Agent Configurations
Manage global agent configuration settings for your Cortex Cloud environment.
Returns the current content management settings configured for agents in your organization, including bandwidth control allocation and minor content version update settings. Use this endpoint to view the bandwidth limits configured for content distribution and determine whether minor content updates are enabled for enhanced threat protection.
The API key.
The API key ID.
Successful response containing the current content management configuration.
Current content management configuration settings.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/content_management HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"enable_bandwidth_control": true,
"bandwidth_in_mbps": 100,
"enable_minor_content_version_updates": true
}
}Updates the content management settings for agents in your organization, including bandwidth control allocation and minor content version update settings. Configure the maximum bandwidth allocated for content distribution between 20 and 10000 Mbps to control agent network consumption. You can also enable or disable minor content version updates to control how frequently agents receive incremental threat protection updates between major content releases.
The API key.
The API key ID.
Request payload for updating agent content management settings.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/content_management/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 118
{
"request_data": {
"enable_bandwidth_control": true,
"bandwidth_in_mbps": 100,
"enable_minor_content_version_updates": true
}
}{
"reply": true
}Returns the current agent status configurations for the tenant such as license revocation and deletion settings. This configuration applies to standard endpoints only and does not impact the VDI or Temporary Session agents.
The API key.
The API key ID.
Successful response containing the current agent status configuration.
Current agent status timeout configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/agent_status HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"license_revocation_after_lost_connection": 30,
"agent_deletion_retention": 90
}
}Updates the agent status configuration for the tenant such as license revocation and deletion settings. This configuration applies to standard endpoints only and does not affect the VDI or Temporary Session agents.
The API key.
The API key ID.
Request payload for updating agent status timeout configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/agent_status/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 94
{
"request_data": {
"license_revocation_after_lost_connection": 30,
"agent_deletion_retention": 90
}
}{
"reply": true
}Returns the current agent auto upgrade configuration for the tenant, including the number of parallel upgrades allowed. During the first week of a new agent release rollout, only a single batch of agents is upgraded. After that, auto-upgrades continue to be deployed across your network with the number of parallel upgrades as configured.
The API key.
The API key ID.
Successful response containing the current auto-upgrade configuration.
Current agent auto-upgrade configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/auto_upgrade HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"amount_of_parallel_upgrades": 10
}
}Updates the agent auto upgrade configuration for the tenant. Changes to parallel upgrade limits take effect immediately. During the first week of a new agent release rollout, only a single batch of agents is upgraded. After that, auto-upgrades continue to be deployed across your network with the number of parallel upgrades as configured.
The API key.
The API key ID.
Request payload for updating agent auto-upgrade configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/auto_upgrade/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 51
{
"request_data": {
"amount_of_parallel_upgrades": 10
}
}{
"reply": true
}Returns the current WildFire analysis configuration for the tenant, including whether analysis scoring is enabled for files that received a Benign verdict.
The WildFire analysis score for Benign-verdict files indicates WildFire's confidence level in that verdict. For example, files signed by a trusted signer receive a high-confidence Benign score, while files that showed no suspicious behavior at test time receive a lower-confidence score. When this setting is enabled, Cortex applies additional verification to Benign Low Confidence files using the active Malware Security profile settings.
The API key.
The API key ID.
Successful response containing the current WildFire analysis configuration.
Current WildFire analysis configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/wildfire_analysis HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"enable_wildfire_analysis_scoring_for_benign_verdicts": false
}
}Updates the WildFire analysis configuration for the tenant. When enabled, Cortex applies additional verification to files that received a Benign Low Confidence verdict from WildFire, enforcing the active Malware Security profile settings (local analysis, Allow, or Block).
Note: Disabling this setting takes immediate effect on new file hashes, fresh agent installations, and existing security policies. However, it may take up to one week to take effect on existing agents due to agent-side caching.
The API key.
The API key ID.
Request payload for updating WildFire analysis configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/wildfire_analysis/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 79
{
"request_data": {
"enable_wildfire_analysis_scoring_for_benign_verdicts": false
}
}{
"reply": true
}Returns the current configuration for displaying informative Behavioral Threat Protection (BTP) alert names and descriptions.
When enabled, BTP alerts are shown with unique, descriptive names and descriptions that provide immediate clarity into the detected behavior without requiring drill-down into each alert. This setting only affects new alerts, existing alerts are not retroactively updated.
The API key.
The API key ID.
Successful response containing the current BTP issues configuration.
Current informative BTP issues display configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/informative_btp_issues HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"display_unique_and_informative_btp_rules": true
}
}Updates the configuration for displaying informative Behavioral Threat Protection (BTP) alert names and descriptions. When enabled, new BTP alerts include unique, descriptive names and descriptions for immediate clarity. Existing alerts are not retroactively updated.
Important: Update any existing filters, starring policies, exclusion policies, scoring rules, log forwarding queries, or XSOAR/third-party SIEM automation rules to support the changes before enabling this setting.
The API key.
The API key ID.
Request payload for updating informative BTP issues display configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/informative_btp_issues/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 66
{
"request_data": {
"display_unique_and_informative_btp_rules": true
}
}{
"reply": true
}Returns the current Cortex XDR log collection configuration for the tenant.
The API key.
The API key ID.
Successful response containing the current log collection configuration.
Current Cortex XDR log collection configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/cortex_xdr_log_collection HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"allow_logs_collection": true
}
}Updates the Cortex XDR log collection configuration for the tenant.
The API key.
The API key ID.
Request payload for updating Cortex XDR log collection configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/cortex_xdr_log_collection/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 47
{
"request_data": {
"allow_logs_collection": true
}
}{
"reply": true
}Returns the current action center expiration settings for authorized actions, specifying timeout durations in hours.
The API key.
The API key ID.
Successful response containing the current action center expiration settings.
Current action center expiration settings. Keys represent action types and values represent the current expiration durations in hours.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/action_center_expiration HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"abort_scan": 4,
"agent_admin_token": 4,
"agent_database_cleanup": 4,
"agent_uninstall": 30,
"agent_upgrade": 7,
"delete_quarantine": 4,
"destroy_files": 4,
"files_retrieval": 30,
"file_prevalence": 4,
"host_firewall_activity_report": 4,
"isolate": 30,
"live_terminal": 4,
"memory_collection": 4,
"move_server": 30,
"pause_endpoint_protection": 4,
"process_kill": 4,
"quarantine": 4,
"registry_search": 4,
"remediation": 4,
"restart_agent": 4,
"restore_quarantine": 4,
"resume_endpoint_protection": 4,
"retrieve_endpoint_data": 4,
"retrieve_security_event_data": 4,
"scan": 4,
"scouter_agent_uninstall": 30,
"scouter_agent_upgrade": 7,
"scouter_retrieve_endpoint_data": 4,
"script_execution": 4,
"terminate_causality": 4,
"unblock_ip": 4,
"unisolate": 30
}
}Updates the action center expiration settings for authorized actions. Timeout values are specified in hours.
The API key.
The API key ID.
Request payload for updating action center expiration settings. Specify action types as keys and desired expiration durations in hours as values.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/action_center_expiration/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 41
{
"request_data": {
"isolate": 72,
"scan": 24
}
}{
"reply": true
}Returns the current configuration for critical environment version monitoring.
The API key.
The API key ID.
Successful response containing the current critical environment versions configuration.
Current critical environment versions configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/critical_environment_versions HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"enabled_critical_environment_versions": true
}
}Updates the configuration for critical environment version monitoring.
The API key.
The API key ID.
Request payload for updating critical environment versions configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/critical_environment_versions/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 63
{
"request_data": {
"enabled_critical_environment_versions": true
}
}{
"reply": true
}Returns the current advanced analysis configuration for the tenant, including automatic file upload and exception application settings.
The API key.
The API key ID.
Successful response containing the current advanced analysis configuration.
Current advanced analysis configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/advanced_analysis HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"automatically_upload_defined_issue_data_files": true,
"automatically_apply_advanced_analysis_exceptions": false
}
}Updates the advanced analysis configuration for the tenant. Changes to file upload and exception settings take effect immediately.
The API key.
The API key ID.
Request payload for updating advanced analysis configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/advanced_analysis/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 128
{
"request_data": {
"automatically_upload_defined_issue_data_files": true,
"automatically_apply_advanced_analysis_exceptions": false
}
}{
"reply": true
}Returns the current endpoint administration cleanup configuration, including whether periodic duplicate cleanup is enabled, the matching criteria used to identify duplicates (hostname, IP address, MAC address), and the cleanup frequency. Periodic duplicate cleanup removes redundant endpoint entries from the endpoint administration table, retaining only the most recent record for each endpoint. This is useful when endpoints re-register after hardware changes, preventing stale or conflicting records in the management console.
The API key.
The API key ID.
Successful response containing the current cleanup configuration.
Current endpoint administration cleanup configuration.
Bad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/endpoint_administration_cleanup HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Accept: */*
{
"reply": {
"periodic_duplicate_cleanup": true,
"host_name": true,
"ip": true,
"mac": false,
"time_interval_hours": 24
}
}Updates the endpoint administration cleanup configuration for the tenant. When periodic duplicate cleanup is enabled, the system will remove duplicate endpoint entries from the administration table at the configured frequency, retaining only the most recent record.
Note: Data for a deleted endpoint is retained for 90 days from its last connection. If a deleted endpoint reconnects, its existing data is recovered.
The API key.
The API key ID.
Request payload for updating endpoint administration cleanup configuration.
Successful response indicating the configuration was updated.
Standard success response for configuration update operations.
Indicates whether the operation completed successfully.
trueBad request. The request was malformed or contained invalid parameters.
Unauthorized. Authentication credentials are missing or invalid.
Forbidden. The API key does not have the required permissions.
Internal server error.
POST /public_api/v1/configurations/agent/endpoint_administration_cleanup/set HTTP/1.1
Host: api-yourfqdn
Authorization: YOUR_API_KEY
x-xdr-auth-id: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 116
{
"request_data": {
"periodic_duplicate_cleanup": true,
"host_name": true,
"ip": true,
"mac": false,
"time_interval_hours": 24
}
}{
"reply": true
}Last updated
Was this helpful?