Cortex XDR Platform APIs

Cortex XDR APIs
Understand Cortex XDR licenses
Get started with Cortex XDR 4.2 APIs
Create a new API key
Get your Cortex XDR API key ID
Get your FQDN
Make your first API call
Run XQL query APIs
What's new in this release
APIs
Cortex XDR Platform APIs
Preface
Servers
API keys
Delete API keys
Generate an API key
Get existing API keys
Asset groups
Create an Asset Group
Delete an Asset Group
Get all or filtered asset groups
Update an Asset Group
Asset inventory
Get all or filtered assets
Get asset by ID
Get enum values of specified field
Get schema of asset inventory
Get raw fields of asset by ID
Attack surface management
Bulk Update Vulnerability Tests
Audit log
Get Audit Management Log
Get Audit Agent Report
Authentication settings
Create authentication settings for IdP SSO or metadata URL
Delete authentication settings by domain
Get IdP metadata
Get authentication settings for all configured domains
Update authentication settings
BIOCs
Delete BIOCs
Get BIOCs
Insert or update BIOCs
Cases
Retrieve Case Artifacts by Case Id
Retrieve cases based on filters
Get War Room entries
Add War Room entries
Update existing case
Correlation Rules
Delete Correlation Rules
Get Correlation Rules
Insert or update Correlation Rules
Cortex CLI
Get the latest version of the Cortex CLI
Dashboards
Delete dashboards
Get dashboards
Insert or update dashboards
Dataset Management
Add Dataset
Delete a dataset
Get all datasets
Endpoint Management
Assign Tags
Create distributions
Delete Endpoints
Get Distribution URL
Get all Endpoints
Get Policy
Get Distribution status
Get Distribution version
Get Violations
Delete agent installation packages
Get Endpoint
Initiate Forensics Triage
Remove Tags
Set an Endpoint Alias
IOCs
Delete Indicators (IOCs)
Get Indicators (IOCs)
Insert or update IOCs
Indicator rules
Insert Simple Indicators, CSV
Insert Simple Indicators, JSON
Issues
Create a new issue
Retrieve issues based on filters
Update existing issue
Lookup Datasets
Add or update data in a lookup dataset
Get data from a lookup dataset
Remove data from a lookup dataset
Playbooks
Delete a playbook
Get a playbook
Insert or update playbooks
Query Library
Delete XQL Queries
Get XQL Queries
Insert or update XQL queries
Response Action
Cancel Scan Endpoints
Allow List Files
Block List Files
File Retrieval Details
Get Action Status
Retrieve File
Isolate Endpoints
Get triage presets
Quarantine Files
Restore File
Scan Endpoints
Get Quarantine Status
Unisolate Endpoints
Scheduled Queries
Delete a scheduled query
Insert or update scheduled queries
Get scheduled queries
Script execution
Get Script Code
Get Script Execution Results
Get Script Execution Result Files
Get Script Execution Status
Get Script Metadata
Get Scripts
Run Script
Run Snippet Code Script
Scripts
Delete a script
Get a script
Insert or update a script
Syslog servers
Create a syslog integration
Delete all or filtered syslog integrations
Get all or filtered syslog servers
Test syslog integration
Update a syslog integration
System management
System Health Check
Get Roles
Get User Groups
Get Users
Set a User Role
Get Tenant Info
Widgets
Delete widgets
Get widgets
Insert or update widgets
XQL query
Get XQL query results
Get XQL query results Stream
Get XQL query Quota
Start an XQL query
Cloud Onboarding APIs
Preface
Servers
Authentication methods
Cloud account management
Enable or disable cloud accounts
Get accounts in the specified integration instances
Cloud integration instance management
Create a cloud onboarding integration template
Delete the specified integration instances
Edit an integration instance
Enable or disable cloud integration instances
Get integration instance details
Get all or filtered integration instances
Get identifier roles for integration instance
General
Get approved Azure tenants
Get available regions for a CSP
Outpost management
Create an outpost template
Edit an outpost
Get all or filtered outposts
ASPM, CICD and Application Security APIs
Preface
Servers
Authentication methods
Default authentication
Applications
Create an application
Delete an application
Get an application
Get an application configuration
Get applications
Update an application
Criteria
Create a Criteria
Delete a Criteria
Retrieve all criteria
Get a Criteria by Id
Integrations
Delete an AppSec integration
Get an AppSec integration
Get AppSec integrations
Update an AppSec integration
Policies
Create an AppSec policy
Create an Application Security policy.
How to access Application Security policies in the UI:
Limitations
Trigger and Action Constraints by Finding Type
General Policy Constraints
Supported Condition Fields
Supported Scope Fields
Delete an AppSec policy
List AppSec policies
Get an AppSec policy
Update an AppSec policy
Remediations
Get Fix Status
Get Fix Suggestion
Trigger Fix Pull Request
Repositories
Get a repository scan configuration
Get a repository
Get repositories
Update a repository scan configuration
Repository branches
Get AppSec repository branches
Update an AppSec repository branch
Rules
Create or clone an AppSec rule
Delete an AppSec rule
Get AppSec rule labels
Get an AppSec rule
Get AppSec rules
Modify an AppSec rule
Create an AppSec rule validation
SBOM management
Get all SBOMs for the specified organization
Get an SBOM for the specified repository
Scan management
Get AppSec CI scans
Get AppSec Pull Request scans
Get AppSec branch periodic scans
List AppSec scan findings
List AppSec scan issues
Get unscanned AppSec scan management repositories
Rerun a repository scan
Vulnerability Intelligence APIs
Preface
Servers
Authentication methods
Affected software
Get affected software
Vulnerabilities
Get vulnerability details
Get list of vulnerabilities
Vulnerability Management APIs
Preface
Servers
Vulnerability Management
Create Policy Public
Delete Policy
Get Policies List
Get Policy By ID
Update Policy
Cloud Infrastructure Entitlement Management APIs
Preface
Servers
Default
Search CIEM Access
Compliance Controls API
Preface
Servers
Authentication methods
Default authentication
Assessment profiles
Add assessment profile
Delete assessment profile
Edit assessment profile
Get assessment profile by ID
Get assessment profiles
Assessment results
Get assessment profile results
Categories
Get categories and subcategories
Compliance Assets
Get compliance assets
Controls
Add new control
Delete control
Edit existing control
Get compliance control by ID
Get control by revision
Get compliance controls
Reports
Get compliance reports
Results
Get control failed results
Get rule failed results
Rules
Add compliance rules to a compliance control
Delete rules from control
Standards
Add new standard
Delete standard
Edit existing standard
Get single standard by ID
Get compliance standards
Cloud Workload Protection APIs
Preface
Servers
Authentication methods
Policies
Delete a CWP policy by ID
Get CWP policies
Get a CWP policy by ID
Add CWP policies
Update a CWP policy by ID
SBOM
Get the SBOM of the specified asset
Data Security Posture Management APIs
Preface
Servers
Default
Get data pattern inventory
Get field inventory details
Get file inventory details

Back to home page