What this endpoint does

Retrieves detailed information for a single Vulnerability alert, identified by its alert ID in the URL path. Each alert corresponds to a specific CVE that matches your configured monitoring rules — such as vulnerabilities affecting your tech stack, watch list entries, or manually selected CVEs. Use the Playbook Alerts: Search endpoint with category cyber_vulnerability to discover alert IDs. The optional panels body parameter lets you request specific data sections ("status", "summary", or "log") to reduce response size. For retrieving multiple alerts at once, use the Playbook Alerts: Vulnerability Bulk endpoint. To look up the full Recorded Future intelligence on a CVE, use the Vulnerability: Lookup endpoint with the entity ID from the response.

Response data

The response contains a single alert with panel-organized data: panel_status provides the CVE entity (CVE ID, criticality rating, Recorded Future risk score, and vulnerability lifecycle stage such as Disclosure or Exploitation), affected targets (vendor/product names), and alert metadata; panel_evidence_summary contains a summary with triggered risk_rules (e.g., NIST severity with CVSS scores, exploit availability, links to penetration testing tools) and their evidence descriptions, a comprehensive affected_products list of vulnerable software names and versions, and any related insikt_notes from Recorded Future analysts; panel_log_v2 tracks the chronological history of alert changes.