": {
          "$ref": "#/$defs/PlaybookAlertOnwardActionList"
        }
      },
      "required": [
        "type",
        "old",
        "new",
        "actions_taken"
      ]
    },
    "DescriptionChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "description_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "DnsRecordV2": {
      "type": "object",
      "properties": {
        "type": {
          "type": "string"
        },
        "entity": {
          "$ref": "#/$defs/Entity"
        }
      }
    },
    "DomainAbuseAttackerAddedChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "attacker": {
          "type": "string"
        },
        "cause": {
          "$ref": "#/$defs/DomainAbuseCause"
        },
        "manual_addition_user_id": {
          "type": "string"
        },
        "manual_addition_user_name": {
          "type": "string"
        },
        "typosquat_targets": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "similar_domains_keywords": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "attacker_added_change"
          ]
        }
      },
      "required": [
        "attacker",
        "type"
      ]
    },
    "DomainAbuseCause": {
      "type": "string",
      "description": "Domain Abuse attacker detection cause.",
      "enum": [
        "manual",
        "typosquat",
        "similar_domains"
      ]
    },
    "DomainAbuseDnsChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DnsRecordV2"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DnsRecordV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "dns_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed",
        "added"
      ]
    },
    "DomainAbuseLogotypeChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogotypeInScreenshotV2"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/LogotypeInScreenshotV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "logotype_in_screenshot_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed",
        "added"
      ]
    },
    "DomainAbuseMaliciousDnsChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousDnsRecord"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousDnsRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_dns_change"
          ]
        }
      },
      "required": [
        "domain",
        "type",
        "removed",
        "added"
      ]
    },
    "DomainAbuseMaliciousUrlChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousUrlRecord"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousUrlRecord"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "malicious_url_change"
          ]
        }
      },
      "required": [
        "domain",
        "removed",
        "added",
        "type"
      ]
    },
    "DomainAbusePhishingMaliciousBehaviorChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "added": {
          "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreats"
        },
        "removed": {
          "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreats"
        },
        "type": {
          "type": "string",
          "enum": [
            "phishing_malicious_behavior_change"
          ]
        }
      },
      "required": [
        "domain",
        "added",
        "type"
      ]
    },
    "DomainAbusePhishingMaliciousBehaviorThreatType": {
      "type": "string",
      "description": "A kind of threat present in the domain.",
      "enum": [
        "malware",
        "unwanted_software",
        "social_engineering",
        "social_engineering_extended_coverage"
      ]
    },
    "DomainAbusePhishingMaliciousBehaviorThreats": {
      "type": "object",
      "properties": {
        "threat_types": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/DomainAbusePhishingMaliciousBehaviorThreatType"
          }
        }
      }
    },
    "DomainAbuseReregistrationChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "removed": {
          "$ref": "#/$defs/ReregistrationRecord"
        },
        "added": {
          "$ref": "#/$defs/ReregistrationRecord"
        },
        "type": {
          "type": "string",
          "enum": [
            "reregistration_change"
          ]
        }
      },
      "required": [
        "domain",
        "type"
      ]
    },
    "DomainAbuseScreenshotMentionsChange": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "added": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "url": {
                "type": "string"
              },
              "screenshot_id": {
                "type": "string"
              },
              "document": {
                "type": "string"
              },
              "analyzed": {
                "type": "string",
                "format": "date-time"
              },
              "mentioned_entities": {
                "type": "array",
                "items": {
                  "$ref": "#/$defs/MentionedEntity"
                }
              },
              "mentioned_texts": {
                "type": "array",
                "items": {
                  "$ref": "#/$defs/MentionedText"
                }
              }
            },
            "required": [
              "url",
              "screenshot_id",
              "document",
              "analyzed",
              "mentioned_entities"
            ]
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "screenshot_mentions_change"
          ]
        }
      },
      "required": [
        "domain",
        "added",
        "type"
      ]
    },
    "DomainAbuseSyncChange": {
      "type": "object",
      "description": "The alert's assessments were re-synchronised.",
      "properties": {
        "domain": {
          "type": "string",
          "description": "The domain whose assessments were synchronised."
        },
        "assessments_before": {
          "type": "array",
          "description": "Assessment ids held before the synchronisation.",
          "items": {
            "type": "string"
          }
        },
        "assessments_after": {
          "type": "array",
          "description": "Assessment ids held after the synchronisation.",
          "items": {
            "type": "string"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "domain_abuse_sync_change"
          ]
        }
      },
      "required": [
        "domain",
        "assessments_before",
        "assessments_after",
        "type"
      ]
    },
    "DomainAbuseWhoisChangeV2": {
      "type": "object",
      "description": "This change only applies to Domain Abuse alerts.",
      "properties": {
        "domain": {
          "type": "string"
        },
        "old_record": {
          "$ref": "#/$defs/WhoisRecordV2"
        },
        "new_record": {
          "$ref": "#/$defs/WhoisRecordV2"
        },
        "removed_contacts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/WhoisContactRecordV2"
          }
        },
        "added_contacts": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/WhoisContactRecordV2"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "whois_change"
          ]
        }
      },
      "required": [
        "type",
        "domain",
        "removed_contacts",
        "added_contacts"
      ]
    },
    "DrpAsset.ClientDomain": {
      "type": "object",
      "description": "A domain on the customer's Domain Watch List.",
      "required": [
        "type",
        "domain_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "client_domain"
          ]
        },
        "domain_id": {
          "type": "string",
          "description": "Identity of the watched domain."
        }
      }
    },
    "DrpAsset.CodeRepoKeyword": {
      "type": "object",
      "description": "A keyword used for code-repository matching.",
      "required": [
        "type",
        "term"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "code_repo_keyword"
          ]
        },
        "term": {
          "$ref": "#/$defs/DrpAsset.DrpTerm"
        }
      }
    },
    "DrpAsset.Company": {
      "type": "object",
      "description": "A company on the customer's Brand Names Watch List.",
      "required": [
        "type",
        "company_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "company"
          ]
        },
        "company_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.DrpAsset": {
      "description": "A protected DRP asset (a oneOf union of asset subtypes). The `type` property selects the concrete subtype.\n",
      "oneOf": [
        {
          "$ref": "#/$defs/DrpAsset.ClientDomain"
        },
        {
          "$ref": "#/$defs/DrpAsset.SimilarDomainTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.ScreenshotOcrKeyword"
        },
        {
          "$ref": "#/$defs/DrpAsset.CodeRepoKeyword"
        },
        {
          "$ref": "#/$defs/DrpAsset.Logotype"
        },
        {
          "$ref": "#/$defs/DrpAsset.ImageHash"
        },
        {
          "$ref": "#/$defs/DrpAsset.Company"
        },
        {
          "$ref": "#/$defs/DrpAsset.Organization"
        },
        {
          "$ref": "#/$defs/DrpAsset.Product"
        },
        {
          "$ref": "#/$defs/DrpAsset.Executive"
        }
      ]
    },
    "DrpAsset.DrpTerm": {
      "description": "A search term used by a DRP asset (a oneOf union of term subtypes). See text search modes (linguistic, exact, substring/pattern). The `type` property selects the subtype.\n",
      "oneOf": [
        {
          "$ref": "#/$defs/DrpAsset.SubstringTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.LanguageTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.ExactTerm"
        },
        {
          "$ref": "#/$defs/DrpAsset.FreetextTerm"
        }
      ]
    },
    "DrpAsset.ExactTerm": {
      "type": "object",
      "description": "Strict exact-text match.",
      "required": [
        "type",
        "text"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "exact"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        }
      }
    },
    "DrpAsset.Executive": {
      "type": "object",
      "description": "A protected executive identity.",
      "required": [
        "type",
        "executive_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "executive"
          ]
        },
        "executive_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.FreetextTerm": {
      "type": "object",
      "description": "Free-text match.",
      "required": [
        "type",
        "text"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "freetext"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        }
      }
    },
    "DrpAsset.ImageHash": {
      "type": "object",
      "description": "A watched image (logo) hash matched on the attacker domain.",
      "required": [
        "type",
        "hash_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "image_hash"
          ]
        },
        "hash_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.LanguageTerm": {
      "type": "object",
      "description": "Linguistic match that includes other words sharing the same word stem.",
      "required": [
        "type",
        "text",
        "language"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "language"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        },
        "language": {
          "type": "string",
          "description": "Language used for stem matching (e.g. `eng`)."
        }
      }
    },
    "DrpAsset.Logotype": {
      "type": "object",
      "description": "A watched logotype detected on the attacker domain.",
      "required": [
        "type",
        "logotype_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "logotype"
          ]
        },
        "logotype_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.Organization": {
      "type": "object",
      "description": "An organization on the customer's Brand Names Watch List.",
      "required": [
        "type",
        "organization_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "organization"
          ]
        },
        "organization_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.Product": {
      "type": "object",
      "description": "A product on the customer's Brand Names Watch List.",
      "required": [
        "type",
        "product_id"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "product"
          ]
        },
        "product_id": {
          "type": "string"
        }
      }
    },
    "DrpAsset.ScreenshotOcrKeyword": {
      "type": "object",
      "description": "A keyword matched in OCR-extracted screenshot text.",
      "required": [
        "type",
        "term"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "screenshot_ocr_keyword"
          ]
        },
        "term": {
          "$ref": "#/$defs/DrpAsset.DrpTerm"
        }
      }
    },
    "DrpAsset.SimilarDomainTerm": {
      "type": "object",
      "description": "A similar-domain search term.",
      "required": [
        "type",
        "term"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "similar_domain_term"
          ]
        },
        "term": {
          "$ref": "#/$defs/DrpAsset.DrpTerm"
        }
      }
    },
    "DrpAsset.SubstringTerm": {
      "type": "object",
      "description": "Substring/pattern match, optionally constrained to a specific entity type.",
      "required": [
        "type",
        "text",
        "position"
      ],
      "properties": {
        "type": {
          "type": "string",
          "enum": [
            "substring"
          ]
        },
        "text": {
          "type": "string",
          "description": "The term text to match."
        },
        "position": {
          "type": "string",
          "description": "Where the text must occur within the matched value.",
          "enum": [
            "prefix",
            "infix",
            "suffix"
          ]
        },
        "entity_type_id": {
          "type": "string",
          "description": "Optional entity type to match against."
        }
      }
    },
    "EntitiesChangeV2": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "removed": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/Entity"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "entities_change"
          ]
        }
      },
      "required": [
        "type",
        "removed",
        "added"
      ]
    },
    "Entity": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "type": {
          "type": "string"
        },
        "name": {
          "type": "string"
        }
      },
      "required": [
        "id",
        "type"
      ]
    },
    "ExternalIdChange": {
      "type": "object",
      "description": "This change applies to any alert type.",
      "properties": {
        "old": {
          "type": "string"
        },
        "new": {
          "type": "string"
        },
        "type": {
          "type": "string",
          "enum": [
            "external_id_change"
          ]
        }
      },
      "required": [
        "type"
      ]
    },
    "FacilityAssessment": {
      "type": "object",
      "description": "Facility assessment data",
      "properties": {
        "name": {
          "type": "string"
        },
        "criticality": {
          "$ref": "#/$defs/PlaybookAlertPriority"
        }
      }
    },
    "FacilityEvidence": {
      "type": "object",
      "properties": {
        "cluster_id": {
          "type": "string"
        },
        "main_event": {
          "$ref": "#/$defs/FacilityMainEvent"
        },
        "type": {
          "type": "string",
          "enum": [
            "cluster_change_added"
          ]
        },
        "other_event_ids": {
          "type": "array",
          "items": {
            "type": "string"
          }
        }
      }
    },
    "FacilityEvidenceChange": {
      "type": "object",
      "properties": {
        "added": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/FacilityEvidence"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "evidence_changes"
          ]
        }
      },
      "required": [
        "added",
        "type"
      ]
    },
    "FacilityMainEvent": {
      "type": "object",
      "properties": {
        "event_id": {
          "type": "string"
        },
        "assessments": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/FacilityAssessment"
          }
        },
        "type": {
          "type": "string",
          "enum": [
            "event_change_added"
          ]
        }
      }
    },
    "ImageAvailability": {
      "type": "string",
      "description": "Image availability status",
      "enum": [
        "Available",
        "NotFound",
        "NotDownloaded",
        "FlaggedForReview",
        "NotAvailableForLegalReasons",
        "ScanCompletedAsPositive"
      ]
    },
    "LogotypeInScreenshotV2": {
      "type": "object",
      "properties": {
        "logotype_id": {
          "type": "string"
        },
        "screenshot_id": {
          "type": "string"
        },
        "url": {
          "type": "string"
        },
        "screenshot_width": {
          "type": "integer",
          "description": "Width of the screenshot in pixels (when available)."
        },
        "screenshot_height": {
          "type": "integer",
          "description": "Height of the screenshot in pixels (when available)."
        },
        "region": {
          "description": "Bounding box of the detected logotype within the screenshot.",
          "type": "object",
          "properties": {
            "min_x": {
              "type": "integer"
            },
            "min_y": {
              "type": "integer"
            },
            "max_x": {
              "type": "integer"
            },
            "max_y": {
              "type": "integer"
            }
          },
          "required": [
            "min_x",
            "min_y",
            "max_x",
            "max_y"
          ]
        },
        "is_high_interest": {
          "type": "boolean",
          "description": "True if the logotype belongs to a high-interest brand list."
        }
      },
      "required": [
        "logotype_id",
        "screenshot_id",
        "url"
      ]
    },
    "MaliciousDnsRecord": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string"
        },
        "assessments": {
          "type": "array",
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "level": {
                "type": "number"
              },
              "title": {
                "type": "string"
              }
            },
            "required": [
              "id",
              "level"
            ]
          }
        }
      }
    },
    "MaliciousSitesAiTriageChange": {
      "type": "object",
      "description": "Indicates an AI triage produced a verdict for the alert, carrying the resulting assessment, the model's rationale, and the scans it analyzed.\n",
      "properties": {
        "triage_id": {
          "type": "string",
          "description": "Identifier of the triage run that produced this verdict."
        },
        "analyzed_scans": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MaliciousSitesAnalyzedScan"
          }
        },
        "assessment": {
          "$ref": "#/$defs/MaliciousSitesAssessment"
        },
        "rationale": {
          "type": "string",
          "description": "The model's free-text explanation for the verdict."
     

# --- truncated at 32 KB (94 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/recorded-future/refs/heads/main/json-schema/recorded-future-malicious-sites-response-schema.json