What this endpoint does

Retrieves detailed vulnerability intelligence for multiple alerts in a single request (up to 250 alert IDs). Each alert corresponds to a specific CVE that matches your configured monitoring rules — such as vulnerabilities affecting your tech stack, watch list entries, or manually selected CVEs. Use the Playbook Alerts: Search endpoint with category cyber_vulnerability to discover alert IDs. The optional panels parameter lets you request only specific data sections ("status", "summary", or "log") to reduce response size. For single-alert retrieval, use the Playbook Alerts: Vulnerability Detail endpoint. To look up the full Recorded Future intelligence on a CVE, use the Vulnerability: Lookup endpoint with the entity ID from the response.

Response data

Each alert contains panel-organized data: panel_status provides the CVE entity (CVE ID, criticality rating, Recorded Future risk score, and vulnerability lifecycle stage such as Disclosure or Exploitation), affected targets (vendor/product names), and alert metadata; panel_evidence_summary contains a summary with triggered risk_rules (e.g., NIST severity with CVSS scores, links to penetration testing tools, exploit availability) and their evidence descriptions, a comprehensive affected_products list of vulnerable software names and versions, and any related insikt_notes from Recorded Future analysts; panel_log_v2 tracks the chronological history of alert changes including priority shifts and risk rule updates.