Profiles

Cortex XDR REST API

Cortex XDR API Overview
Get Started with Cortex XDR APIs
Running XQL Query APIs
API Reference
Cortex XDR REST API
Preface
Servers
Authentication methods
Audit Log
Get Audit Management Log
Get Audit Agent Report
AuthenticationSettings
Create authentication settings for IdP SSO or metadata URL
Update authentication settings
Delete authentication settings by domain
Get authentication settings for all configured domains
Get IdP metadata
Dataset Management
Add Dataset
Delete a dataset
Get all datasets
Endpoint Management
Get all Endpoints
Get Endpoint
Set an Endpoint Alias
Get Policy
Delete Endpoints
Get endpoint security profiles
Get Legacy Exceptions Modules
Fetch Legacy Exception Rules
Add Legacy Exception Rule
Edit Legacy Exception Rule
Delete Legacy Exception Rules
Get Disable Injection and Prevention rules
Add Disable Injection and Prevention rule
Disable Disable Injection and Prevention Rules
Get Disable Prevention Rules
Get Disable Prevention Modules
Add Disable Prevention Rule
Edit Disable Prevention Rule
Delete Disable Prevention Rules
Get Distribution version
Create distributions
Get Distribution status
Get Distribution URL
Get Distributions
Delete agent installation packages
Get Violations
Assign Tags
Remove Tags
Add Prevention Profile
Add Signer CN to Allowlist
Edit Prevention Profile
Get Prevention Profile Modules
Delete Tags Permanently
Incident Management
Get all Incidents
Get all Alerts
Update an Incident
Update Alerts
Insert CEF Alerts
Insert Parsed Alerts
Retrieve PCAP Packet
Get Alerts Multi-Events v2
Get Alerts Multi-Events v1
Replace Featured Hosts
Replace Featured Users
Replace Featured IP Addresses
Replace Featured Active Directory Groups
Get Extra Incident Data
Lookup Datasets
Add or update data in a lookup dataset
Remove data from a lookup dataset
Get data from a lookup dataset
Profiles
Get endpoint security profiles
Response Action
Restore File
File Retrieval Details
Allow List Files
Get Quarantine Status
Quarantine Files
Block List Files
Unisolate Endpoints
Cancel Scan Endpoints
Scan Endpoints
Get Action Status
Retrieve File
Isolate Endpoints
Initiate Forensics Triage
Get triage presets
Rule Management
Insert Simple Indicators, CSV
Insert Simple Indicators, JSON
Script Execution
Run Snippet Code Script
Run Script
Get Script Metadata
Get Scripts
Get Script Execution Status
Get Script Execution Results
Get Script Execution Result Files
Get Script Code
Syslog servers
Create a syslog integration
Get all or filtered syslog servers
Update a syslog integration
Delete all or filtered syslog integrations
Test syslog integration
System Management
System Health Check
Get Tenant Info
Get Users
Get Roles
Get User Groups
Set a User Role
Get Risk Score
Get Risky Users
Get Risky Hosts
XQL Query
Start an XQL Query
Get XQL Query Results
Get XQL Query Quota
Get XQL Query Results Stream

Back to home page