Check connectivity and credentials against the XSIAM tenant. Calls the tenant-info endpoint and reports whether auth works. Run this first to confirm the server is configured correctly.

Discovery tool. Returns the catalog of all available XSIAM operations grouped by category (OpenAPI tag), with each tool's name and summary. Use this to find the right tool before calling it. Optionally filter by a tag substring.

Run an XQL query end-to-end in a single call: starts the query, polls until results are ready, and returns them. This wraps xql/start_xql_query + xql/get_query_results so you don't have to poll manually. Prefer this for ad-hoc data investigation.

Example: {"query": "dataset = xdr_data | fields event_id, event_type | limit 10", "time_frame": {"relativeTime": 86400000}}

Start an XQL query

Execute an XQL query.

For more information on how to run XQL queries, see Running XQL query APIs.

Note

To ensure you don't surpass your quota, Cortex XSIAM allows you to run up to four API queries in parallel.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/start_xql_query] · XQL query

Example request body:

{
  "request_data": {
    "query": "dataset=xdr_data | fields event_id, event_type, event_sub_type | limit 3",
    "tenants": [],
    "timeframe": {
      "from": 1598907600000,
      "to": 1599080399000
    }
  }
}

Get XQL query results

Retrieve results of an executed XQL query API.

Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.

Maximum result set size is 1000. The API does not support pagination, therefore, you can set values to determine the result size limitation and how to wait for the results. To view response with greater than 1000 results you must call Get XQL query results Stream.

For more information on how to run XQL queries, see Running XQL query APIs.

Note

To ensure you don't surpass your quota, Cortex XSIAM allows you to run up to four API queries in parallel.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/get_query_results] · XQL query

Example request body:

{
  "request_data": {
    "query_id": "061880b4867446_4356_inv",
    "pending_flag": true,
    "limit": 100,
    "format": "json"
  }
}

Get XQL query Quota

Retrieve the amount of query quota available and used.

Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.

For more information on how to run XQL queries, see Running XQL query APIs.

Note

To ensure you don't surpass your quota, Cortex XSIAM allows you to run up to four API queries in parallel.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/get_quota] · XQL query

Example request body:

{
  "request_data": {}
}

Get XQL query results Stream

Retrieve XQL query results with more than 1000 results.

Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.

Response is returned as chunked (Transfer-Encoding: chunked). To retrieve a compressed gzipped response (Content-Encoding: gzip), in your header add Accept-Encoding: gzip.

For more information on how to run XQL queries, see Running XQL query APIs.

Note

To ensure you don't surpass your quota, Cortex XSIAM allows you to run up to four API queries in parallel.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/get_query_results_stream] · XQL query

Example request body:

{
  "request_data": {
    "stream_id": "563c5e24-===-9a1f8139d3c5",
    "is_gzip_compressed": true
  }
}

Get Incidents

Get a list of incidents filtered by a list of incident IDs, modification time, or creation time. This includes all incident types and severities, including correlation-generated incidents.

• The response is concatenated using AND condition (OR is not supported).

• The maximum result set size is >100.

• Offset is the zero-based number of incidents from the start of the result set.

Note: You can send a request to retrieve either all or filtered results.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/incidents/get_incidents] · Incidents

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "incident_id_list",
        "operator": "in",
        "value": [
          "<incident ID>",
          "<incident ID>"
        ]
      }
    ],
    "search_from": 0,
    "search_to": 100,
    "sort": {
      "field": "creation_time",
      "keyword": "desc"
    }
  }
}

Get all Alerts

Get a list of all or filtered alerts. The alerts listed are what remains after alert exclusions are applied by Cortex XSIAM.

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 100.

• Offset is the zero-based number of alerts from the start of the result set. The response indicates whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/alerts/get_alerts] · Incidents

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "severity",
        "operator": "in",
        "value": [
          "medium",
          "high"
        ]
      }
    ],
    "search_from": 0,
    "search_to": 5,
    "sort": {
      "field": "severity",
      "keyword": "asc"
    }
  }
}

Get Alerts Multi-Events v2

Get a list of alerts with multiple events.

• The response is concatenated using AND condition (OR is not supported).

• The maximum result set size is 100.

• Offset is the zero-based number of alerts from the start of the result set.

Cortex XDR displays in the API response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.

Note: You can send a request to retrieve either all or filtered results.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v2/alerts/get_alerts_multi_events] · Incidents

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "severity",
        "operator": "in",
        "value": [
          "medium",
          "high"
        ]
      }
    ]
  }
}

Get Alerts Multi-Events v1

**Note: ** This endpoint is legacy. Use the Get Alerts Multi-Events v2 endpoint.

Get a list of alerts with multiple events.

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 100.

• Offset is the zero-based number of alerts from the start of the result set. Cortex XDR displays in the APIs response whether an PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.

Note: You can send a request to retrieve either all or filtered results.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/alerts/get_alerts_multi_events] · Incidents

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "severity",
        "operator": "in",
        "value": [
          "medium",
          "high"
        ]
      }
    ],
    "search_from": 0,
    "search_to": 5,
    "sort": {
      "field": "severity",
      "keyword": "asc"
    }
  }
}

Update an Incident

Update one or more fields of a specific incident. Missing fields are ignored. Note:

• assigned_user_mail field is validated by Cortex XSIAM to confirm the provided assignee email address belongs to a user that exists in the same Cortex XSIAM tenant.

• To unassign an incident pass none or "assigned_user_mail": "".

• To remove a manually set severity pass none or "manual_severity": "".

[POST /public_api/v1/incidents/update_incident] · Incidents

Update Alerts

Update one or more alerts. You can update up to 100 alerts per request. Missing fields are ignored.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/alerts/update_alerts] · Incidents

Example request body:

{
  "request_data": {
    "alert_id_list": "<list of ids>",
    "update_data": {
      "severity": "medium",
      "status": "resolved_other",
      "comment": "This incident is resolved"
    }
  }
}

Insert CEF Alerts

Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 alerts per minute.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/alerts/insert_cef_alerts] · Incidents

Example request body:

{
  "request_data": {
    "alerts": [
      "CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|microsoft-ds|Unknown|act=AcceptdeviceDirection=0 rt=1569---000 spt=5---57 dpt=4---5cs2Label=Rule Name cs2=ADPrimerylayer_name=FW_Device_blackenedSecuritylayer_uuid=07-----fc7-1a5c-71b8c match_id=1---6parent_rule=0rule_action=Accept rule_uid=8----be5cifname=bond2logid=0loguid={0x5d8c5388,0x61,0x29321fac,0xc0000022}origin=1.1.1.1originsicname=CN=DWdeviceBlackend,O=Blackend sequencenum=363version=5dst=1.1.1.1 inzone=External outzone=Internal product=VPN-1 & FireWall-1proto=6service_id=microsoft-ds src=1.1.1.1",
      "CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|Log|Unknown|act=AcceptdeviceDirection=0 rt=1569477501000 spt=63088 dpt=5985cs2Label=RuleNamelayer_name=FW_Device_blackenedSecuritylayer_uuid=07693f---e96c71b8c match_id=8----9parent_rule=0rule_action=Acceptrule_uid=ae9---70f-ab1c-1ad552c82369conn_direction=Internal ifname=bond1.12logid=0loguid={0x5d8c537d,0xbb,0x29321fac,0xc0000014}origin=1.1.1.1originsicname=CN=DWdeviceBlackend,O=Blackend sequencenum=899version=5dst=1.1.1.1 product=VPN-1 & FireWall-1 proto=6 src=1.1.1.1"
    ]
  }
}

Insert Parsed Alerts

Upload alerts from external alert sources in Cortex XSIAM format. Cortex XSIAM displays alerts that are parsed successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/alerts/insert_parsed_alerts] · Incidents

Example request body:

{
  "request_data": {
    "alerts": [
      {
        "product": "VPN & Firewall-1",
        "vendor": "<vendor name>",
        "local_ip": "<IP address>",
        "local_port": "<port>",
        "remote_ip": "<IP address>",
        "remote_port": "<port>",
        "event_timestamp": 1543270652000,
        "severity": "Low",
        "alert_name": "Alert Name Example",
        "alert_description": "Alert Description",
        "action_status": "Reported",
        "local_ip_v6": "<IPv6 address>",
        "remote_ip_v6": "<IPv6 address>"
      }
    ]
  }
}

Retrieve PCAP Packet

Retrieve a list of alert IDs and the associated PCAP triggering packets of PAN NGFW type alerts returned when running the Get Alerts and Get Extra Incident Data APIs. Maximum result set size is 100.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/alerts/get_alerts_pcap] · Incidents

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "severity",
        "operator": "in",
        "value": [
          "medium",
          "high"
        ]
      }
    ],
    "search_from": 0,
    "search_to": 5,
    "sort": {
      "field": "severity",
      "keyword": "asc"
    }
  }
}

Create a Custom Alert

Create a custom alert.

In addition to the mandatory fields (vendor, product, severity, category), any field that appears in the alert table can be used. In order to use a field from the alert table, use its lower camel case representation. For example: Container ID -> container_id. If the field in the alert table contains a hyphen, replace it with underscore, for example: App - ID -> app_id.

The following fields are recommended for creating an alert: - remote_ip - remote_host - host_name - group_id - initiated_by - initiator_sha256 - target_process_sha256 - cgo_sha256 - file_sha256 - os_parent_cmd - os_parent_user_name

By using multiple calls of create_alert, you can send up to 600 alerts per minute.

Required role: App Service Account

Required licenses: Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus.

[POST /public_api/v1/alerts/create_alert] · Incidents

Replace Featured Hosts

Replace the featured hosts listed in your environment.

Note: Running this API will delete all existing host names.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/featured_fields/replace_hosts] · Incidents

Example request body:

{
  "request_data": {
    "fields": [
      {
        "value": "ADMIN-PC",
        "comment": "ADMIN-PC is a featured host"
      },
      {
        "value": "CEO-PC"
      }
    ]
  }
}

Replace Featured Users

Replace the featured users listed in your environment.

Note: Running this API will delete all existing user names.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/featured_fields/replace_users] · Incidents

Example request body:

{
  "request_data": {
    "fields": [
      {
        "value": "Administrator",
        "comment": "Administrator is a featured user"
      },
      {
        "value": "System"
      }
    ]
  }
}

Replace Featured IP Addresses

Replace the featured IP addresses listed in your environment.

Note: Running this API will delete all existing IP addresses.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/featured_fields/replace_ip_addresses] · Incidents

Example request body:

{
  "request_data": {
    "fields": [
      {
        "value": "1.2.3.4",
        "comment": "A single featured IP"
      },
      {
        "value": "192.111.1.0-192.111.1.255",
        "comment": "Featured IP range"
      },
      {
        "value": "7.7.7.7/16",
        "comment": "Featured CIDR"
      }
    ]
  }
}

Replace Featured Active Directory Groups

Replace the featured active directory groups and organizational units listed in your environment.

Note: Running this API will delete all existing active directory groups.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/featured_fields/replace_ad_groups] · Incidents

Example request body:

{
  "request_data": {
    "fields": [
      {
        "value": "domain/administrators-group",
        "type": "group",
        "comment": "Administrators-group is a featured AD group"
      },
      {
        "value": "dev",
        "type": "OU"
      }
    ]
  }
}

Get Distribution version

Get a list of all the agent versions to use for creating a distribution list.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/distributions/get_versions] · Endpoint Management

Get all Endpoints

Gets a list of all of your endpoints. The response is concatenated using AND condition (OR is not supported).

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/get_endpoints] · Endpoint Management

Get Policy

Get the policy name for a specific endpoint.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/get_policy] · Endpoint Management

Example request body:

{
  "request_data": {
    "endpoint_id": "<endpoint ID>"
  }
}

Delete Endpoints

Delete selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.

Note: Endpoints are deleted from the Cortex XDR app web interface, however they still exist in the database.

When filtering by multiple fields:

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 1000.

• Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/delete] · Endpoint Management

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      }
    ]
  }
}

Create distributions

Create an installation package. This is an async call that returns the distribution ID; it does not mean that the creation succeeded. To confirm the package has been created, check the status of the distribution by running the Get Distribution Status API.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/distributions/create] · Endpoint Management

Example request body:

{
  "request_data": {
    "name": "<installation package name>",
    "platform": "windows",
    "package_type": "standalone",
    "agent_version": "<agent version>"
  }
}

Get Violations

Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.

When filtering by multiple fields:

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 100.

• Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/device_control/get_violations] · Endpoint Management

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "type",
        "operator": "in",
        "value": [
          "disk drivE"
        ]
      }
    ],
    "search_to": 1
  }
}

Get Distribution status

Check the status of the installation package.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/distributions/get_status] · Endpoint Management

Example request body:

{
  "request_data": {
    "distribution_id": "<distribution ID>"
  }
}

Get Distribution URL

Get the distribution URL for downloading the installation package.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/distributions/get_dist_url] · Endpoint Management

Example request body:

{
  "request_data": {
    "distribution_id": "<distribution ID>",
    "package_type": "x86"
  }
}

Set an Endpoint Alias

Set or modify an Alias field for your endpoints.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/update_agent_name] · Endpoint Management

Example request body:

{
  "context": {
    "lcaas_id": "<tenant_id>"
  },
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<distribution_id"
        ]
      }
    ],
    "alias": "<alias_name>"
  }
}

Assign Tags

Assign one or more tags to one or more endpoints.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/tags/agents/assign] · Endpoint Management

Example request body:

{
  "context": {
    "lcaas_id": "<tenant_id>"
  },
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<distribution_id"
        ]
      }
    ],
    "tag": "<tag_name>"
  }
}

Remove Tags

Remove one or more tags from one or more endpoints.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/tags/agents/remove] · Endpoint Management

Example request body:

{
  "context": {
    "lcaas_id": "<tenant_id>"
  },
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<distribution_id"
        ]
      }
    ],
    "tag": "<tag_name>"
  }
}

Restore File

Restore a quarantined file on a requested endpoints. When filtering by multiple fields:

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 100.

• Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/restore] · Response Action

Example request body:

{
  "request_data": {
    "file_hash": "<hash value>",
    "incident_id": 302
  }
}

File Retrieval Details

View the API required to call in order to download the file retrieved by the Retrieve File API request according to the action ID.

The response contains a file hash you need to download and then unzip to view:

1. Download the file.

curl -XPOST "https://api-{fqdn}/public_api/v1/download/<api_value>" 
-H "x-xdr-auth-id:{API_KEY_ID}"  
-H "Authorization:{API_KEY}" 
-H 'Content-Type:application/json' 
--output /tmp/file.zip

2. Unzip the file: unzip /tmp/file.zip

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/actions/file_retrieval_details] · Response Action

Example request body:

{
  "request_data": {
    "group_action_id": "<action ID>"
  }
}

Allow List Files

Add files which do not exist in the allow or block lists to an allow list.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/hash_exceptions/allowlist] · Response Action

Example request body:

{
  "request_data": {
    "hash_list": [
      "032196FB1A---DFCF69E5D553F0",
      "365296EB1B---FCF29E5D553E4",
      "365296EB1B---FCF69E3D553E4",
      "365296EB1B---FCF69E5D553D4",
      "365296EB1B---FCF79E5D553D4"
    ],
    "comment": "test",
    "incident_id": 5
  }
}

Get Quarantine Status

Retrieve the quarantine status for specified files.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/quarantine/status] · Response Action

Example request body:

{
  "request_data": {
    "files": [
      {
        "endpoint_id": "<endpoint ID>",
        "file_path": "C:\\<file path>\\test_x64.msi",
        "file_hash": "<hash value>"
      }
    ]
  }
}

Quarantine Files

Quarantine file on selected endpoints. You can select up to 1000 endpoints.

Note: A success response means that the request reached the defined endpoints, however if the file was not found there, no quarantine action will take place. To ensure if the file has been quarantined, check the Cortex XDR Action Center.

When filtering by multiple fields:

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 1000.

• Offset is the zero-based number of incidents from the start of the result set.

[POST /public_api/v1/endpoints/quarantine] · Response Action

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      }
    ],
    "file_path": "C:\\<file path>\\test_x64.msi",
    "file_hash": "<hash value>"
  }
}

Block List Files

Add files which do not exist in the allow or block lists to a block list. You can view the block list in the UI at Incident Response > Action Center > Block List.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/hash_exceptions/blocklist] · Response Action

Example request body:

{
  "request_data": {
    "hash_list": [
      "032196FB1A---DFCF69E5D553F0",
      "365296EB1B---FCF69E7D553E4",
      "365296EB1B---FCF69E5D523E4",
      "365296EB1B---FCF69E5D553D4",
      "365296EB1B---FCF63E5D553D4"
    ],
    "comment": "test",
    "incident_id": 5
  }
}

Unisolate Endpoints

Reverse the isolation of one or more endpoints in single request.

Note: You can only send a request with either endpoint_id to unisolate one endpoint or with filters to unisolate more than one endpoint. An error is raised if you try to use both endpoint_id and the filters.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/unisolate] · Response Action

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "dist_name",
        "operator": "IN",
        "value": [
          "MG"
        ]
      }
    ]
  }
}

Cancel Scan Endpoints

Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are in Pending or in Progress status.

When filtering by multiple fields:

• Response is concatenated using AND condition (OR is not supported).

• Offset is the zero-based number of endpoints from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/abort_scan] · Response Action

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      },
      {
        "field": "dist_name",
        "operator": "in",
        "value": [
          "WinInstaller"
        ]
      },
      {
        "field": "group_name",
        "operator": "in",
        "value": [
          "test"
        ]
      },
      {
        "field": "scan_status",
        "operator": "in",
        "value": [
          "none",
          "pending",
          "in_progress",
          "pending_cancellation",
          "aborted",
          "success"
        ]
      },
      {
        "field": "group_name",
        "operator": "in",
        "value": [
          "test"
        ]
      }
    ]
  }
}

Scan Endpoints

Run a scan on selected endpoints.

• Response is concatenated using AND condition (OR is not supported).

• Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/scan] · Response Action

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      },
      {
        "field": "dist_name",
        "operator": "in",
        "value": [
          "WinInstaller"
        ]
      },
      {
        "field": "group_name",
        "operator": "in",
        "value": [
          "test"
        ]
      },
      {
        "field": "scan_status",
        "operator": "in",
        "value": [
          "none",
          "pending",
          "in_progress",
          "pending_cancellation",
          "aborted",
          "success"
        ]
      },
      {
        "field": "group_name",
        "operator": "in",
        "value": [
          "test"
        ]
      }
    ]
  }
}

Get Action Status

Retrieve the status of the requested actions according to the action ID.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/actions/get_action_status] · Response Action

Example request body:

{
  "request_data": {
    "group_action_id": "<action ID>"
  }
}

Run Snippet Code Script

Initiate a new endpoint script execution action using provided snippet code. Cortex XDR supports sending your request in Base64.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/run_snippet_code_script] · Script execution

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      }
    ],
    "snippet_code": "print (\"7\")"
  }
}

Run Script

Initiate a new endpoint script execution action using a script from the script library. The script can be run on up to 1000 endpoints.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/run_script] · Script execution

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      }
    ],
    "script_uid": "<unique ID>",
    "parameters_values": {
      "x": "param input as returned in Get Script Metadata",
      "y": 4
    }
  }
}

Get Script Metadata

Get the full definitions of a specific script in the scripts library.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/get_script_metadata] · Script execution

Example request body:

{
  "request_data": {
    "script_uid": "<unique ID>"
  }
}

Get Script Execution Status

Retrieve the status of a script execution action.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/get_script_execution_status] · Script execution

Example request body:

{
  "request_data": {
    "action_id": "<action ID>"
  }
}

Get Scripts

Get a list of scripts available in the scripts library.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/get_scripts] · Script execution

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "is_high_risk",
        "operator": "in",
        "value": [
          "false"
        ]
      }
    ]
  }
}

Get Script Execution Results

Retrieve the results of a script execution action.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/get_script_execution_results] · Script execution

Example request body:

{
  "request_data": {
    "action_id": "<action ID>"
  }
}

Get Script Execution Result Files

Get the files retrieved from a specific endpoint during a script execution.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/get_script_execution_results_files] · Script execution

Example request body:

{
  "request_data": {
    "action_id": "<action ID>",
    "endpoint_id": "<endpoint ID>"
  }
}

Get Script Code

Get the code of a specific script in the script library.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/scripts/get_script_code] · Script execution

Example request body:

{
  "request_data": {
    "script_uid": "<unique ID>"
  }
}

Insert Simple Indicators, CSV

Upload IOCs in CSV format that you retrieved from external threat intelligence sources.

Note: Cortex XDR does not scan historic data, but rather only new incoming data.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/indicators/insert_csv] · Rules

Example request body:

{
  "request_data": "indicator,type,severity,expiration_date, comment,reputation,reliability,class,vendor.name,vendor.reputation, vendor.reliability\n B2c74bf609159f27dd89a829501ec34d6596d8b39a2cce7add73a8207088817a, HASH,HIGH,1587054895000,This is an example IOC,BAD,D,Malware,IBM, GOOD,B\n A2c74bf609159f27dd89a829501ec34d6596d8b39a2cce7add73a8207088817a, HASH,LOW,1587054895000,This is an example IOC,GOOD,D,Malware,PANW, BAD,A\n"
}

Insert Simple Indicators, JSON

Upload IOCs as JSON objects that you retrieved from external threat intelligence sources.

Note: Cortex XSIAM does not scan historic data, rather only new incoming data.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/indicators/insert_jsons] · Rules

Example request body:

{
  "request_data": [
    {
      "indicator": "<hash_value>",
      "type": "HASH",
      "comment": "test",
      "reputation": "GOOD",
      "reliability": "D",
      "vendors": [
        {
          "vendor_name": "V1",
          "reliability": "A",
          "reputation": "GOOD"
        },
        {
          "vendor_name": "V2",
          "reliability": "A",
          "reputation": "SUSPICIOUS"
        }
      ],
      "class": "Malware"
    }
  ],
  "validate": true
}

Get Audit Management Log

Get audit management logs.

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 100.

• Offset is the zero-based number of incidents from the start of the result set.

[POST /public_api/v1/audits/management_logs] · Audit log

Example request body:

{
  "request_data": {
    "search_from": 0,
    "search_to": 19,
    "sort": {
      "field": "email",
      "keyword": "ASC"
    },
    "filters": [
      {
        "field": "type",
        "operator": "in",
        "value": [
          "AUTH"
        ]
      },
      {
        "field": "sub_type",
        "operator": "in",
        "value": [
          "login"
        ]
      },
      {
        "field": "result",
        "operator": "in",
        "value": [
          "SUCCESS"
        ]
      },
      {
        "field": "timestamp",
        "operator": "lte",
        "value": 1565074114053
      }
    ]
  }
}

System Health Check

Perform a health check of your Cortex XSIAM environment.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[GET /public_api/v1/healthcheck] · System management

Get Tenant Info

Get your tenant license information.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/system/get_tenant_info] · System management

Get Extra Incident Data

Get extra data fields of a specific incident including alerts and key artifacts.

• Cortex XDR displays in the APIs response whether a PAN NGFW type alert contains a PCAP triggering packet. Use the Retrieve PCAP Packet API to retrieve a list of alert IDs and their associated PCAP data.

Note: The API includes a limit rate of 10 API requests per minute.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/incidents/get_incident_extra_data] · Incidents

Example request body:

{
  "request_data": {
    "incident_id": "<incident ID>",
    "alerts_limit": 5
  }
}

Get Users

Retrieve a list of the current users in your environment.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/rbac/get_users] · System management

Get Roles

Retrieve information about one or more roles created in your environment.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/rbac/get_roles] · System management

Example request body:

{
  "request_data": {
    "role_names": [
      "Role1",
      "Role2"
    ]
  }
}

Get User Groups

Retrieve a list of the current user emails associated with one or more user groups in your environment.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/rbac/get_user_group] · System management

Example request body:

{
  "request_data": {
    "group_names": [
      "Group1",
      "Group2"
    ]
  }
}

Set a User Role

Add or remove one or more users from a role.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/rbac/set_user_role] · System management

Example request body:

{
  "request_data": {
    "user_emails": [
      "user1@acme.com",
      "user2@acme.com"
    ],
    "role_name": "Role1"
  }
}

Get Endpoint

Gets a list of filtered endpoints.

• The response is concatenated using AND condition (OR is not supported).

• The maximum result set size is 100.

• Offset is the zero-based number of endpoints from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/get_endpoint] · Endpoint Management

Example request body:

{
  "request_data": {
    "search_from": 0,
    "search_to": 1,
    "sort": {
      "field": "endpoint_id",
      "keyword": "ASC"
    },
    "filters": [
      {
        "field": "group_name",
        "operator": "in",
        "value": [
          "Test-Group-01"
        ]
      },
      {
        "field": "endpoint_status",
        "operator": "in",
        "value": [
          "disconnected"
        ]
      },
      {
        "field": "dist_name",
        "operator": "in",
        "value": [
          "papi-test"
        ]
      },
      {
        "field": "scan_status",
        "operator": "in",
        "value": [
          "none",
          "pending",
          "in_progress",
          "pending_cancellation",
          "aborted",
          "success",
          "canceled",
          "error"
        ]
      }
    ]
  }
}

Get Risk Score

Retrieve the risk score of a specific user or endpoint in your environment, along with the reason for the score.

Required license: Cortex XSIAM Premium or Identity Threat Module

[POST /public_api/v1/get_risk_score] · System management

Example request body:

{
  "request_data": {
    "id": "<user or endpoint ID>"
  }
}

Get Risky Users

Retrieve a list of users with the highest risk score in your environment along with the reason affecting each score.

Required license: Cortex XSIAM Premium or Identity Threat Module

[POST /public_api/v1/get_risky_users] · System management

Get Risky Hosts

Retrieve a list of endpoints with the highest risk score in your environment along with the reason for each score.

Required license: Cortex XSIAM Premium or Identity Threat Module

[POST /public_api/v1/get_risky_hosts] · System management

Retrieve File

Retrieve files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints.

• Response is concatenated using AND condition (OR is not supported).

• Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/file_retrieval] · Response Action

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID 1>",
          "<endpoint ID 2>",
          "<endpoint ID 3>"
        ]
      }
    ],
    "files": {
      "windows": [
        "C:\\<file path>\\test.txt"
      ]
    }
  }
}

Isolate Endpoints

Isolate one or more endpoints in a single request. Request is limited to 1000 endpoints.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/endpoints/isolate] · Response Action

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID 1>",
          "<endpoint ID 2>",
          "<endpoint ID 3>"
        ]
      }
    ]
  }
}

Get Audit Agent Report

Get agent event reports.

• Response is concatenated using AND condition (OR is not supported).

• Maximum result set size is 100.

• Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/audits/agents_reports] · Audit log

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "trapsversion",
        "operator": "in",
        "value": [
          "<version value>",
          "<version value>"
        ]
      },
      {
        "field": "timestamp",
        "operator": "gte",
        "value": 0
      },
      {
        "field": "domain",
        "operator": "in",
        "value": [
          "WORKGROUP"
        ]
      }
    ],
    "sort": {
      "field": "timestamp",
      "keyword": "asc"
    }
  }
}

Get External Service

Get service details according to the service ID. You can send up to 20 IDs.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise, Cortex XSIAM Enterprise Plus or Cortex XSIAM Premium

[POST /public_api/v1/assets/get_external_service] · Asset management

Example request body:

{
  "request_data": {
    "service_id_list": [
      "<service_ID>"
    ]
  }
}

Get All Services

Get a complete or filtered list of all your external services.

The maximum result limit is 500.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise, Cortex XSIAM Enterprise Plus or Cortex XSIAM Premium

[POST /public_api/v1/assets/get_external_services] · Asset management

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "discovery_type",
        "operator": "in",
        "value": [
          "colocated_on_ip"
        ]
      }
    ]
  }
}

Get all Internet Exposures

Get a list of all your Internet exposure filtered by business units, externally detected providers, externally inferred CVEs, mac addresses, names, IP addresses, whether it has an XDR agent, whether it has active external services, and type.

The maximum result limit is 500 assets.

Note: You can send a request to retrieve either all or filtered results.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/assets/get_assets_internet_exposure] · Asset management

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "has_xdr_agent",
        "operator": "in",
        "value": [
          "n/a",
          false,
          true
        ]
      },
      {
        "field": "has_active_external_services",
        "operator": "in",
        "value": [
          false
        ]
      }
    ],
    "search_from": 0,
    "search_to": 500,
    "sort": {
      "field": "last_observed",
      "keyword": "desc"
    }
  }
}

Get Internet Exposure

Get Internet exposure asset details according to the asset ID. You can send up to 20 IDs.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/assets/get_asset_internet_exposure] · Asset management

Example request body:

{
  "request_data": {
    "asm_id_list": [
      "<asset_ID>"
    ]
  }
}

Get all External IP Address Ranges

Get a list of all your Internet exposure filtered by business units and organization handles.

The maximum result limit is 1000 ranges.

Note: You can send a request to retrieve either all or filtered results.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/assets/get_external_ip_address_ranges] · Asset management

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "organization_handles",
        "operator": "contains",
        "value": "irt"
      }
    ],
    "search_from": 0,
    "search_to": 500
  }
}

Get External IP Address Range

Get external IP address range details according to the range IDs. You can send up to 100 IDs.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/assets/get_external_ip_address_range] · Asset management

Example request body:

{
  "request_data": {
    "range_id_list": [
      "<range_ID>"
    ]
  }
}

Initiate Forensics Triage

Initiate forensics triage for the specified agents.

• Maximum of 10 concurrent triage actions at a time.

• Specified agents must have Forensics License enabled.

• Specified agents must be the same OS, Windows or macOS, but not a mixture of both.

• Specified configuration must have type "Online = True".

Required license: Cortex XSIAM Premium or

[POST /public_api/v1/triage_endpoint] · Endpoint Management

Get Vulnerability Tests

Get a complete or filtered list of vulnerability tests. Results include details about each test, including the number of services confirmed vulnerable.

[POST /public_api/v1/assets/get_vulnerability_tests] · Asset management

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "name",
        "operator": "contains",
        "value": "apache"
      }
    ]
  }
}

Bulk Update Vulnerability Tests

Enable or disable vulnerability tests.

[POST /public_api/v1/assets/bulk_update_vulnerability_tests] · Asset management

Example request body:

{
  "request_data": {
    "test_names": [
      "Apache Solr DataImportHandler Code Injection Vulnerability"
    ],
    "status": "Enabled"
  }
}

Define an XQL user dataset

Define an XQL user dataset based on an existing BigQuery table created by the user.

Note: BigQuery table must be an existing table under public_access_user.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus.

These APIs are only applicable from within the XSIAM Notebook environment.

[POST /public_api/v1/dataset/define_dataset] · XQL user datasets

Get created XQL user datasets

Retrieve a list of all XQL user datasets created using the Cortex SDK.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus.

These APIs are only applicable from within the XSIAM Notebook environment.

[POST /public_api/v1/dataset/get_created_datasets] · XQL user datasets

Delete an XQL user dataset

Delete an XQL user dataset that was created by the Cortex SDK.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus.

These APIs are only applicable from within the XSIAM Notebook environment.

[POST /public_api/v1/dataset/delete_dataset] · XQL user datasets

Add Dataset

Add a dataset of type lookup with the specified name and schema.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/add_dataset] · Dataset Management

Delete a dataset

Delete a dataset with the specified name. The following dataset types can be deleted: Lookup, Raw, User, Snapshot, and Correlation. You can only delete a dataset with dependencies by setting force to TRUE.

Note: The System dataset and other protected datasets cannot be deleted.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v2/xql/delete_dataset] · Dataset Management

Example request body:

{
  "dataset_name": "users",
  "force": "yes"
}

Get all datasets

Retrieve a list of all the datasets and their properties.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/get_datasets] · Dataset Management

Add or update data in a lookup dataset

Add or update data in a lookup dataset.

When updating data, any field not specified in the data field, but specified on at least one of the rows, will be set to None.

The /public_api/xql/lookups/add_data/ endpoint does not support concurrent edits. Sending concurrent calls to this endpoint can cause data to be unintentionally overwritten or deleted. To allow sufficient time for each API call to complete its operation before initiating another one, assume that 1000 entries can be added per API every 10 seconds.

**Note: **

• The maximum size of a lookup dataset is 50 MB. Attemping to exceed this limit will fail.

• Requests time out after three minutes.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/lookups/add_data] · Lookup Datasets

Remove data from a lookup dataset

Remove data from a dataset based on the specified parameters. If any one of the filter sets are not found, the API does not delete any data.

The /public_api/xql/lookups/remove_data/ endpoint does not support concurrent edits. Sending concurrent calls to this endpoint can cause data to be unintentionally overwritten or deleted. To allow sufficient time for each API call to complete its operation before initiating another one, assume that 1000 entries can be added per API every 10 seconds.

Note:

• All lookup entries matching any of the filter blocks are deleted. To match a filter block, a lookup entry must match all the specified fields as if there were an AND operator between them.

• Requests time out after three minutes.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/lookups/remove_data] · Lookup Datasets

Get data from a lookup dataset

Get data from a lookup dataset according to the specified filter fields. All lookup entries matching any of the filter blocks are returned. To match a filter block, a lookup entry must match all the specified fields as if there were an AND operator between them. If no filters are specified, return all lookup entries.

Note:

• The maximum number of entries returned is 10,000.

• Requests time out after three minutes.

Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus

[POST /public_api/v1/xql/lookups/get_data] · Lookup Datasets

Get triage presets

Get all triage preset information including triage name, platform, description, created by, and triage type.

Required license: Cortex XSIAM Premium or Forensics add-on

[POST /public_api/v1/get_triage_presets] · Response Action

Example request body:

{
  "request_data": {}
}

Create authentication settings for IdP SSO or metadata URL

Create authentication settings for IdP SSO or metadata URL. You must include either the metadata_url field or all of the following fields: idp_sso_url, idp_issuer, and idp_certificate.

You must have Instance Administrator permissions to run this endpoint.

[POST /public_api/v1/authentication-settings/create] · Authentication settings

Example request body:

{
  "request_data": {
    "name": "str",
    "default_role": "",
    "is_account_role": false,
    "domain": " ",
    "mappings": {
      "email": "str",
      "firstname": "str",
      "lastname": "str",
      "group_name": "str"
    },
    "advanced_settings": {
      "relay_state": " ",
      "idp_single_logout_url": " ",
      "service_provider_public_cert": " ",
      "service_provider_private_key": " ",
      "authn_context_enabled": " ",
      "force_authn": false
    },
    "idp_sso_url": " ",
    "idp_certificate": " ",
    "idp_issuer": " ",
    "metadata_url": " "
  }
}

Update authentication settings

Update existing authentication settings. To update the default domain, include empty value for both current_domain_value and new_domain_value.

You must have Instance Administrator permissions to run this endpoint.

[POST /public_api/v1/authentication-settings/update] · Authentication settings

Example request body:

{
  "request_data": {
    "name": "str",
    "default_role": "",
    "is_account_role": false,
    "domain": " ",
    "mappings": {
      "email": "str",
      "firstname": "str",
      "lastname": "str",
      "group_name": "str"
    },
    "advanced_settings": {
      "relay_state": " ",
      "idp_single_logout_url": " ",
      "service_provider_public_cert": " ",
      "service_provider_private_key": " ",
      "authn_context_enabled": " ",
      "force_authn": false
    },
    "idp_sso_url": " ",
    "idp_certificate": " ",
    "idp_issuer": " ",
    "metadata_url": " "
  }
}

Delete authentication settings by domain

Delete all authentication settings for the specified domain.

**Note: ** The first configuration on the tenant is the default configuration and cannot be deleted.

You must have Instance Administrator permissions to run this endpoint.

[POST /public_api/v1/authentication-settings/delete] · Authentication settings

Example request body:

{
  "request_data": {
    "domain": "str"
  }
}

Get authentication settings for all configured domains

Get all the authentication settings for every configured domain in the tenant.

You must have Instance Administrator permissions to run this endpoint.

[POST /public_api/v1/authentication-settings/get/settings] · Authentication settings

Example request body:

{
  "request_data": {}
}

Get IdP metadata

Get the metadata for all IdPs.

You must have Instance Administrator permissions to run this endpoint.

[POST /public_api/v1/authentication-settings/get/metadata] · Authentication settings

Example request body:

{
  "request_data": {}
}

Upload assets to the inventory

Upload domains (paid-level domains (PLD) and subdomains) and IPv4 address ranges. You can upload up to 500 IP address ranges or domains in each request.

You must have Instance Administrator permissions to run this endpoint.

Required license: Cortex XSIAM Premium or Cortex XSIAM with ASM add-on

[POST /public_api/v1/asm_management/upload_asm_data] · Asset management

Example request body:

{
  "request_data": {
    "request_type": "Addition",
    "asset_type": "ip_range",
    "asset_identifiers": [
      "192.84.12.55-192.84.12.68"
    ],
    "business_units": [
      "BU:1",
      "BU:2"
    ]
  }
}

Get Website Details

Get details about specific websites based on website IDs. You can submit up to 20 website IDs.

Required license: Cortex XSIAM Premium or Cortex XSIAM with ASM Add-on

[POST /public_api/v1/assets/get_external_website] · Asset management

Get All Websites

Get a complete or filtered list of your public-facing websites.

Required license: Cortex XSIAM Premium or Cortex XSIAM with ASM Add-on

[POST /public_api/v1/assets/get_external_websites] · Asset management

Get Websites Last Assessment

Gets the time and status of the last update of websites data in Cortex. A status of "true" indicates the websites data update was successful.

[POST /public_api/v1/assets/get_external_websites/last_external_assessment] · Asset management

Create a syslog integration

Create a new syslog integration.

You must have View/Edit Alert Notification permissions to run this endpoint.

[POST /public_api/v1/integrations/syslog/create] · Syslog servers

Example request body:

{
  "request_data": {
    "name": "Test PAPI",
    "address": "34.24.11.16",
    "port": "1234",
    "protocol": "TLS",
    "facility": "FAC_USER",
    "security_info": {
      "certificate_name": "wf-verdict-service.key.pem",
      "ignore_cert_errors": false,
      "certificate_content": "<binary string of the cert>"
    }
  }
}

Get all or filtered syslog servers

Get a complete or filtered list of syslog servers.

You must have View Alert Notification permissions to run this endpoint.

[POST /public_api/v1/integrations/syslog/get] · Syslog servers

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "name",
        "operator": "EQ",
        "value": "Test PAP"
      }
    ]
  }
}

Update a syslog integration

Update the details of the specified syslog integration.

You must have View/Edit Alert Notification permissions to run this endpoint.

[POST /public_api/v1/integrations/syslog/update] · Syslog servers

Example request body:

{
  "request_data": {
    "syslog_id": "123456789",
    "name": "Test PAPI",
    "address": "35.27.11.16",
    "port": "1234",
    "protocol": "TLS",
    "facility": "FAC_USER",
    "security_info": {
      "certificate_name": "wf-verdict-service.key.pem",
      "ignore_cert_errors": false,
      "certificate_content": "<binary string of the cert>"
    }
  }
}

Delete all or filtered syslog integrations

Delete all the syslog integrations or the ones who match the filter criteria.

You must have View/Edit Alert Notification permissions to run this endpoint.

[POST /public_api/v1/integrations/syslog/delete] · Syslog servers

Example request body:

{
  "request_data": {
    "filters": [
      {
        "field": "name",
        "operator": "EQ",
        "value": "Test PAP"
      }
    ]
  }
}

Test syslog integration

Tests a syslog integration's validity.

You must have View Alert Notification permissions to run this endpoint.

[POST /public_api/v1/integrations/syslog/test] · Syslog servers

Example request body:

{
  "request_data": {
    "syslog_id": "123456789",
    "name": "Test PAPI",
    "address": "34.24.11.16",
    "port": "1234",
    "protocol": "TLS",
    "facility": "FAC_USER",
    "security_info": {
      "certificate_name": "wf-verdict-service.key.pem",
      "ignore_cert_errors": false,
      "certificate_content": "<binary string of the cert>"
    }
  }
}