What this endpoint does

Retrieves threat indicators (IPs, domains, file hashes, URLs) from a specific threat detection profile. This is step 2 of the detection workflow: first discover profile UUIDs via Threat Detection: Query Profiles, then pass the profile id here. For detection rules (Sigma, Snort, YARA, etc.) instead of indicators, use Threat Detection: Get Profile Rules. Filter by observable type (domain, hash, ip, url) and hash algorithm. Enable risk score enrichment with include.risk.score: true.

Response data

Returns IOCs curated by your detection profile — malicious IPs, domains, file hashes, and URLs for ingestion into your SIEM or EDR. Unlike hunting job indicators (point-in-time snapshots), detection profile indicators are continuously updated. Optionally include risk scores and triggered rule details to prioritize which indicators represent the highest-confidence threats. Pagination uses opaque cursor tokens — pass nextOffset from one response as offset in your next request until nextOffset is absent. Filter by type to pull only what your tool needs, and by hash algorithm when your endpoint platform requires a specific hash format (e.g., SHA-256 only).