scripts_run_script
Run a script from the library on up to 1000 endpoints by providing endpoint IDs and script parameters. Execute actions across multiple endpoints for security investigation or remediation.
Instructions
Run Script
Initiate a new endpoint script execution action using a script from the script library. The script can be run on up to 1000 endpoints.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/scripts/run_script] · Script execution
Example request body:
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<endpoint ID>"
]
}
],
"script_uid": "<unique ID>",
"parameters_values": {
"x": "param input as returned in Get Script Metadata",
"y": 4
}
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes | A dictionary containing the API request fields. |