What this endpoint does

Retrieves the block list of confirmed-malicious indicators (IPs, domains, hashes, URLs) from a threat prevention profile — the primary output of prevention profiles, intended for firewalls, web proxies, and endpoint tools. First discover profile UUIDs via Threat Prevention: Query Profiles, then pass the profile id here. For supplementary detection rules, use Threat Prevention: Get Profile Rules. Filter by observable type and hash algorithm. Enable risk enrichment with include.risk.score: true.

Response data

Returns the actual IOCs for your block lists — malicious IPs, domains, file hashes, and URLs that your firewalls and proxies should block. Each indicator is ready for direct ingestion into security infrastructure. Optionally include risk scores and triggered rule details to prioritize which indicators to act on first. Pagination uses opaque cursor tokens — pass the nextOffset value from one response as the offset in your next request to get the next page. When nextOffset is absent, you've retrieved all indicators. Filter by type to pull only what your specific tool needs (e.g., only ip and domain for firewall rules, only hash for endpoint tools).