What this endpoint does

Retrieves intelligence hits across one or more alerts in a single request. Each hit represents a piece of intelligence — such as a threat report, malware analysis, or security event — that matched an alert rule's criteria. Unlike the Alerts: Get by ID endpoint which returns one alert at a time with full metadata, this endpoint efficiently aggregates just the hit-level data from multiple alerts, making it suited for bulk processing of intelligence matches. Pass one or more alert IDs (obtained from the Alerts: Search endpoint) as a comma-separated list.

Response data

Returns a flat array where each hit includes the source document's title and URL, a text fragment summarizing the intelligence match, and an array of referenced entities such as threat actors, malware families, domains, file hashes, and MITRE ATT&CK technique identifiers. Each hit is tagged with its parent alert_id and a numeric index so results can be traced back to specific alerts. Responses can be large when alerts contain many matches — a single alert may have hundreds of hits.