API Reference

Cortex XDR REST API

Cortex XDR API Overview
Get Started with Cortex XDR APIs
Running XQL Query APIs
Changes in this release
Changes to existing endpoints
New endpoints
API Reference
Cortex XDR REST API
Preface
Servers
Authentication methods
Audit Log
Get Audit Management Log
Get Audit Agent Report
AuthenticationSettings
Create authentication settings for IdP SSO or metadata URL
Delete authentication settings by domain
Get IdP metadata
Get authentication settings for all configured domains
Update authentication settings
Dataset Management
Add Dataset
Delete a dataset
Get all datasets
Endpoint Management
Assign Tags
Create distributions
Delete Endpoints
Get Distribution URL
Get all Endpoints
Get Policy
Get Distribution status
Get Distribution version
Get Violations
Delete agent installation packages
Get Endpoint
Remove Tags
Set an Endpoint Alias
Incident Management
Get Alerts Multi-Events v1
Retrieve PCAP Packet
Get all Incidents
Insert CEF Alerts
Insert Parsed Alerts
Get all Alerts
Get Extra Incident Data
Get Alerts Multi-Events v2
Replace Featured Active Directory Groups
Replace Featured Hosts
Replace Featured IP Addresses
Replace Featured Users
Update Alerts
Update an Incident
Lookup Datasets
Add or update data in a lookup dataset
Get data from a lookup dataset
Remove data from a lookup dataset
Response Action
Cancel Scan Endpoints
Allow List Files
Block List Files
File Retrieval Details
Get Action Status
Retrieve File
Isolate Endpoints
Get triage presets
Initiate Forensics Triage
Quarantine Files
Restore File
Scan Endpoints
Get Quarantine Status
Unisolate Endpoints
Rule Management
Insert Simple Indicators, CSV
Insert Simple Indicators, JSON
Script Execution
Get Script Code
Get Script Execution Results
Get Script Execution Result Files
Get Script Execution Status
Get Script Metadata
Get Scripts
Run Script
Run Snippet Code Script
Syslog servers
Create a syslog integration
Delete all or filtered syslog integrations
Get all or filtered syslog servers
Test syslog integration
Update a syslog integration
System Management
System Health Check
Get Tenant Info
Get Risk Score
Get Risky Hosts
Get Risky Users
Get Roles
Get User Groups
Get Users
Set a User Role
XQL Query
Get XQL Query Results
Get XQL Query Results Stream
Get XQL Query Quota
Start an XQL Query

Back to home page