This can be done very easily via cscli using the --contained flag:
cscli decisions list -r 1.2.3.0/24 --contained
This command will display all IP addresses belonging to the specified range.
But I can't do the same using the HTTP API.
The /decisions endpoint has a contains parameter, but it doesn't seem to work. Either it does something else entirely, or it doesn't work at all.
There's nothing like that in /alerts, but I tried that too. Nothing works.