What this endpoint does

Retrieves detailed information for a single Malware Report alert, identified by its alert ID in the URL path. These alerts are triggered when new sandbox analysis results match your configured monitoring rules for specific malware behaviors, families, or risk thresholds. Use the Playbook Alerts: Search endpoint with category malware_report to discover alert IDs. The optional panels body parameter lets you request specific data sections ("status", "summary", or "log"). For retrieving multiple alerts at once, use the Playbook Alerts: Malware Report Bulk endpoint. To investigate specific samples further, use the Malware Intelligence: Get Sandbox Reports endpoint with the SHA-256 hashes from the response.

Response data

The response contains a single alert with panel-organized data: panel_evidence_summary provides the core intelligence — matched sample hashes with risk scores, sandbox scores, and malware family/technique tags; detected malware families with occurrence counts; and sandbox score distributions. The panel_status provides alert metadata and panel_log_v2 tracks the change history.