Intelligence documents gathered after the 1976 Kingsmill massacre named at least 13 suspects in the atrocity, an inquest has heard.
One of those named was described by police as a "well-armed, known killer".
Details of the security documents were made public for the first time at the inquest into the IRA murder of 10 Protestant workmen.
Families of the murdered men gathered at Belfast Coroner's Court on Monday for the resumption of the inquest after almost a year.
It emerged that within days of the murders, the police were able to access descriptions and photographs of several of the suspects.
A PSNI crime operations branch witness, known only as J2, gave evidence to the hearing from behind a screen. He was there to assist the coroner with police-sensitive intelligence.
The documents detailed four of the main suspects behind the murders as being members of the Provisional IRA.
Two of the four were understood to be on the run, having escaped from custody.
A later intelligence document from January 1976 reported on an IRA plan to murder RUC officers and named two of the four men as having already carried out the Kingsmill murders earlier that month.
It stated the two men had crossed into Monaghan after the murders, later recrossing the border into the Crossmaglen and Cullyhanna areas of south Armagh.
The document said the two suspects were "well-armed".
Although the court heard a considerable amount of planning would have gone into the murders, the intelligence documents did not show any evidence of prior knowledge of the attack.
"Eleven firearms were known to have been used. It seems a considerable number of individuals must have been involved in carrying out the shootings," a lawyer for the Coroner's office said.
"Would you say that this must have involved a considerable degree of planning?" he asked J2.
The witness replied: "There would need to be a level of planning ... How long it would take them to get the logistics in place to carry out this attack I can't answer."
Referring to the intelligence documents, he added: "There (was) intelligence in the (police) system as to republican activities but no specifics to this incident."
According to the documents, a report was received a month after the murders that, prior to the massacre, a number of IRA men in South Armagh had discussed targets to attack in the area.
J2 said that would be an indication of planning in the Kingsmill murders.
The documents also showed conflicting evidence as to who was responsible for the attack.
There were intelligence reports the Provisional IRA was responsible while other reports claimed a splinter group called the South Armagh Republican Action Force had carried out the attack.
The hearing was told that cover names were sometimes used for the IRA.
The 10 workmen were shot dead on January 5, 1976 after the gunmen stopped their van and asked which among them was a Catholic, and instructed that man to leave the scene.
No-one has ever been held to account for the murders but in recent years the Historical Enquiries Team identified the killers as the Provisional IRA.
The inquest was halted in June 2016 after just a month, and after hearing evidence and statements from 53 witnesses.
The adjournment came after the PSNI arrested a man in connection with the murders.
That followed the discovery that a left palm print was recovered from a window of a vehicle used by the attackers. It is understood the print matched the man arrested in the Newry area.
Earlier this year, the Public Prosecution Service decided not to prosecute the man, saying the test for prosecution had not been met.