Remove one or more tags from one or more endpoints.
Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint
request_dataObject
A dictionary containing the following API request fields.
filtersArray
Array of filter fields.
fieldString (Enum)
String that identifies the field the filter is matching. Filters are based on the following keywords:
- endpoint_id_list
: List of endpoint IDs.
- endpoint_status
: Status of the endpoint ID.
- dist_name
: Distribution / Installation Package name.
- ip_list
: List of IP addresses.
- group_name
: Group name the agent belongs to.
- platform
: Platform name.
- alias
: Alias name.
- isolate
: If the endpoint was isolated.
- hostname
: Hostname
operatorObject (Enum)
String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:
in
- endpoint_id_list
, dist_name
, group_name
, alias
, hostname
, username
: List of strings.
- endpoint_status
: Permitted values are connected
or disconnected
.
- ip_list
: List of strings, for example 192.168.5.12.
- platform
: Permitted values are windows
, linux
, macos
, or android
.
- isolate
: Permitted values are isolated
or unisolated
.
- scan_status
: Permitted values are none
, pending
, in_progress
, canceled
, aborted
, pending_cancellation
, success
, or error
.
gte
/ lte
- first_seen
and last_seen
: Integer in timestamp epoch milliseconds.
valueArray string integer
Value that this filter must match. The contents of this field will differ depending on the endpoint field that you specified for this filter:
- endpoint_id_list
, distribution_name
, hostname
, alias
, group_name
: List of strings.
- endpoint_status
: Must contain only the following valid values: connected
or disconnected
- ip_list
: String list of IP addresses.
- platform
: Must contain only the following valid values: windows
, linux
, macos
, or android
.
- isolate
: Must contain only the following valid values: isolated
or unisolated
.
tagString
The tag you want to remove.
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<distribution_id>"
]
}
],
"tag": "<tag_name>"
}
}
curl -X 'POST'
-H
'Accept: application/json'
-H
'Content-Type: application/json'
'https://api-yourfqdn/public_api/v1/tags/agents/remove'
-d
''