> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/agent-configuration-settings/agent-configurations.md).
# Agent Configurations
Manage global agent configuration settings for your Cortex Cloud environment.
## Retrieve content management settings
> Returns the current content management settings configured for agents in your organization, including bandwidth control allocation and minor content version update settings. Use this endpoint to view the bandwidth limits configured for content distribution and determine whether minor content updates are enabled for enhanced threat protection.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"ContentManagementResponse":{"type":"object","description":"Current content management configuration settings.","properties":{"reply":{"type":"object","properties":{"enable_bandwidth_control":{"type":"boolean","description":"Indicates whether bandwidth control is currently enabled for agent network consumption during content updates and package downloads."},"bandwidth_in_mbps":{"type":"integer","description":"The current maximum bandwidth in Mbps allocated for content downloads."},"enable_minor_content_version_updates":{"type":"boolean","description":"Indicates whether automatic minor content updates between major content releases are enabled."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/content_management":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve content management settings","description":"Returns the current content management settings configured for agents in your organization, including bandwidth control allocation and minor content version update settings. Use this endpoint to view the bandwidth limits configured for content distribution and determine whether minor content updates are enabled for enhanced threat protection.","operationId":"getContentManagement","responses":{"200":{"description":"Successful response containing the current content management configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ContentManagementResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update content management settings
> Updates the content management settings for agents in your organization, including bandwidth control allocation and minor content version update settings. Configure the maximum bandwidth allocated for content distribution between 20 and 10000 Mbps to control agent network consumption. You can also enable or disable minor content version updates to control how frequently agents receive incremental threat protection updates between major content releases.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetContentManagementRequest":{"type":"object","description":"Request payload for updating agent content management settings.","properties":{"request_data":{"type":"object","required":["enable_bandwidth_control","bandwidth_in_mbps"],"properties":{"enable_bandwidth_control":{"type":"boolean","description":"Enables bandwidth control for the agent network consumption during content updates and package downloads."},"bandwidth_in_mbps":{"type":"integer","minimum":20,"maximum":10000,"description":"Defines the maximum bandwidth allocated for agent content downloads in megabits per second (Mbps). Must be between 20 and 10000 Mbps."},"enable_minor_content_version_updates":{"type":"boolean","default":true,"description":"Enables delivery of minor content updates between major content releases. When `true`, the agents receive more frequent content updates to improve their ability to protect against emerging threats. When `false`, agents receive updates only during major content releases."}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/content_management/set":{"post":{"tags":["Agent Configurations"],"summary":"Update content management settings","description":"Updates the content management settings for agents in your organization, including bandwidth control allocation and minor content version update settings. Configure the maximum bandwidth allocated for content distribution between 20 and 10000 Mbps to control agent network consumption. You can also enable or disable minor content version updates to control how frequently agents receive incremental threat protection updates between major content releases.","operationId":"setContentManagement","requestBody":{"required":true,"description":"Content management configuration settings to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetContentManagementRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve agent status configurations
> Returns the current agent status configurations for the tenant such as license revocation and deletion settings. This configuration applies to standard endpoints only and does not impact the VDI or Temporary Session agents.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"AgentStatusResponse":{"type":"object","description":"Current agent status timeout configuration.","properties":{"reply":{"type":"object","properties":{"license_revocation_after_lost_connection":{"type":"integer","description":"Indicates the current number of days after which the license is revoked when an agent loses connection to Cortex."},"agent_deletion_retention":{"type":"integer","description":"Indicates the number of days to retain agent data before deletion from the Cortex database after loss of connection."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/agent_status":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve agent status configurations","description":"Returns the current agent status configurations for the tenant such as license revocation and deletion settings. This configuration applies to standard endpoints only and does not impact the VDI or Temporary Session agents.","operationId":"getAgentStatus","responses":{"200":{"description":"Successful response containing the current agent status configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentStatusResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update the Agent license revocation and deletion period.
> Updates the agent status configuration for the tenant such as license revocation and deletion settings. This configuration applies to standard endpoints only and does not affect the VDI or Temporary Session agents.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetAgentStatusRequest":{"type":"object","description":"Request payload for updating agent status timeout configuration.","properties":{"request_data":{"type":"object","required":["license_revocation_after_lost_connection","agent_deletion_retention"],"properties":{"license_revocation_after_lost_connection":{"type":"integer","minimum":2,"maximum":60,"description":"Number of days after which the license is revoked when an agent loses connection to Cortex. Day one is counted as the first 24 hours with no connection.","default":30},"agent_deletion_retention":{"type":"integer","minimum":3,"maximum":360,"description":"Number of days to retain agent data before deletion from the Cortex database after loss of connection. Ensure that this value is greater than the `license_revocation_after_lost_connection` period. Day one is counted as the first 24 hours with no connection.","default":180}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/agent_status/set":{"post":{"tags":["Agent Configurations"],"summary":"Update the Agent license revocation and deletion period.","description":"Updates the agent status configuration for the tenant such as license revocation and deletion settings. This configuration applies to standard endpoints only and does not affect the VDI or Temporary Session agents.","operationId":"setAgentStatus","requestBody":{"required":true,"description":"Agent status timeout configuration settings to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetAgentStatusRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve agent auto-upgrade settings
> Returns the current agent auto upgrade configuration for the tenant, including the number of parallel upgrades allowed. During the first week of a new agent release rollout, only a single batch of agents is upgraded. After that, auto-upgrades continue to be deployed across your network with the number of parallel upgrades as configured.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"AgentAutoUpgradeResponse":{"type":"object","description":"Current agent auto-upgrade configuration.","properties":{"reply":{"type":"object","properties":{"amount_of_parallel_upgrades":{"type":"integer","description":"The current maximum number of agents that can be upgraded simultaneously."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/auto_upgrade":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve agent auto-upgrade settings","description":"Returns the current agent auto upgrade configuration for the tenant, including the number of parallel upgrades allowed. During the first week of a new agent release rollout, only a single batch of agents is upgraded. After that, auto-upgrades continue to be deployed across your network with the number of parallel upgrades as configured.","operationId":"getAgentAutoUpgrade","responses":{"200":{"description":"Successful response containing the current auto-upgrade configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAutoUpgradeResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update agent auto-upgrade settings
> Updates the agent auto upgrade configuration for the tenant. Changes to parallel upgrade limits take effect immediately. During the first week of a new agent release rollout, only a single batch of agents is upgraded. After that, auto-upgrades continue to be deployed across your network with the number of parallel upgrades as configured.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetAgentAutoUpgradeRequest":{"type":"object","description":"Request payload for updating agent auto-upgrade configuration.","properties":{"request_data":{"type":"object","required":["amount_of_parallel_upgrades"],"properties":{"amount_of_parallel_upgrades":{"type":"integer","minimum":1,"maximum":2000,"description":"Specify the desired maximum number of agents to upgrade simultaneously."}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/auto_upgrade/set":{"post":{"tags":["Agent Configurations"],"summary":"Update agent auto-upgrade settings","description":"Updates the agent auto upgrade configuration for the tenant. Changes to parallel upgrade limits take effect immediately. During the first week of a new agent release rollout, only a single batch of agents is upgraded. After that, auto-upgrades continue to be deployed across your network with the number of parallel upgrades as configured.","operationId":"setAgentAutoUpgrade","requestBody":{"required":true,"description":"Agent auto upgrade configuration settings to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetAgentAutoUpgradeRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve WildFire analysis settings
> Returns the current WildFire analysis configuration for the tenant, including whether analysis scoring is enabled for files that received a Benign verdict.\
> \
> The WildFire analysis score for Benign-verdict files indicates WildFire's confidence level in that verdict. For example, files signed by a trusted signer receive a high-confidence Benign score, while files that showed no suspicious behavior at test time receive a lower-confidence score. When this setting is enabled, Cortex applies additional verification to Benign Low Confidence files using the active Malware Security profile settings.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"WildfireAnalysisResponse":{"type":"object","description":"Current WildFire analysis configuration.","properties":{"reply":{"type":"object","properties":{"enable_wildfire_analysis_scoring_for_benign_verdicts":{"type":"boolean","description":"Indicates whether WildFire analysis scoring is currently applied to files that received a benign verdict."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/wildfire_analysis":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve WildFire analysis settings","description":"Returns the current WildFire analysis configuration for the tenant, including whether analysis scoring is enabled for files that received a Benign verdict.\n\nThe WildFire analysis score for Benign-verdict files indicates WildFire's confidence level in that verdict. For example, files signed by a trusted signer receive a high-confidence Benign score, while files that showed no suspicious behavior at test time receive a lower-confidence score. When this setting is enabled, Cortex applies additional verification to Benign Low Confidence files using the active Malware Security profile settings.\n","operationId":"getWildfireAnalysis","responses":{"200":{"description":"Successful response containing the current WildFire analysis configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WildfireAnalysisResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update WildFire analysis settings
> Updates the WildFire analysis configuration for the tenant. When enabled, Cortex applies additional verification to files that received a Benign Low Confidence verdict from WildFire, enforcing the active Malware Security profile settings (local analysis, Allow, or Block).\
> \
> \*\*Note:\*\* Disabling this setting takes immediate effect on new file hashes, fresh agent installations, and existing security policies. However, it may take up to one week to take effect on existing agents due to agent-side caching.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetWildfireAnalysisRequest":{"type":"object","description":"Request payload for updating WildFire analysis configuration.","properties":{"request_data":{"type":"object","required":["enable_wildfire_analysis_scoring_for_benign_verdicts"],"properties":{"enable_wildfire_analysis_scoring_for_benign_verdicts":{"type":"boolean","description":"Set to `true` to enable WildFire analysis scoring for files that received a benign verdict."}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/wildfire_analysis/set":{"post":{"tags":["Agent Configurations"],"summary":"Update WildFire analysis settings","description":"Updates the WildFire analysis configuration for the tenant. When enabled, Cortex applies additional verification to files that received a Benign Low Confidence verdict from WildFire, enforcing the active Malware Security profile settings (local analysis, Allow, or Block).\n\n**Note:** Disabling this setting takes immediate effect on new file hashes, fresh agent installations, and existing security policies. However, it may take up to one week to take effect on existing agents due to agent-side caching.\n","operationId":"setWildfireAnalysis","requestBody":{"required":true,"description":"WildFire analysis configuration settings to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetWildfireAnalysisRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve informative BTP issues settings
> Returns the current configuration for displaying informative Behavioral Threat Protection (BTP) alert names and descriptions.\
> \
> When enabled, BTP alerts are shown with unique, descriptive names and descriptions that provide immediate clarity into the detected behavior without requiring drill-down into each alert. This setting only affects new alerts, existing alerts are not retroactively updated.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"InformativeBTPIssuesResponse":{"type":"object","description":"Current informative BTP issues display configuration.","properties":{"reply":{"type":"object","properties":{"display_unique_and_informative_btp_rules":{"type":"boolean","description":"Indicates whether unique and informative Behavioral Threat Protection (BTP) rules are currently displayed in the console."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/informative_btp_issues":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve informative BTP issues settings","description":"Returns the current configuration for displaying informative Behavioral Threat Protection (BTP) alert names and descriptions.\n\nWhen enabled, BTP alerts are shown with unique, descriptive names and descriptions that provide immediate clarity into the detected behavior without requiring drill-down into each alert. This setting only affects new alerts, existing alerts are not retroactively updated.\n","operationId":"getInformativeBTPIssues","responses":{"200":{"description":"Successful response containing the current BTP issues configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InformativeBTPIssuesResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update informative BTP issues settings
> Updates the configuration for displaying informative Behavioral Threat Protection (BTP) alert names and descriptions. When enabled, new BTP alerts include unique, descriptive names and descriptions for immediate clarity. Existing alerts are not retroactively updated.\
> \
> \*\*Important:\*\* Update any existing filters, starring policies, exclusion policies, scoring rules, log forwarding queries, or XSOAR/third-party SIEM automation rules to support the changes before enabling this setting.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetInformativeBTPIssuesRequest":{"type":"object","description":"Request payload for updating informative BTP issues display configuration.","properties":{"request_data":{"type":"object","required":["display_unique_and_informative_btp_rules"],"properties":{"display_unique_and_informative_btp_rules":{"type":"boolean","description":"Set to `true` to display unique and informative Behavioral Threat Protection (BTP) rules in the console."}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/informative_btp_issues/set":{"post":{"tags":["Agent Configurations"],"summary":"Update informative BTP issues settings","description":"Updates the configuration for displaying informative Behavioral Threat Protection (BTP) alert names and descriptions. When enabled, new BTP alerts include unique, descriptive names and descriptions for immediate clarity. Existing alerts are not retroactively updated.\n\n**Important:** Update any existing filters, starring policies, exclusion policies, scoring rules, log forwarding queries, or XSOAR/third-party SIEM automation rules to support the changes before enabling this setting.\n","operationId":"setInformativeBTPIssues","requestBody":{"required":true,"description":"Informative BTP issues display configuration to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetInformativeBTPIssuesRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve log collection settings
> Returns the current Cortex XDR log collection configuration for the tenant.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"LogCollectionResponse":{"type":"object","description":"Current Cortex XDR log collection configuration.","properties":{"reply":{"type":"object","properties":{"allow_logs_collection":{"type":"boolean","description":"Indicates whether agents are currently allowed to collect and send diagnostic logs."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/cortex_xdr_log_collection":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve log collection settings","description":"Returns the current Cortex XDR log collection configuration for the tenant.","operationId":"getCortexXDRLogCollection","responses":{"200":{"description":"Successful response containing the current log collection configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/LogCollectionResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update log collection settings
> Updates the Cortex XDR log collection configuration for the tenant.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetLogCollectionRequest":{"type":"object","description":"Request payload for updating Cortex XDR log collection configuration.","properties":{"request_data":{"type":"object","required":["allow_logs_collection"],"properties":{"allow_logs_collection":{"type":"boolean","description":"Set to `true` to allow agents to collect and send diagnostic logs."}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/cortex_xdr_log_collection/set":{"post":{"tags":["Agent Configurations"],"summary":"Update log collection settings","description":"Updates the Cortex XDR log collection configuration for the tenant. ","operationId":"setCortexXDRLogCollection","requestBody":{"required":true,"description":"Cortex XDR log collection configuration settings to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetLogCollectionRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve action center expiration settings
> Returns the current action center expiration settings for authorized actions, specifying timeout durations in hours.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"ActionCenterExpirationResponse":{"type":"object","description":"Current action center expiration settings. Keys represent action types and values represent the current expiration durations in hours.","properties":{"reply":{"type":"object","additionalProperties":{"type":"integer","description":"The current expiration duration in hours for the specified action type."}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/action_center_expiration":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve action center expiration settings","description":"Returns the current action center expiration settings for authorized actions, specifying timeout durations in hours.","operationId":"getActionCenterExpiration","responses":{"200":{"description":"Successful response containing the current action center expiration settings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ActionCenterExpirationResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update action center expiration settings
> Updates the action center expiration settings for authorized actions. Timeout values are specified in hours.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetActionCenterExpirationRequest":{"type":"object","description":"Request payload for updating action center expiration settings. Specify action types as keys and desired expiration durations in hours as values.","properties":{"request_data":{"type":"object","additionalProperties":{"type":"integer","description":"Specify the desired expiration duration in hours for the action type."}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/action_center_expiration/set":{"post":{"tags":["Agent Configurations"],"summary":"Update action center expiration settings","description":"Updates the action center expiration settings for authorized actions. Timeout values are specified in hours. ","operationId":"setActionCenterExpiration","requestBody":{"required":true,"description":"Action center expiration settings to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetActionCenterExpirationRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve critical environment versions settings
> Returns the current configuration for critical environment version monitoring.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"CriticalEnvironmentVersionsResponse":{"type":"object","description":"Current critical environment versions configuration.","properties":{"reply":{"type":"object","properties":{"enabled_critical_environment_versions":{"type":"boolean","description":"Indicates whether version enforcement is currently enabled for agents in critical environments."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/critical_environment_versions":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve critical environment versions settings","description":"Returns the current configuration for critical environment version monitoring.","operationId":"getCriticalEnvironmentVersions","responses":{"200":{"description":"Successful response containing the current critical environment versions configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CriticalEnvironmentVersionsResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update critical environment versions settings
> Updates the configuration for critical environment version monitoring.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetCriticalEnvironmentVersionsRequest":{"type":"object","description":"Request payload for updating critical environment versions configuration.","properties":{"request_data":{"type":"object","required":["enabled_critical_environment_versions"],"properties":{"enabled_critical_environment_versions":{"type":"boolean","description":"Set to `true` to enable version enforcement for agents in critical environments."}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/critical_environment_versions/set":{"post":{"tags":["Agent Configurations"],"summary":"Update critical environment versions settings","description":"Updates the configuration for critical environment version monitoring. ","operationId":"setCriticalEnvironmentVersions","requestBody":{"required":true,"description":"Critical environment versions configuration to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetCriticalEnvironmentVersionsRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve advanced analysis settings
> Returns the current advanced analysis configuration for the tenant, including automatic file upload and exception application settings.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"AdvancedAnalysisResponse":{"type":"object","description":"Current advanced analysis configuration.","properties":{"reply":{"type":"object","properties":{"automatically_upload_defined_issue_data_files":{"type":"boolean","description":"Indicates whether defined issue data files are currently uploaded automatically for analysis."},"automatically_apply_advanced_analysis_exceptions":{"type":"boolean","description":"Indicates whether advanced analysis exceptions are currently applied automatically."}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/advanced_analysis":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve advanced analysis settings","description":"Returns the current advanced analysis configuration for the tenant, including automatic file upload and exception application settings.","operationId":"getAdvancedAnalysis","responses":{"200":{"description":"Successful response containing the current advanced analysis configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AdvancedAnalysisResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update advanced analysis settings
> Updates the advanced analysis configuration for the tenant. Changes to file upload and exception settings take effect immediately.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetAdvancedAnalysisRequest":{"type":"object","description":"Request payload for updating advanced analysis configuration.","properties":{"request_data":{"type":"object","required":["automatically_upload_defined_issue_data_files","automatically_apply_advanced_analysis_exceptions"],"properties":{"automatically_upload_defined_issue_data_files":{"type":"boolean","description":"Set to `true` to automatically upload defined issue data files for analysis."},"automatically_apply_advanced_analysis_exceptions":{"type":"boolean","description":"Set to `true` to automatically apply advanced analysis exceptions."}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/advanced_analysis/set":{"post":{"tags":["Agent Configurations"],"summary":"Update advanced analysis settings","description":"Updates the advanced analysis configuration for the tenant. Changes to file upload and exception settings take effect immediately.","operationId":"setAdvancedAnalysis","requestBody":{"required":true,"description":"Advanced analysis configuration settings to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetAdvancedAnalysisRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Retrieve endpoint administration cleanup settings
> Returns the current endpoint administration cleanup configuration, including whether periodic duplicate cleanup is enabled, the matching criteria used to identify duplicates (hostname, IP address, MAC address), and the cleanup frequency. Periodic duplicate cleanup removes redundant endpoint entries from the endpoint administration table, retaining only the most recent record for each endpoint. This is useful when endpoints re-register after hardware changes, preventing stale or conflicting records in the management console.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"EndpointAdministrationCleanupResponse":{"type":"object","description":"Current endpoint administration cleanup configuration.","properties":{"reply":{"type":"object","properties":{"periodic_duplicate_cleanup":{"type":"boolean","description":"Indicates whether periodic cleanup of duplicate endpoints is currently enabled."},"host_name":{"type":"boolean","nullable":true,"description":"Indicates whether hostname is currently used as a criterion for identifying duplicate endpoints. Null when periodic cleanup is disabled."},"ip":{"type":"boolean","nullable":true,"description":"Indicates whether IP address is currently used as a criterion for identifying duplicate endpoints. Null when periodic cleanup is disabled."},"mac":{"type":"boolean","nullable":true,"description":"Indicates whether MAC address is currently used as a criterion for identifying duplicate endpoints. Null when periodic cleanup is disabled."},"time_interval_hours":{"type":"integer","enum":[1,6,24,168],"nullable":true,"description":"The current time interval in hours between cleanup runs. Null when periodic cleanup is disabled.\nValid values: `1` (hourly), `6` (every 6 hours), `24` (daily), `168` (weekly).\n"}}}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/endpoint_administration_cleanup":{"post":{"tags":["Agent Configurations"],"summary":"Retrieve endpoint administration cleanup settings","description":"Returns the current endpoint administration cleanup configuration, including whether periodic duplicate cleanup is enabled, the matching criteria used to identify duplicates (hostname, IP address, MAC address), and the cleanup frequency. Periodic duplicate cleanup removes redundant endpoint entries from the endpoint administration table, retaining only the most recent record for each endpoint. This is useful when endpoints re-register after hardware changes, preventing stale or conflicting records in the management console.","operationId":"getEndpointAdministrationCleanup","responses":{"200":{"description":"Successful response containing the current cleanup configuration.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EndpointAdministrationCleanupResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
## Update endpoint administration cleanup settings
> Updates the endpoint administration cleanup configuration for the tenant. When periodic duplicate cleanup is enabled, the system will remove duplicate endpoint entries from the administration table at the configured frequency, retaining only the most recent record.\
> \
> \*\*Note:\*\* Data for a deleted endpoint is retained for 90 days from its last connection. If a deleted endpoint reconnects, its existing data is recovered.
```json
{"openapi":"3.0.3","info":{"title":"Agent Configuration Settings API","version":"1.0.0"},"tags":[{"name":"Agent Configurations","description":"Manage global agent configuration settings for your Cortex Cloud environment."}],"servers":[{"url":"https://api-yourfqdn"}],"security":[{"api-key-header-x-xdr-auth-id":[],"api-key-header-authorization":[]}],"components":{"securitySchemes":{"api-key-header-x-xdr-auth-id":{"type":"apiKey","name":"x-xdr-auth-id","in":"header","description":"The API key ID."}},"schemas":{"SetEndpointAdministrationCleanupRequest":{"type":"object","description":"Request payload for updating endpoint administration cleanup configuration.","properties":{"request_data":{"type":"object","required":["periodic_duplicate_cleanup"],"properties":{"periodic_duplicate_cleanup":{"type":"boolean","description":"Set to `true` to enable periodic cleanup of duplicate endpoints."},"host_name":{"type":"boolean","nullable":true,"description":"Set to `true` to use hostname as a criterion for identifying duplicate endpoints. Set to null to ignore this criterion."},"ip":{"type":"boolean","nullable":true,"description":"Set to `true` to use IP address as a criterion for identifying duplicate endpoints. Set to null to ignore this criterion."},"mac":{"type":"boolean","nullable":true,"description":"Set to `true` to use MAC address as a criterion for identifying duplicate endpoints. Set to null to ignore this criterion."},"time_interval_hours":{"type":"integer","enum":[1,6,24,168],"nullable":true,"description":"Specify the desired time interval in hours between cleanup runs. Set to null when disabling periodic cleanup.\nValid values: `1` (hourly), `6` (every 6 hours), `24` (daily), `168` (weekly).\n"}}}}},"BaseResponse":{"type":"object","description":"Standard success response for configuration update operations.","properties":{"reply":{"type":"boolean","description":"Indicates whether the operation completed successfully."}}},"ErrorResponse":{"type":"object","description":"Standard error response returned when a request fails.","properties":{"reply":{"type":"object","description":"Error details container.","properties":{"err_code":{"type":"integer","description":"Numeric error code identifying the type of error."},"err_msg":{"type":"string","description":"Human-readable error message describing what went wrong."},"err_extra":{"type":"string","description":"Additional context about the error, if available."}}}}}}},"paths":{"/public_api/v1/configurations/agent/endpoint_administration_cleanup/set":{"post":{"tags":["Agent Configurations"],"summary":"Update endpoint administration cleanup settings","description":"Updates the endpoint administration cleanup configuration for the tenant. When periodic duplicate cleanup is enabled, the system will remove duplicate endpoint entries from the administration table at the configured frequency, retaining only the most recent record.\n\n**Note:** Data for a deleted endpoint is retained for 90 days from its last connection. If a deleted endpoint reconnects, its existing data is recovered.\n","operationId":"setEndpointAdministrationCleanup","requestBody":{"required":true,"description":"Endpoint administration cleanup configuration to update.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SetEndpointAdministrationCleanupRequest"}}}},"responses":{"200":{"description":"Successful response indicating the configuration was updated.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/BaseResponse"}}}},"400":{"description":"Bad request. The request was malformed or contained invalid parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized. Authentication credentials are missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"403":{"description":"Forbidden. The API key does not have the required permissions.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal server error.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/agent-configuration-settings/agent-configurations.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.