XQL query

Cortex XSIAM Platform APIs

Cortex XSIAM APIs
Understand Cortex XSIAM licenses
Get started with Cortex XSIAM 3.x APIs
Create a new API key
Get your Cortex XSIAM API key ID
Get your FQDN
Make your first API call
Run XQL query APIs
API Release Notes for Cortex XSIAM
Cortex XSIAM 3.5
Cortex XSIAM 3.4
Supported fields for issue exception filters
Example
Core issue fields
Target (XDM)
Source (XDM)
Identity (XDM)
Email (XDM)
Certificate (XDM)
Certificate template (XDM)
File (XDM)
Cloud (XDM)
Code (XDM)
HTTP (XDM)
Vulnerability (XDM)
Active Directory (XDM)
Kubernetes (XDM)
Observer (XDM)
Secret (XDM)
Disk (XDM)
DNS (XDM)
TLS (XDM)
Malware (XDM)
Software package (XDM)
Application (XDM)
Application protocol (XDM)
Repository (XDM)
Organizational unit (XDM)
Security control (XDM)
Event (XDM)
Cloud security policy (XDM)
Application security (XDM)
Data (XDM)
Domain (XDM)
OWASP (XDM)
Authentication methods (XDM)
Backlog status (XDM)
Finding sources (XDM)
Remediation owners (XDM)
URL (XDM)
Resolution SLA (XDM)
Resolution timer (XDM)
APIs
Cortex XSIAM Platform APIs
Preface
Servers
Authentication methods
API Keys
Get existing API Keys
Generate an API Key
Delete API Keys
Asset groups
Get all or filtered asset groups
Create an Asset Group
Update an Asset Group
Delete an Asset Group
Asset inventory
Get all or filtered assets
Get asset by ID
Get raw fields of asset by ID
Get schema of asset inventory
Get enum values of specified field
Attack surface management
Get External Service
Get All Services
Get all Internet Exposures
Get Internet Exposure
Get all External IP Address Ranges
Get External IP Address Range
Get vulnerability tests
Bulk Update Vulnerability Tests
Upload assets to the inventory
Get Website Details
Get all Websites
Get Websites Last Assessment
Get all Attack Surface Rules
Remove Assets
Audit log
Get Audit Management Log
Get Audit Agent Report
Authentication settings
Create authentication settings for IdP SSO or metadata URL
Update authentication settings
Delete authentication settings by domain
Get authentication settings for all configured domains
Get IdP metadata
BIOCs
Get BIOCs
Insert or update BIOCs
Delete BIOCs
Correlation Rules
Get Correlation Rules
Insert or update Correlation Rules
Delete Correlation Rules
Cortex CLI
Get the latest version of the Cortex CLI.
Dashboards
Get dashboards
Insert or update dashboards
Delete dashboards
Dataset Management
Add Dataset
Delete a dataset
Get all datasets
Endpoint Management
Get Distribution version
Get all Endpoints
Get Policy
Delete Endpoints
Create distributions
Get Distributions
Get Violations
Get Distribution status
Get Distribution URL
Set an Endpoint Alias
Assign Tags
Remove Tags
Get Endpoint
Initiate Forensics Triage
Delete agent installation packages
Delete Tags Permanently
Upgrade Agents
Get endpoint security profiles
Get Legacy Exceptions Modules
Fetch Legacy Exception Rules
Add Legacy Exception Rule
Edit Legacy Exception Rule
Delete Legacy Exception Rules
Add Prevention Profile
Add Signer CN to Allowlist
Edit Prevention Profile
Get Prevention Profile Modules
Edit prevention policy rules
IOCs
Get Indicators (IOCs)
Insert or update IOCs
Delete Indicators (IOCs)
Indicator rules
Insert Simple Indicators, CSV
Insert Simple Indicators, JSON
Lookup Datasets
Add or update data in a lookup dataset
Remove data from a lookup dataset
Get data from a lookup dataset
Playbooks
Get a playbook
Insert or update playbooks
Delete a playbook
Profiles
Get endpoint security profiles
Query Library
Get XQL Queries
Insert or update XQL queries
Delete XQL Queries
Response Action
Restore File
File Retrieval Details
Allow List Files
Get Quarantine Status
Quarantine Files
Block List Files
Unisolate Endpoints
Cancel Scan Endpoints
Scan Endpoints
Get Action Status
Retrieve File
Isolate Endpoints
Get triage presets
Scheduled Queries
Get scheduled queries
Insert or update scheduled queries
Delete a scheduled query
Script execution
Run Snippet Code Script
Run Script
Get Script Metadata
Get Script Execution Status
Get Scripts
Get Script Execution Results
Get Script Execution Result Files
Get Script Code
Scripts
Get a script
Insert or update a script
Delete a script
Syslog servers
Create a syslog integration
Get all or filtered syslog servers
Update a syslog integration
Delete all or filtered syslog integrations
Test syslog integration
System management
System Health Check
Get Tenant Info
Get Users
Get Roles
Get User Groups
Set a User Role
Get Risk Score
Get Risky Users
Get Risky Hosts
Widgets
Get widgets
Insert or update widgets
Delete widgets
XQL query
Start an XQL query
Get XQL query results
Get XQL query Quota
Get XQL query results Stream
XQL user datasets
Define an XQL user dataset
Get created XQL user datasets
Delete an XQL user dataset
Issues API
Preface
Servers
Issues
Create a new issue
Retrieve issues based on filters
Supported Filter Fields & Values
Update existing issue
Retrieve issue schema
Create a new issue exception
Disable an issue exception
Retrieve issue exceptions based on filters
Cases API
Preface
Servers
Cases
Retrieve cases based on filters
Supported Filter Fields & Operators
Update existing case
Update Fields
Retrieve case artifacts
Get cases schema
Get War Room entries
Add War Room entries
Agent Configuration Settings API
Preface
Servers
Authentication methods
Default authentication
Agent Configurations
Retrieve content management settings
Update content management settings
Retrieve agent status configurations
Update the Agent license revocation and deletion period.
Retrieve agent auto-upgrade settings
Update agent auto-upgrade settings
Retrieve WildFire analysis settings
Update WildFire analysis settings
Retrieve informative BTP issues settings
Update informative BTP issues settings
Retrieve log collection settings
Update log collection settings
Retrieve action center expiration settings
Update action center expiration settings
Retrieve critical environment versions settings
Update critical environment versions settings
Retrieve advanced analysis settings
Update advanced analysis settings
Retrieve endpoint administration cleanup settings
Update endpoint administration cleanup settings
Cortex Platform IAM APIs
Preface
Servers
Authentication methods
Roles
List all roles
Create a new role
Delete an existing role
List all permission configs
User Groups
List all user groups
Create a new user group
Edit an existing user group
Delete an existing user group
Scopes
Retrieve an existing scope
Edit an existing scope
User
List all users
Get user
Edit an existing user
API Keys
Get API Key
Edit an API key
Cortex XSIAM Alert Notification Rules REST APIs
Preface
Servers
Alert Notification Rules
List all rules
Create a new rule
Retrieve a specific alert notification rule
Delete an existing Alert Notification Rule
Edit an existing Alert Notification Rule
Edit the status of an existing Alert Notification Rule
Cortex XSIAM External Application Management API
Preface
Servers
Authentication methods
External Applications
Create a new application
List all applications
Update an existing application (full replacement)
Delete an application
Get External Application details by ID
Cortex XSIAM Cloud Logging and Collection Service Management APIs
Preface
Servers
CLCS Management
List connected NGFW devices
Disconnect NGFW devices from CLCS
Cloud Onboarding APIs
Preface
Servers
Authentication methods
Cloud instance management
Create a cloud onboarding integration template
Get cloud instance details
Get all or filtered cloud instances
Edit a cloud instance
Enable or disable cloud cloud instances
Delete the specified cloud instances
Get identifier roles for cloud instance
Cloud account management
Get accounts in the specified cloud instances
Enable or disable cloud accounts
Outpost management
Create an outpost template
Edit an outpost
Get all or filtered outposts
General
Get available regions for a CSP
Get approved Azure tenants
Disable Injection and Prevention Rules Public API
Preface
Servers
Default
Get Disable Injection and Prevention rules
Add Disable Injection and Prevention rule
Disable Disable Injection and Prevention Rules
Disable Prevention Rule Public APIs
Preface
Servers
Default
Get Disable Prevention Rules
Get Disable Prevention Modules
Add Disable Prevention Rule
Edit Disable Prevention Rule
Delete Disable Prevention Rules
ASPM, CICD and Application Security APIs
Preface
Servers
Authentication methods
Default authentication
Billing
Get Billing Contributors
Applications
Get an application configuration
Create an application
Get applications
Get an application
Update an application
Delete an application
Policies
Create an AppSec policy
Limitations
Trigger and Action Constraints by Finding Type
General Policy Constraints
List AppSec policies
Get an AppSec policy
Update an AppSec policy
Delete an AppSec policy
Supported Condition Fields
Supported Scope Fields
Supported Condition Fields
Supported Scope Fields
Rules
Get AppSec rules
Create an AppSec rule
Create an Application Security Rule
Get an AppSec rule
Modify an AppSec rule
Delete an AppSec rule
Get AppSec rule labels
Create an AppSec rule validation
Repositories
Get repositories
Get a repository
Get a repository scan configuration
Update a repository scan configuration
Get AppSec repository branches
Update an AppSec repository branch
Scan management
Get unscanned AppSec scan management repositories
Get AppSec branch periodic scans
Get AppSec Pull Request scans
Get AppSec CI scans
List AppSec scan issues
List AppSec scan findings
Rerun a repository scan
SBOM management
Get an SBOM for the specified repository
Get all SBOMs for the specified organization
Criteria
Get all criteria
Get a Criteria by ID
Delete a Criteria
Create a Criteria
Remediations
Get Fix Suggestion
Trigger Fix Pull Request
Get Fix Status
Data Sources
Get all Data Sources
Create AppSec Data Sources
Get an AppSec Data Source
Update an AppSec Data Source
Delete an AppSec Data Source
3rd Party AppSec Collector
Prerequisites
Limitations
Vulnerability Intelligence APIs
Preface
Servers
Authentication methods
Vulnerabilities
Get list of vulnerabilities
Get vulnerability details
Affected software
Get affected software
Vulnerability Management APIs
Preface
Servers
Vulnerability Management
Get Policies List
Create Policy Public
Update Policy
Get Policy By ID
Delete Policy
Trigger Scan for an AssetId
Bring Your Own Scanner
Submit assets and vulnerabilities from an external scanner
Poll the status of a BYOS import job
Vulnerability Findings
List vulnerability findings (paginated)
Get a single vulnerability finding by platform ID
Vulnerability Findings Snapshot
Bulk export vulnerability findings snapshot
NetScan Public API
Preface
Servers
Vulnerability Network Scan Management
Launch a scan run
Get scan run status
Launch a scan run by definition ID
Get scan run status by ID
Create a scan definition
Send a command to a running scan
Cloud Infrastructure Entitlement Management APIs
Preface
Servers
Default
Search CIEM Access
Compliance Controls API
Preface
Servers
Authentication methods
Default authentication
Assessment profiles
Get assessment profiles
Get assessment profile by ID
Add assessment profile
Edit assessment profile
Delete assessment profile
Assessment results
Get assessment profile results
Controls
Get compliance controls
Get compliance control by ID
Add new control
Edit existing control
Delete control
Get control by revision
Rules
Add compliance rules to a compliance control
Delete rules from control
Categories
Get categories and subcategories
Results
Get control failed results
Get rule failed results
Reports
Get compliance reports
Standards
Get compliance standards
Get single standard by ID
Add new standard
Edit existing standard
Delete standard
Compliance Assets
Get compliance assets
Get Asset Compliance Results API
Preface
Servers
Authentication methods
Default authentication
Control Findings
Get asset compliance results
Policies
Preface
Cloud Security Policies
Create Cloud Security Policy
List Cloud Security Policies
Get Cloud Security Policy
Update Cloud Security Policy
Delete Cloud Security Policy
Cloud Workload Protection APIs
Preface
Servers
Authentication methods
Policies
Get CWP Policies (v2)
Add CWP Policies (v2)
Get a CWP Policy by ID (v2)
Update a CWP Policy by ID (v2)
Get CWP Policies (v1)
Add CWP Policies (v1)
Get a CWP Policy by ID (v1)
Delete a CWP Policy by ID (v1)
Update a CWP Policy by ID (v1)
SBOM
Get the SBOM of the specified asset
Registry Onboarding
Create a registry connector
Get a registry connector
Update a registry connector
Delete a registry connector
Data Security Posture Management APIs
Preface
Servers
Default
Get data pattern inventory
Get field inventory details
Get file inventory details
Managed Services APIs
Preface
Authentication
Supported Tenants
Timestamps
Servers
Authentication methods
Comments
Add a comment to an MTH/MDR report
Get comments for MTH/MDR reports
Status
Update report status
Assignment
Update report assignment
Reports
Get reports by source ID
Get reports by incident ID

Run XQL queries on your data sources using a series of APIs.

Back to home page