Cloud account management

Cortex XSIAM Platform APIs

Cortex XSIAM APIs
Understand Cortex XSIAM licenses
Get started with Cortex XSIAM 3.3 APIs
Create a new API key
Get your Cortex XSIAM API key ID
Get your FQDN
Make your first API call
Run XQL query APIs
Whats-new-in-this-release
APIs
Cortex XSIAM Platform APIs
Preface
Servers
Authentication methods
Cortex CLI
Get the latest version of the Cortex CLI
XQL query
Start an XQL query
Get XQL query results
Get XQL query Quota
Get XQL query results Stream
Endpoint Management
Get Distribution version
Get all Endpoints
Get Policy
Delete Endpoints
Create distributions
Get Violations
Get Distribution status
Get Distribution URL
Set an Endpoint Alias
Assign Tags
Remove Tags
Get Endpoint
Initiate Forensics Triage
Delete agent installation packages
Response Action
Restore File
File Retrieval Details
Allow List Files
Get Quarantine Status
Quarantine Files
Block List Files
Unisolate Endpoints
Cancel Scan Endpoints
Scan Endpoints
Get Action Status
Retrieve File
Isolate Endpoints
Get triage presets
Script execution
Run Snippet Code Script
Run Script
Get Script Metadata
Get Script Execution Status
Get Scripts
Get Script Execution Results
Get Script Execution Result Files
Get Script Code
Indicator rules
Insert Simple Indicators, CSV
Insert Simple Indicators, JSON
Audit log
Get Audit Management Log
Get Audit Agent Report
System management
System Health Check
Get Tenant Info
Get Users
Get Roles
Get User Groups
Set a User Role
Get Risk Score
Get Risky Users
Get Risky Hosts
Attack surface management
Get External Service
Get All Services
Get all Internet Exposures
Get Internet Exposure
Get all External IP Address Ranges
Get External IP Address Range
Get vulnerability tests
Bulk Update Vulnerability Tests
Upload assets to the inventory
Get Website Details
Get all Websites
Get Websites Last Assessment
Get all Attack Surface Rules
Remove Assets
XQL user datasets
Define an XQL user dataset
Get created XQL user datasets
Delete an XQL user dataset
Dataset Management
Add Dataset
Delete a dataset
Get all datasets
Lookup Datasets
Add or update data in a lookup dataset
Remove data from a lookup dataset
Get data from a lookup dataset
Authentication settings
Create authentication settings for IdP SSO or metadata URL
Update authentication settings
Delete authentication settings by domain
Get authentication settings for all configured domains
Get IdP metadata
Syslog servers
Create a syslog integration
Get all or filtered syslog servers
Update a syslog integration
Delete all or filtered syslog integrations
Test syslog integration
Scheduled Queries
Get scheduled queries
Insert or update scheduled queries
Delete a scheduled query
Query Library
Get XQL Queries
Insert or update XQL queries
Delete XQL Queries
IOCs
Get Indicators (IOCs)
Insert or update IOCs
Delete Indicators (IOCs)
BIOCs
Get BIOCs
Insert or update BIOCs
Delete BIOCs
Correlation Rules
Get Correlation Rules
Insert or update Correlation Rules
Delete Correlation Rules
Playbooks
Get a playbook
Insert or update playbooks
Delete a playbook
Scripts
Get a script
Insert or update a script
Delete a script
Dashboards
Get dashboards
Insert or update dashboards
Delete dashboards
Widgets
Get widgets
Insert or update widgets
Delete widgets
Issues
Create a new issue
Retrieve issues based on filters
Update existing issue
Cases
Retrieve Cases based on filters
Update existing case
Retrieve Case Artifacts by Case ID
Get War Room entries
Add War Room entries
Asset inventory
Get all or filtered assets
Get asset by ID
Get raw fields of asset by ID
Get schema of asset inventory
Get enum values of specified field
Asset groups
Get all or filtered asset groups
Create an Asset Group
Update an Asset Group
Delete an Asset Group
API keys
Get existing API keys
Generate an API key
Delete API keys
Cortex Platform IAM APIs
Preface
Servers
Authentication methods
Roles
List all roles
Create a new role
Delete an existing role
List all permission configs
User Groups
List all user groups
Create a new user group
Edit an existing user group
Delete an existing user group
Scopes
Retrieve an existing scope
Edit an existing scope
User
List all users
Get user
Edit an existing user
API Keys
Get API Key
Edit an API key
Cloud Onboarding APIs
Preface
Servers
Authentication methods
Cloud integration instance management
Create a cloud onboarding integration template
Get integration instance details
Get all or filtered integration instances
Edit an integration instance
Enable or disable cloud integration instances
Delete the specified integration instances
Get identifier roles for integration instance
Cloud account management
Get accounts in the specified integration instances
Enable or disable cloud accounts
Outpost management
Create an outpost template
Edit an outpost
Get all or filtered outposts
General
Get available regions for a CSP
Get approved Azure tenants
ASPM, CICD and Application Security APIs
Preface
Servers
Authentication methods
Default authentication
Applications
Get an application configuration
Create an application
Get applications
Get an application
Update an application
Delete an application
Policies
Create an AppSec policy
Create an Application Security policy.
How to access Application Security policies in the UI:
Limitations
Trigger and Action Constraints by Finding Type
General Policy Constraints
List AppSec policies
List all or filtered Application Security policies.
How to access Application Security policies in the UI:
Get an AppSec policy
Get the details of the Application Security policy specified by its policy ID.
How to access Application Security policies in the UI:
Delete an AppSec policy
Delete an Application Security policy by specifying its policy ID.
How to access Application Security policies in the UI:
Update an AppSec policy
Update the details of the Application Security policy specified by its policy ID.
How to access Application Security policies in the UI:
Supported Condition Fields
Supported Scope Fields
Supported Condition Fields
Supported Scope Fields
Rules
Get AppSec rules
Create or clone an AppSec rule
Get an AppSec rule
Modify an AppSec rule
Delete an AppSec rule
Get AppSec rule labels
Create an AppSec rule validation
Repositories
Get repositories
Get a repository
Get a repository scan configuration
Update a repository scan configuration
Get AppSec repository branches
Update an AppSec repository branch
Data Sources
Get AppSec Data Source
Get an AppSec Data Source
Update an AppSec Data Source
Delete an AppSec Data Source
Scan management
Get unscanned AppSec scan management repositories
Get AppSec branch periodic scans
Get AppSec Pull Request scans
Get AppSec CI scans
List AppSec scan issues
List AppSec scan findings
Rerun a repository scan
SBOM management
Get an SBOM for the specified repository
Get all SBOMs for the specified organization
Criteria
Get all criteria
Get a Criteria by ID
Delete a Criteria
Create a Criteria
Remediations
Get Fix Suggestion
Trigger Fix Pull Request
Get Fix Status
Vulnerability Intelligence APIs
Preface
Servers
Authentication methods
Vulnerabilities
Get list of vulnerabilities
Get vulnerability details
Affected software
Get affected software
Vulnerability Management APIs
Preface
Servers
Vulnerability Management
Get Policies List
Create Policy Public
Update Policy
Get Policy By ID
Delete Policy
Cloud Infrastructure Entitlement Management APIs
Preface
Servers
Default
Search CIEM Access
Compliance Controls API
Preface
Servers
Authentication methods
Default authentication
Assessment profiles
Get assessment profiles
Get assessment profile by ID
Add assessment profile
Edit assessment profile
Delete assessment profile
Assessment results
Get assessment profile results
Controls
Get compliance controls
Get compliance control by ID
Add new control
Edit existing control
Delete control
Get control by revision
Rules
Add compliance rules to a compliance control
Delete rules from control
Categories
Get categories and subcategories
Results
Get control failed results
Get rule failed results
Reports
Get compliance reports
Standards
Get compliance standards
Get single standard by ID
Add new standard
Edit existing standard
Delete standard
Compliance Assets
Get compliance assets
Cloud Workload Protection APIs
Preface
Servers
Authentication methods
SBOM
Get the SBOM of the specified asset
Policies
Get CWP policies
Add CWP policies
Get a CWP policy by ID
Delete a CWP policy by ID
Update a CWP policy by ID
Data Security Posture Management APIs
Preface
Servers
Default
Get data pattern inventory
Get field inventory details
Get file inventory details
Trusted Images APIs
Preface
Servers
Rules Management Service
Delete Policies
Get Policies
Add Policies
Update Policies
Disable Policies
Enable Policies
Get a Policy by ID
Add (custom) Compliance rules
Delete (custom) CWP Rules
Get rules by IDs
Get the Compliance Rules
Get a rule by ID
rego script linter
Update (custom) Compliance rules
Get Policies
Add Policies
Update Policies
Get a Policy by ID
Get Policies.
Add Policy.
Delete a Policy by ID
Get a Policy by ID.
Update a Policy by ID.

APIs for managing cloud accounts per instance

Back to home page