Script Execution
APIs executing script
Initiate a new endpoint script execution action using provided snippet code. Cortex XDR supports sending your request in Base64.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/run_snippet_code_script HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 132
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<endpoint ID>"
]
}
],
"snippet_code": "print (\"7\")"
}
}{
"reply": {
"action_id": "<action ID>",
"endpoints_count": 21
}
}Initiate a new endpoint script execution action using a script from the script library. The script can be run on up to 1000 endpoints.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/run_script HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 209
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<endpoint ID>"
]
}
],
"script_uid": "<unique ID>",
"parameters_values": {
"x": "param input as returned in Get Script Metadata",
"y": 4
}
}
}{
"reply": {
"action_id": 22519813685366,
"status": 1,
"endpoints_count": 1
}
}Get the full definitions of a specific script in the scripts library.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/get_script_metadata HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"request_data": {
"script_uid": "<unique ID>"
}
}{
"reply": {
"script_id": "<script ID>",
"name": "list_directories",
"description": "List all directories under path",
"modification_date": 1585074627259,
"created_by": "Palo Alto Networks",
"is_high_risk": false,
"windows_supported": true,
"linux_supported": true,
"macos_supported": true,
"script_uid": "<unique ID>",
"entry_point": "run",
"script_input": [
{
"name": "path",
"type": "string"
},
{
"friendly_name": "Number of levels",
"name": "num_levels",
"type": "integer"
}
],
"script_output_type": "dictionary",
"script_output_dictionary_definitions": [
{
"friendly_name": "Number Of Processes",
"name": "output_2",
"type": "integer"
},
{
"friendly_name": "Name",
"name": "output_1",
"type": "string"
}
]
}
}Retrieve the status of a script execution action.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/get_script_execution_status HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 44
{
"request_data": {
"action_id": "<action ID>"
}
}{
"reply": {
"general_status": "PENDING",
"endpoints_pending": 1,
"endpoints_canceled": 0,
"endpoints_in_progress": 0,
"endpoints_timeout": 0,
"endpoints_failed": 0,
"endpoints_completed_successfully": 0,
"endpoints_pending_abort": 0,
"endpoints_aborted": 0,
"endpoints_expired": 0
}
}Get a list of scripts available in the scripts library.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/get_scripts HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"total_count": 129,
"result_count": 24,
"scripts": [
{
"script_id": "<script ID>",
"name": "list_directories",
"description": "List all directories under path",
"modification_date": 1585074627259,
"created_by": "Palo Alto Networks",
"is_high_risk": false,
"windows_supported": true,
"linux_supported": true,
"macos_supported": true,
"script_uid": "<unique ID>"
},
{
"script_id": "<script ID>",
"name": "test 1",
"description": "test",
"modification_date": 1583052236449,
"created_by": "User 1",
"is_high_risk": false,
"windows_supported": true,
"linux_supported": false,
"macos_supported": false,
"script_uid": "<unique ID>"
},
{
"script_id": "<script ID>",
"name": "test 2",
"description": "test 2",
"modification_date": 1582709343498,
"created_by": "User 2",
"is_high_risk": false,
"windows_supported": true,
"linux_supported": true,
"macos_supported": true,
"script_uid": "<unique ID>"
}
]
}
}Retrieve the results of a script execution action.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/get_script_execution_results HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 44
{
"request_data": {
"action_id": "<action_id>"
}
}{
"reply": {
"script_name": "snippet script",
"script_description": "",
"script_parameters": [],
"date_created": "2020-03-29 13:21:59",
"scope": "win_10and 21 other endpoints",
"error_message": "",
"results": [
{
"endpoint_name": "<name>",
"endpoint_ip_address": [
"<IP address>"
],
"endpoint_status": "LOST",
"domain": "aaaa",
"endpoint_id": "<endpoint ID>",
"execution_status": "PENDING",
"standard_output": null,
"retrieved_files": 0,
"failed_files": 0,
"retention_date": null
},
{
"endpoint_name": "<name>",
"endpoint_ip_address": [
"<IP address>"
],
"endpoint_status": "LOST",
"domain": "<domain name>",
"endpoint_id": "<endpoint ID>",
"execution_status": "PENDING",
"standard_output": null,
"retrieved_files": 0,
"failed_files": 0,
"retention_date": null
},
{
"endpoint_name": "<name>",
"endpoint_ip_address": [
"<IP address>"
],
"endpoint_status": "DISCONNECTED",
"domain": "WORKGROUP",
"endpoint_id": "<endpoint ID>",
"execution_status": "PENDING",
"standard_output": null,
"retrieved_files": 0,
"failed_files": 0,
"retention_date": null
}
]
}
}Get the files retrieved from a specific endpoint during a script execution.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/get_script_execution_results_files HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 58
{
"request_data": {
"action_id": "text",
"endpoint_id": "text"
}
}{
"reply": {
"DATA": "https://example-link"
}
}Get the code of a specific script in the script library.
Required license: Cortex AgentiX Enterprise or Cortex AgentiX Base
{api_key}
{api_key_id}
Successful response
JSON object containing the query result.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/scripts/get_script_code HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"request_data": {
"script_uid": "<unique ID>"
}
}{
"reply": "import os\nimport sys\nimport traceback\n\n\ndef run(path, num_levels):\n\tpath = os.path.expanduser(path)\n\tpath = os.path.expandvars(path)\n\treturn scan_directory_recursive(path, num_levels)\n\n\ndef scan_directory_recursive(directory, level):\n\tif level == 0:\n\t\treturn []\n\n\tsubfolders = []\n\ttry:\n\t\twith os.scandir(directory) as entries:\n\t\t\tfor f in entries:\n\t\t\t\ttry:\n\t\t\t\t\tif f.is_dir():\n\t\t\t\t\t\tsubfolders.append(f.path)\n\t\t\t\texcept (OSError,PermissionError):\n\t\t\t\t\tsys.stderr.write(f\"Failed access <{f.path}>\\n\")\n\n\t\tfor folder in list(subfolders):\n\t\t subfolders.extend(scan_directory_recursive(folder, level-1))\n\texcept Exception:\n\t\tsys.stderr.write(f\"Failed scanning directory: <{directory}>, error: {traceback.format_exc()}\")\n\n\treturn subfolders\n"
}Last updated
Was this helpful?