Get all or filtered assets

post /public_api/v1/assets

Retrieve detailed information about all assets within your environment, including enterprise, multi-cloud, code, and external surfaces.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.

Request headers

Authorization String required

{api_key}

Example: authorization_example

x-xdr-auth-id String required

{api_key_id}

Example: xXdrAuthId_example

CLIENT REQUEST

          curl -X 'POST'

        -H
        'Accept: application/json'
      
        -H
        'Content-Type: application/json'
      
          -H
          'Authorization: authorization_example'
          -H
          'x-xdr-auth-id: xXdrAuthId_example'
      
      'https://api-yourfqdn/public_api/v1/assets'
    
      -d
      ''

import http.client

conn = http.client.HTTPSConnection("api-yourfqdn")

payload = "{\"filters\":{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]},\"on_demand_fields\":[\"xdm.host.ipv4_addresses\"],\"sort\":[{\"FIELD\":\"xdm.asset.name\",\"ORDER\":\"DESC\"}],\"search_from\":0,\"search_to\":1000}"

headers = {
    'Authorization': "SOME_STRING_VALUE",
    'x-xdr-auth-id': "SOME_STRING_VALUE",
    'content-type': "application/json"
    }

conn.request("POST", "/public_api/v1/assets", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))

require 'uri'
require 'net/http'
require 'openssl'

url = URI("https://api-yourfqdn/public_api/v1/assets")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'SOME_STRING_VALUE'
request["x-xdr-auth-id"] = 'SOME_STRING_VALUE'
request["content-type"] = 'application/json'
request.body = "{\"filters\":{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]},\"on_demand_fields\":[\"xdm.host.ipv4_addresses\"],\"sort\":[{\"FIELD\":\"xdm.asset.name\",\"ORDER\":\"DESC\"}],\"search_from\":0,\"search_to\":1000}"

response = http.request(request)
puts response.read_body

const data = JSON.stringify({
  "filters": {
    "AND": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ]
  },
  "on_demand_fields": [
    "xdm.host.ipv4_addresses"
  ],
  "sort": [
    {
      "FIELD": "xdm.asset.name",
      "ORDER": "DESC"
    }
  ],
  "search_from": 0,
  "search_to": 1000
});

const xhr = new XMLHttpRequest();
xhr.withCredentials = true;

xhr.addEventListener("readystatechange", function () {
  if (this.readyState === this.DONE) {
    console.log(this.responseText);
  }
});

xhr.open("POST", "https://api-yourfqdn/public_api/v1/assets");
xhr.setRequestHeader("Authorization", "SOME_STRING_VALUE");
xhr.setRequestHeader("x-xdr-auth-id", "SOME_STRING_VALUE");
xhr.setRequestHeader("content-type", "application/json");

xhr.send(data);

HttpResponse<String> response = Unirest.post("https://api-yourfqdn/public_api/v1/assets")
  .header("Authorization", "SOME_STRING_VALUE")
  .header("x-xdr-auth-id", "SOME_STRING_VALUE")
  .header("content-type", "application/json")
  .body("{\"filters\":{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]},\"on_demand_fields\":[\"xdm.host.ipv4_addresses\"],\"sort\":[{\"FIELD\":\"xdm.asset.name\",\"ORDER\":\"DESC\"}],\"search_from\":0,\"search_to\":1000}")
  .asString();

import Foundation

let headers = [
  "Authorization": "SOME_STRING_VALUE",
  "x-xdr-auth-id": "SOME_STRING_VALUE",
  "content-type": "application/json"
]
let parameters = [
  "filters": ["AND": [
      [
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      ]
    ]],
  "on_demand_fields": ["xdm.host.ipv4_addresses"],
  "sort": [
    [
      "FIELD": "xdm.asset.name",
      "ORDER": "DESC"
    ]
  ],
  "search_from": 0,
  "search_to": 1000
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api-yourfqdn/public_api/v1/assets")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-yourfqdn/public_api/v1/assets",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => "{\"filters\":{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]},\"on_demand_fields\":[\"xdm.host.ipv4_addresses\"],\"sort\":[{\"FIELD\":\"xdm.asset.name\",\"ORDER\":\"DESC\"}],\"search_from\":0,\"search_to\":1000}",
  CURLOPT_HTTPHEADER => [
    "Authorization: SOME_STRING_VALUE",
    "content-type: application/json",
    "x-xdr-auth-id: SOME_STRING_VALUE"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

CURL *hnd = curl_easy_init();

curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST");
curl_easy_setopt(hnd, CURLOPT_URL, "https://api-yourfqdn/public_api/v1/assets");

struct curl_slist *headers = NULL;
headers = curl_slist_append(headers, "Authorization: SOME_STRING_VALUE");
headers = curl_slist_append(headers, "x-xdr-auth-id: SOME_STRING_VALUE");
headers = curl_slist_append(headers, "content-type: application/json");
curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers);

curl_easy_setopt(hnd, CURLOPT_POSTFIELDS, "{\"filters\":{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]},\"on_demand_fields\":[\"xdm.host.ipv4_addresses\"],\"sort\":[{\"FIELD\":\"xdm.asset.name\",\"ORDER\":\"DESC\"}],\"search_from\":0,\"search_to\":1000}");

CURLcode ret = curl_easy_perform(hnd);

var client = new RestClient("https://api-yourfqdn/public_api/v1/assets");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "SOME_STRING_VALUE");
request.AddHeader("x-xdr-auth-id", "SOME_STRING_VALUE");
request.AddHeader("content-type", "application/json");
request.AddParameter("application/json", "{\"filters\":{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]},\"on_demand_fields\":[\"xdm.host.ipv4_addresses\"],\"sort\":[{\"FIELD\":\"xdm.asset.name\",\"ORDER\":\"DESC\"}],\"search_from\":0,\"search_to\":1000}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

Body parameters

application/json

filtersobject

Any of

ANDarrayrequired

[

SEARCH_FIELDstring

The field you want to filter.

Example:"xdm.asset.type.class"

SEARCH_TYPEstring (Enum)

The operator to apply to the SEARCH_FIELD. It defines how the SEARCH_VALUE will be used to evaluate the SEARCH_FIELD.

Example:"NEQ"

Allowed values:"EQ""NEQ""GT""LT""GTE""LTE""IN""NIN""RLIKE""NRLIKE""WILDCARD""WILDCARD_NOT""CONTAINS""NCONTAINS""IP_MATCH""NIP_MATCH""ARRAY_CONTAINS""ARRAY_NOT_CONTAINS""IS_EMPTY""NIS_EMPTY""REGEX""REGEX_NOT""REGEX_MATCH""REGEX_NOT_MATCH""IPLIST_MATCH""NLISTIP_MATCH""INCIDR""NINCIDR""INCIDR6""NINCIDR6""RANGE""RELATIVE_TIMESTAMP""JSON_OVERLAPS""JSON_ARRAY_CONTAINED_IN""JSON_IS_NOT_EMPTY"

SEARCH_VALUEobject

The value that the SEARCH_FIELD will be compared to, based on the SEARCH_TYPE operator. Valid values include: EQ, IN, NIN, NEQ, IS, IS_NOT, LIKE_ANY, NOT_LIKE_ANY, WILDCARD, WILDCARD_NOT, REGEX, REGEX_NOT, GT, LT, GTE, LTE, RELATIVE_TIMESTAMP, RANGE, CONTAINS, JSON_SEARCH, JSON_OVERLAPS, JSON_OVERLAPS_NOT, NCONTAINS, CONTAINS_IN_LIST, NOT_CONTAINS_IN_LIST, ARRAY_LEN_EQ, ARRAY_LEN_NEQ, ARRAY_CONTAINS, ARRAY_CONTAINS_NUMBERS, ARRAY_NOT_CONTAINS, JSON_EQ, JSON_NEQ, JSON_WILDCARD_NOT, JSON_WILDCARD, JSON_GTE, JSON_LTE, JSON_GT, JSON_LT, JSON_CONTAINS_NOT, JSON_CONTAINS, JSON_ARRAY_CONTAINED_IN, JSON_ARRAY_NOT_CONTAINED_IN, JSON_ARRAY_CONTAINS, JSON_ARRAY_CONTAINS_NOT, JSON_IS_EMPTY, JSON_IS_NOT_EMPTY`

Example:"Other"

One of

string

Example:"Other"

boolean

Example:"Other"

integer

Example:"Other"

]

ORarrayrequired

[

SEARCH_FIELDstring

The field you want to filter.

Example:"xdm.asset.type.class"

SEARCH_TYPEstring (Enum)

The operator to apply to the SEARCH_FIELD. It defines how the SEARCH_VALUE will be used to evaluate the SEARCH_FIELD.

Example:"NEQ"

SEARCH_VALUEobject

Example:"Other"

One of

string

Example:"Other"

boolean

Example:"Other"

integer

Example:"Other"

]

on_demand_fieldsarray[string]

sortarray

[

FIELDstring

The field according to which you want the results to be sorted.

Example:"xdm.asset.name"

ORDERstring (Enum)

Sort order. Valid values include:

ASC (ascending order)
DESC (descending order)

Example:"DESC"

Allowed values:"DESC""ASC"

]

search_frominteger

An integer representing the starting offset within the query result set from which you want assets returned.

search_tointeger

An integer representing the end offset within the result set after which you do not want assets returned.
Assets in the asset inventory that are indexed higher than this value are not returned in the final results set.

Example:1000

REQUEST

{
  "filters": {
    "AND": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ],
    "OR": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ]
  },
  "on_demand_fields": [
    "xdm.host.ipv4_addresses"
  ],
  "sort": [
    {
      "FIELD": "xdm.asset.name",
      "ORDER": "DESC"
    }
  ],
  "search_from": 0,
  "search_to": 1000
}

{
  "filters": {
    "AND": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ],
    "OR": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ]
  },
  "on_demand_fields": [
    "xdm.host.ipv4_addresses"
  ],
  "sort": [
    {
      "FIELD": "xdm.asset.name",
      "ORDER": "DESC"
    }
  ],
  "search_from": 0,
  "search_to": 1000
}

{
  "filters": {
    "AND": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ],
    "OR": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ]
  },
  "on_demand_fields": [
    "xdm.host.ipv4_addresses"
  ],
  "sort": [
    {
      "FIELD": "xdm.asset.name",
      "ORDER": "DESC"
    }
  ],
  "search_from": 0,
  "search_to": 1000
}

{
  "filters": {
    "AND": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ],
    "OR": [
      {
        "SEARCH_FIELD": "xdm.asset.type.class",
        "SEARCH_TYPE": "NEQ",
        "SEARCH_VALUE": "Other"
      }
    ]
  },
  "on_demand_fields": [
    "xdm.host.ipv4_addresses"
  ],
  "sort": [
    {
      "FIELD": "xdm.asset.name",
      "ORDER": "DESC"
    }
  ],
  "search_from": 0,
  "search_to": 1000
}

Responses

Body

application/json

replyobject

dataarray

[

issues_breakdownobject

criticalinteger

Number of critical issues

highinteger

Number of high issues

lowinteger

Number of low issues

mediuminteger

Number of medium issues

xdm.asset.first_observedinteger

Timestamp of when the asset was first observed

xdm.asset.cloud.regionstring

Region of the cloud asset

xdm.asset.last_observedinteger

Timestamp of when the asset was last observed

issues_criticalinteger

xdm.asset.strong_idstring

xdm.asset.type.categorystring

A more detailed grouping within a class. It categorizes assets based on their normalized function or common type, regardless of the provider or implementation.

xdm.asset.namestring

Asset name

xdm.asset.type.namestring

Represents the provider-specific name for a particular asset within a category.

cases_breakdownobject

criticalinteger

Number of critical cases

highinteger

Number of high cases

lowinteger

Number of low cases

mediuminteger

Number of medium cases

xdm.asset.providerstring

xdm.asset.type.classstring

The highest-level grouping of assets based on their general purpose or domain. It is a broad classification that defines the overall function of the assets

xdm.asset.idstring

Asset ID

xdm.asset.type.idstring

Asset type ID

cases_criticalinteger

xdm.asset.group_idsarray[string]

List of asset group IDs

xdm.asset.realmstring

xdm.host.ipv4_addressesarray[string]

]

metadataobject

filter_countinteger

Number of assets returned

total_countinteger

Number of total results of this filter without paging

RESPONSEExample 1
{
  "reply": {
    "data": [
      {
        "issues_breakdown": {
          "critical": 0,
          "high": 0,
          "low": 0,
          "medium": 0
        },
        "xdm.asset.first_observed": 1747834085000,
        "xdm.asset.cloud.region": null,
        "xdm.asset.last_observed": 1748399709000,
        "issues_critical": 0,
        "xdm.asset.strong_id": "172.16.33.51",
        "xdm.asset.type.category": "Device",
        "xdm.asset.name": null,
        "xdm.asset.type.name": "Generic Device",
        "cases_breakdown": {
          "critical": 0,
          "high": 0,
          "low": 0,
          "medium": 0
        },
        "xdm.asset.provider": "ON_PREM",
        "xdm.asset.type.class": "Compute",
        "xdm.asset.id": "fffd007cff1c15f3a0d152ae630df9630ce00e39bc66811a9fa9b6457a788afc",
        "xdm.asset.type.id": "GENERIC_DEVICE",
        "cases_critical": 0,
        "xdm.asset.group_ids": [],
        "xdm.asset.realm": "Other",
        "xdm.host.ipv4_addresses": [
          "172.16.33.51"
        ]
      }
    ],
    "metadata": {
      "filter_count": 1,
      "total_count": 915
    }
  }
}

Unauthorized

Body

application/json

[

err_codeinteger

Example:403

err_msgstring

Example:"Forbidden. Access was denied to this resource."

err_extrastring

]

RESPONSE
[
  {
    "err_code": 403,
    "err_msg": "Forbidden. Access was denied to this resource.",
    "err_extra": "example"
  }
]

Internal Server Error, Invalid Input

Body

application/json

[

err_codeinteger

Example:500

err_msgstring

Example:"An unexpected behavior occurred by Cortex Pubic API"

err_extrastring

]

RESPONSE
[
  {
    "err_code": 500,
    "err_msg": "An unexpected behavior occurred by Cortex Pubic API",
    "err_extra": "example"
  }
]