What this endpoint does

Discovers threat prevention profiles available to your organization. Prevention profiles define block lists of confirmed-malicious indicators for security infrastructure (firewalls, proxies, endpoint tools) — distinct from detection profiles, which focus on SIEM/EDR rules. After finding profile UUIDs here, fetch block list indicators via Threat Prevention: Get Profile Indicators or supplementary rules via Threat Prevention: Get Profile Rules. Supply either ids (array of UUIDs, max 100) or enterprise (e.g., uhash:XXXXXXXXXX) — at least one required. Empty body or empty ids returns 400.

Response data

Returns the prevention profiles your organization has configured — each one represents a curated block list strategy targeting specific threat categories for your security infrastructure. Use profile UUIDs from this response as input to the indicators and rules endpoints to pull the actual IOCs and detection rules for ingestion into firewalls, proxies, or endpoint tools. If the response is empty, your organization may not have prevention profiles configured yet (check with your RF administrator), or the enterprise/ID filter doesn't match any profiles. Prevention profiles are simpler than hunting profiles — they don't carry scheduling or lookback configuration since they represent continuously-updated block lists rather than periodic scans.