Restore a quarantined file on a requested endpoints. When filtering by multiple fields: - Response is concatenated using AND condition (OR is not supported). - Maximum result set size is 100. - Offset is the zero-based number of incidents from the start of the result set.
Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB
curl -X POST \
-H "Accept: application/json" \
-H "Content-Type: application/json" \
"https://api-yourfqdn/public_api/v1/endpoints/restore" \
-d '{
"request_data" : {
"incident_id" : 0,
"file_hash" : "file_hash",
"endpoint_id" : "endpoint_id"
}
}'
{
"reply": {
"action_id": "<action ID>",
"status": 1,
"endpoints_count": "673"
}
}
{"request_data":{"file_hash":"","incident_id":302}}
Endpoint ID.
Note: If you do not enter a specific endpoint ID, the request will run restore on all endpoints which relate to the quarantined file you defined.
Successful response
Bad Request. Got an invalid JSON.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}
Unauthorized access. User does not have the required license type to run this API.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}
Internal server error. A unified status for API communication type errors.
{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}