Detections and verdicts

An alert is one detection source saying something about what the browser saw. urlquery combines three kinds of source. Each alert names its source and gives a verdict and severity, so you can judge how much weight it deserves.

Alert sources

Source	Key	What it detects	Typical sensor_name
Network IDS	ids	Suspicious network traffic, matched by intrusion-detection signatures on the analysis traffic.	suricata
urlquery rules	urlquery	Phishing kits, scams, and malicious page behavior, from urlquery's own detection rules and signatures. These rules also add report tags.	urlquery
Analyzer	analyzer	External and file-level evidence: blocklists and protective DNS resolvers that list a URL or host, YARA signatures, antivirus scanning, and multi-engine file reputation. It also includes detections from your own YARA rules.	The source's name, for example a blocklist, or user_<id> for a private rule.

Where alerts appear

Every alert is listed in detection, grouped by source:

"detection": {
  "ids": [],
  "urlquery": [],
  "analyzer": []
}

The same alert also appears on the evidence it fired on: http[].alerts for a transaction, javascript.script[].alerts for a script, and alerts on files, archive entries, PDFs, and shortcuts. Use the top-level list to see what fired, and the per-item copy to see exactly which request or file it fired on.

stats.alert_count and the overview's alert_count give the totals per source. On each host in summary, alert_count counts the alerts on that host's transactions.

Alert fields

Field	Sources	Meaning
sensor_name	all	Which source raised the alert.
alert	all	The alert name. Search for it to find other reports with the same detection.
title, description	ids, analyzer	Human-readable detail.
verdict	urlquery, analyzer	The source's conclusion. See below.
severity	all	How serious the source considers it. See below.
comment, link	urlquery, analyzer	Analyst notes and a reference link, when the source provides them.
tags	urlquery	Tags the rule applies to the report.
trigger, sensor_type, scan_date	analyzer	What matched and when the source checked it.
ip_src, ip_dst, date	ids	The traffic the signature matched. The analysis client appears as "Client IP".

Verdicts

Verdict	Meaning
phishing	The page imitates a brand or service to collect credentials or payment details.
scam, fraud	Deceptive pages such as fake shops, investment scams, or tech-support scams.
malware	The page delivers or links to malicious software.
malicious	Harmful behavior that does not fit a narrower category, or a source that only reports "malicious".
suspicious	Indicators that warrant a closer look but are not conclusive on their own.
audit	Informational: worth knowing, not a judgment. Private YARA rules default to audit unless the rule sets a verdict.

Severities are high, medium, low, and audit. A clean answer from a blocklist can appear with severity none.

Weighing alerts

• Several independent sources agree: strong. A urlquery phishing rule plus blocklist listings for the same host is a confident finding.
• One blocklist listing on a shared or popular host: weak. Check whether the listing concerns the host you care about or something else it serves, and look at summary[].domain_rank.
• IDS alerts on third-party traffic: often caused by ads, trackers, or CDNs rather than the page itself. Check which transaction they fired on.
• No alerts: not evidence that a page is safe. Kits cloak by location, device, or referrer, and new campaigns appear before signatures do. Read the screenshot, the final page, and the traffic.
• Tags: report tags come from urlquery rules, so they summarize what fired. submit.tags are whatever the submitter typed and say nothing about the content.

Your own detection rules

Alerts from your private YARA rules carry sensor_name user_<id> and a detection_meta object identifying the rule and whether it is shared with your team. They are visible only to you, or to your team when the rule is shared with it. List the reports your rules matched with GET /public/v2/reports/recent?scope=alerted; see the workflows. See YARA rules for what your rules scan and how to set their alert text, verdict, and severity.

Searching on detections

Search on alert names and sources to find related reports:

detection.urlquery.alert:*phishing*
http.alerts.urlquery.alert:"<ALERT_NAME>"
tags:phishing

See the search syntax for all fields.

What you may not see

Alerts are filtered for your account. Alerts from other accounts' private rules are never shown, and some sources and JavaScript alert details depend on your account's permissions. Two accounts can therefore see different alert counts on the same report.