Cortex XSOAR 8 API

Cortex XSOAR 8 overview
Get started with Cortex XSOAR 8 APIs
Create a new API key
Get your Cortex XSOAR API key ID
Get your FQDN
Make your first API call
Optimistic locking and versioning
Changes in this release
Changes to existing endpoints
New endpoints
APIS
Cortex XSOAR 8 API
Preface
Servers
API Keys
Delete API keys
Generate an API key
Get existing API keys
Audit Log
Get audit management log
Authentication settings
Create authentication settings for IdP SSO or metadata URL
Delete authentication settings by domain
Get IdP metadata
Get authentication settings for all configured domains
Update authentication settings
Automations
Get an existing script
Content
Fetch content differences
Synchronize selected content between main and specified child tenant
Synchronize content between main and child tenants
Content Packs
Get metadata for all installed content packs
Search for content packs
Retrieve content pack item dependencies
Dashboards
Get all dashboards details
Get dashboard details for the specified dashboard
Engines
Delete an engine
Download the engine configuration file
Get all engines
Get details by engine ID
Create an engine
Update engine configuration
Upgrade specified engines
Entry
Download an entry file attachment
Create new entry in existing investigation
Create a new incident War Room entry
Mark entry as note or delete entry
Set tags on incident War Room entry
Upload content to an incident War Room entry
Evidence
Delete evidence
Search evidence
Incident Fields
Get all incident fields in the tenant
Create a new incident field
Incidents
Create or update an incident
Create an incident from JSON
Create a new incident type
Get incidents as a CSV file
Get a specific incident
Export an incident's history and workplan
Batch export incidents to CSV
Close an incident
Investigate an incident
Update incidents in a batch
Delete a batch of incidents
Search incidents by filter
Indicators
Get a batch of indicators in a CSV file
Search indicators
Batch delete indicators or add them to the exclusion list
Batch export indicators to CSV
Edit indicator
Create feed indicators from JSON
Create an indicator exclusion list
Create an indicator
Search for indicator relationships
Create a relationship between indicators
Enrich an indicator using Unit 42 Intel Objects Feed
Integrations
Delete an integration instance by its ID
Get all integrations
Get details on integration instances, engines, and health
Fetch a integration instance's execution history
Get an integration instance by its ID
Create an instance of an integration
Investigations
Get investigation workplan
Investigate an incident
Get investigation ID context
Close an investigation
Retrieve an incident investigation
Reopen a closed incident
Retrieve an investigation workplan task list
Jobs
Delete the specified job
Create a new job
Sets the specified job to the specified status
Search for jobs
Lists
Get all lists
Delete a list
Create a list
Multi-tenant
Fetch content differences
Synchronize selected content between main and specified child tenant
Synchronize content between main and child tenants
Upload custom content file
Playbooks
Get playbook by ID
Complete a playbook task
Execute task in running investigation
Mark a completed task in a running playbook as not complete
Search playbooks using queries
Remote repository
Get a list of content available to be pushed to production
Check for new content
Install content on a production tenant
Push custom content to production tenant
Reports
Get latest report by ID
Get all reports
Scripts
Get metadata details about all scripts in this tenant
Create or update a script
Get details about a specific script
Get an existing script
Search scripts
Syslog servers
Create a syslog integration
Delete all or filtered syslog integrations
Get all or filtered syslog servers
Test syslog integration
Update a syslog integration
System Management
Get roles
Get user groups
Get users
Set a user role
Widgets
Get widget statistics

Back to home page