Retrieve File

Cortex XDR REST API

post /public_api/v1/endpoints/file_retrieval

Retrieve files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. - Response is concatenated using AND condition (OR is not supported). - Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Body parameters
request_dataObjectrequired

A dictionary containing the API request fields.

filtersArray

An array of filter fields.

fieldString (Enum)

Identifies the field the filter must match: - endpoint_id_list

Allowed values:"endpoint_id_list"
operatorString (Enum)

Identifies the comparison operator you want to use for this filter. Valid keywords and values are: in - 'endpoint_id_list'

Allowed values:"in"
valueArray[string]

Value that this filter must match. Valid keywords: - 'endpoint_id_list': List of strings.

filesObject

One of the operating system types must be included.

windowsArray[string]
linuxArray[string]
macosArray[string]
incident_idString

Incident ID. When included in the request, the Retrieve File action will appear in the Cortex XDR Incident View Timeline tab.

CURL
curl -X 'POST'
-H 'Accept: application/json'
-H 'Content-Type: application/json'
'https://api-yourfqdn/public_api/v1/endpoints/file_retrieval'
-d ''
Responses

OK

Body
replyObject

JSON object containing the query result.

action_idString

ID of action to retrieve files from selected endpoints. Response only indicates the request was successfully sent to the endpoint. To track if the file was retrieved successfully either: in the Cortex XDR console, navigate to Response > Action Center > Isolation and search for the action ID. Make sure the Action ID field is selected in the table Layout settings by selecting the three vertical dots. To view the file, send a File Retrieval Details request.

statusString
endpoints_countString

Number of endpoints included in the request.

RESPONSE
{ "Example 1": { "reply": { "action_id": "<action ID>", "status": "1", "endpoints_count": "673" } } }

Bad Request. Got an invalid JSON.

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

Unauthorized access. User does not have the required license type to run this API.

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

Internal server error. A unified status for API communication type errors.