What's new in this release

• API Release Notes for Cortex Cloud

  • Cortex Cloud 2.2
  • Cortex Cloud 2.1
  • Cortex Cloud 2.0

Cortex Cloud 2.2

Product Name	Details
Agent Configurations	No Changes in this release.
Application Security (AppSec)	Paths Added - GET /public_api/appsec/v1/code-to-cloud/coverage: Retrieve the Code-to-Cloud coverage ratio — the percentage of assets with a traceable lineage between code and cloud. Use direction to select which way lineage is traced and type to select the asset kind. - GET /public_api/appsec/v1/package_explorer/packages/{name}/versions/{version}: Retrieve details for a specific package version, including vulnerability counts and where the package is used. - GET /public_api/appsec/v1/application/{applicationId}/assets/addable: List assets that can be added to an application. - GET /public_api/appsec/v1/application/{applicationId}/assets/removable: List assets that can be removed from an application. - POST /public_api/appsec/v1/application/{applicationId}/assets/override: Add or remove assets, overriding the application's asset selection criteria. - GET /public_api/appsec/v1/application/{applicationId}/assets/overrides: List the override actions applied to an application. - DELETE /public_api/appsec/v1/application/{applicationId}/assets/overrides/{actionId}: Revert a single asset override action. Updated Schemas - CreateOrModifyCustomRuleRequestParams: Added category, subCategory, frameworks, cspmRuleId, and clonedFromRuleId. - DetectionRule: Added complianceStandards, cspmRuleId, cspmTypeId, and findingTypeName. - CustomRuleScanner: Added IAC and SECRETS scanner values. - GetRulesResponseObject: Added nextOffset to support offset pagination. Schemas Added - CoveragePublicApiResponse, CodeToCloudDirection, CodeToCloudDashboardType: Code-to-Cloud coverage response and query enums. - PackageExplorerResponse, PackageType, VulnerabilityCounts, UsedInCounts: Package Explorer response types. - ManageableAsset, GetManageableAssetsResponse, AddableAssetFilter, OverrideAssetsRequest, OverrideAssetsResponse, ApplicationAssetOverrideResponse, RevertOverridesResponse, OperationType: Application asset management types. - ComplianceStandard, Control: Compliance metadata attached to detection rules. Schemas Removed - IACSecurity and secretsSecurity were replaced by the CustomRuleScanner enum values.
Asset Compliance	No Changes in this release.
Broker VM	New specs published Broker VM endpoints are now documented in two specs, reflecting the two places a Broker VM is managed from: - Cortex Broker Public API (tenant-side) (broker-papi.yaml): manage brokers from the Cortex tenant. - Cortex Broker Direct Public API (on-appliance) (broker-direct-papi.yaml): configure an individual appliance directly. Paths included (tenant-side) - GET /public_api/v1/brokers/: List brokers. - GET /public_api/v1/brokers/images/: List available broker images. - GET /public_api/v1/brokers/action_status/{action_id}/: Poll the status of an asynchronous broker action. - POST /public_api/v1/brokers/registration_token/: Generate a registration token. - POST /public_api/v1/brokers/{device_id}/: Update broker settings. - POST /public_api/v1/brokers/{device_id}/delete/, /reboot/, /shutdown/, /upgrade/: Lifecycle actions. - GET /public_api/v1/brokers/{device_id}/applets/{applet_name}/, POST .../activate/, .../deactivate/, .../config/: Manage applets. - POST /public_api/v1/brokers/{device_id}/applets/network_mapper/scan_now/: Trigger an on-demand network mapper scan. - POST /public_api/v1/brokers/{device_id}/applets/wec/wef_cert/: Upload a WEF certificate. - POST /public_api/v1/brokers/{device_id}/logs/generate/, GET .../logs/status/, GET .../logs/download/: Generate and retrieve broker logs. Paths included (on-appliance) - POST /public_api/v1/auth/token, POST /public_api/v1/auth/reset-initial-password: Appliance authentication. - POST /public_api/v1/register: Register the appliance with a tenant. - POST /public_api/v1/network/interface, /internal_subnet, /ntp, /proxy, /ssl_certificate, /trusted_ca: Appliance network configuration. - POST /public_api/v1/logs: Retrieve appliance logs.
Cases APIs	Paths Added - POST /public_api/v1/case/timeline/{case-id}/: Retrieve the timeline for a case. - POST /public_api/v1/case/timeline/{case-id}/add_record/: Add a record to a case timeline. Updated Paths - POST /public_api/v1/case/search: Added modification_time as a supported filter and sort field. last_update_time is still accepted for backward compatibility but is deprecated — use modification_time instead. Updated Schemas - Case: Added access_mode, case_team, asset_group_ids, and asset_group_names. - UpdateCase: Added access_mode and case_team. - Asset: Added asset_tags and asset_group_names. - Response wrapper: Corrected to return a reply object rather than the err_code / err_msg / err_extra shape previously documented.
CIEM	Paths Added - GET /public_api/ciem/v1/access/source/{source_uai}: Retrieve the resources a source identity can access. - GET /public_api/ciem/v1/access/destination/{destination_uai}: Retrieve the identities that can access a destination resource. - GET /public_api/ciem/v1/access/granter/{granter_uai}: Retrieve the access conferred by a permission-granting entity. - GET /public_api/ciem/v1/assets/{assetId}/least-privileged-access: Retrieve a least-privilege access recommendation for an asset. Deprecated Paths - POST /public_api/v1/ciem/access/search is deprecated. Use the three GET access endpoints above instead. Note: The deprecated endpoint continues to function for backward compatibility but will not receive further enhancements. Schemas Added - CiemAccessGetRequest, CiemAccessGetResponse, CiemAccessGetEntry, GetFilterObject: Request/response types for the access GET endpoints. - CustomLeastPrivilegedAccessResponseDto, LeastPrivilegedPermissionVerdict, RecommendationSnippetsDto: Least-privilege recommendation types.
Cloud Consumption	New spec published Cortex Platform Cloud Consumption Dashboard REST APIs (cloud-consumption-papi.yaml) report credit consumption and licensing posture. Paths Added - POST /platform/cloud-consumption/v1/details/: Retrieve detailed consumption records. - POST /platform/cloud-consumption/v1/over-time/: Retrieve consumption trends over a time range. - POST /platform/cloud-consumption/v1/per-asset-type/: Retrieve consumption broken down by asset type. - GET /platform/cloud-consumption/v1/license-posture/: Retrieve posture license entitlement and usage. - GET /platform/cloud-consumption/v1/license-runtime/: Retrieve runtime license entitlement and usage. - POST /public_api/v1/system/get_tenant_info/: Retrieve tenant information.
Cloud Onboarding	Updated Schemas - InstanceAdditionalCapabilities: Added upload_files_to_wildfire to control whether scanned files are uploaded to WildFire. - InstanceAuditLogsConfig: Added is_control_tower_byob for AWS Control Tower bring-your-own-bucket audit log collection. - InstanceScopeModifications: Added organizational_units, folders, management_groups, and onboard_only_mode for scoping onboarding across AWS OUs, GCP folders, and Azure management groups. Schemas Added - InstanceOUConfig: Organizational unit configuration for scoped onboarding.
Compliance	Compliance v2 APIs A v2 set of compliance endpoints has been added for managing custom standards, controls, and categories. The existing v1 compliance endpoints are unchanged and remain available. Paths Added — Standards - GET /public_api/v2/compliance/standards, POST /public_api/v2/compliance/standards: List and create standards. - GET /public_api/v2/compliance/standards/{standard_id}, POST /public_api/v2/compliance/standards/{standard_id}, DELETE /public_api/v2/compliance/standards/{standard_id}: Retrieve, update, and delete a standard. - POST /public_api/v2/compliance/standards/{standard_id}/clone: Clone an existing standard. Paths Added — Import and export - POST /public_api/v2/compliance/standards/export, GET /public_api/v2/compliance/standards/export/{job_id}, GET /public_api/v2/compliance/standards/export/{job_id}/download: Start an export job, poll its status, and download the result. - POST /public_api/v2/compliance/standards/import, GET /public_api/v2/compliance/standards/import/{job_id}: Start an import job and poll its status. Paths Added — Controls - GET /public_api/v2/compliance/controls, POST /public_api/v2/compliance/controls: List and create controls. - GET /public_api/v2/compliance/controls/{control_id}, POST /public_api/v2/compliance/controls/{control_id}, DELETE /public_api/v2/compliance/controls/{control_id}: Retrieve, update, and delete a control. - POST /public_api/v2/compliance/controls/bulk, POST /public_api/v2/compliance/controls/bulk-update, POST /public_api/v2/compliance/controls/delete: Bulk create, update, and delete controls. Paths Added — Categories - GET /public_api/v2/compliance/categories, POST /public_api/v2/compliance/categories: List and create categories. - POST /public_api/v2/compliance/categories/{category_id}, DELETE /public_api/v2/compliance/categories/{category_id}: Update and delete a category. Schemas Added - PapiStandardCreate, PapiStandardUpdate, PapiStandardResponse, PapiControlCreate, PapiControlUpdate, PapiControlResponse, PapiCategoryCreate, PapiCategoryUpdate, PapiCategoryResponse, PapiPaginatedResponse, PapiBulkDeleteControls, BulkControlResult, BulkControlResultItem, BulkUpdateControlItem, CloneStandardRequest, CloneStandardResponse, CloneStandardCategoryResponse, CloneStandardSubcategoryResponse, CloneStandardControlResponse, ExportRequest, ExportJobResponse, ExportStatusResponse, ImportJobResponse, ImportStatusResponse, ImportStandardResult.
Cortex Cloud Platform	Paths Added - POST /public_api/v1/tags/agents/create: Create an endpoint tag.
CSPM Policies	No Changes in this release.
CWP	No Changes in this release.
Detection Rules	No Changes in this release.
Forensics	New spec published Cortex Cloud Forensics REST API (forensics-papi.json) supports forensic investigations and evidence collection. Paths Added - POST /public_api/v1/forensics/investigations: Create or retrieve forensic investigations. - POST /public_api/v1/forensics/investigations/collections: Manage collections within an investigation. - POST /public_api/v1/forensics/investigations/collections/get_data: Retrieve collected data. - POST /public_api/v1/forensics/investigations/collections/hunt: Run a hunt across collected data. - POST /public_api/v1/forensics/investigations/collections/triage: Trigger triage collection. - POST /public_api/v1/forensics/investigations/collections/triage/get_files: Retrieve triage files. - POST /public_api/v1/forensics/investigations/collections/triage/host_timeline: Retrieve a host timeline from triage data.
IAM Platform	Updated Paths - GET /platform/iam/v1/role: Clarified the response description; 403 responses now include named examples for insufficient-permissions and Instance Administrator privilege-escalation errors. - PUT /platform/iam/v1/scope/{entity_type}/{entity_id}: Documented that datasets_rows is available only on XSIAM tenants with the feature explicitly enabled — contact your account team to enable it. When enabled, this field is mandatory in every scope edit request; omitting it returns a 400 error. Updated Schemas - DatasetsRowsScope: Clarified that dataset row-level scoping is an XSIAM-only feature. When enabled, this field is required in all scope edit requests.
Issues APIs	Updated Paths - POST /public_api/v1/issue/search: Added include_evidences and include_actions boolean request fields to control whether evidence and action objects are included in search results. Added compliance filter fields: xdm.compliance.standard_id, xdm.compliance.category_id, xdm.compliance.control_id, xdm.policy_id, asset_group_names, and asset_tags. - POST /public_api/v1/issue_exceptions/: Clarified exception creation behavior. Updated Schemas - CreateIssueException: Corrected field definitions for creating issue exceptions.
Managed Services	Spec reorganization The Managed Services (MTH) endpoints moved from managed-threat-detection-papi.yaml to managed-threat-detection-papi.json. Existing operations are unchanged. Paths Added - POST /public_api/v1/mth/child/get_all_reports: Retrieve all reports for a child tenant. - POST /public_api/v1/mth/child/get_reports_by_statuses: Retrieve reports filtered by status. Paths included - POST /public_api/v1/mth/child/add_comment, /get_comments, /get_reports_by_source_id, /get_reports_by_incident_id, /report/update/assign, /report/update/status.
Restore Distributions	New spec published Restore Distributions Public API (restore-distributions-papi.json). Paths Added - POST /public_api/v1/distributions/restore: Restore a previously deleted agent installation package.
Unified Rules	New spec published Unified Rules API (unified-rules-papi.json) lets you manage linked Cloud Security and AppSec rule pairs through a single unified endpoint. Paths Added - GET /public_api/appsec/v1/unified-rules: Returns a paginated list of all unified rule pairs. - POST /public_api/appsec/v1/unified-rules: Creates a linked Cloud Security (CSPM) and AppSec rule pair in a single operation. - GET /public_api/appsec/v1/unified-rules/{ruleId}: Returns the full details of a specific unified rule pair, including both the linked AppSec and Cloud Security (CSPM) rule objects. - PUT /public_api/appsec/v1/unified-rules/{ruleId}: Updates one or both rules in a unified rule pair in a single request. - DELETE /public_api/appsec/v1/unified-rules/{ruleId}: Deletes both the AppSec and Cloud Security rules in a unified rule pair in a single operation.
UVEM	Updated Paths - POST /vulnerability-management/v1/vulnerability-finding/search and POST /vulnerability-management/v1/vulnerability-finding/snapshot: Corrected the documented paths to remove the trailing slash, matching live API behavior. - Documented the CVSS_SEVERITY and EXPLOIT_LEVEL filter values available on vulnerability finding searches. - Clarified the Bring Your Own Scanner (BYOS) import and job status endpoint descriptions. Updated Schemas - FilterTriplet: Renamed field, operator, and value to SEARCH_FIELD, SEARCH_TYPE, and SEARCH_VALUE to match the live API. - FindingsSortObject: Renamed field and keyword to FIELD and ORDER to match the live API.
Vulnerability Intelligence	No Changes in this release.

Cortex Cloud 2.1

Product Name	Details
Agent Configurations	No Changes in this release.
Application Security (AppSec)	Updated Schemas - AppsecPolicyTriggersandActions: Added ciImage and imageRegistry trigger configurations. - ConditionOperators: Added CONTAINS_IN_LIST, JSON_WILDCARD, RANGE, and RELATIVE_TIMESTAMP. - CreateRequest: Added enabled, suggestionId, and userSbac. - FindingType: Updated enum values (e.g., VULNERABILITY, CODE_WEAKNESS). - Integration: Added scanTypes, statusDetails, and tenantId. - Policy: Added overrideIssueSeverity, scopeFields, suggestionHash, and suggestionId. Schemas Added - BillingErrorResponse: Error schema for billing-related endpoints. - ConditionValue: Structured value for range and key-value matching. - EmailOrigin: Enum for user email sources (API, GIT). - IntegrationStatusDetails: Detailed status for data source components. - RepositoryUser: Detailed schema for repository contributors. - Transporter: Configuration for secure communication with private data sources. - UnifiedAction: Consolidated enum for all possible policy actions. Paths Added - GET /public_api/appsec/v1/billing/contributors: Retrieve active contributors for billing. - POST /public_api/appsec/v1/collectors/{collectorId}: Upload 3rd party SARIF findings. Updated Paths - POST /public_api/appsec/v1/policies: Detailed rules for finding types. Deprecated Paths The following Integrations API endpoints are deprecated: - GET /public_api/appsec/v1/integrations - POST /public_api/appsec/v1/integrations - GET /public_api/appsec/v1/integrations/{integrationId} - PUT /public_api/appsec/v1/integrations/{integrationId} - DELETE /public_api/appsec/v1/integrations/{integrationId} Note: The deprecated endpoints will continue to function temporarily for backward compatibility. However, they will not receive further enhancements or updates. A formal sunset date will be announced in a future release. Replacement Paths The Integrations APIs are replaced with the following Data Source Instances API endpoints: - GET /public_api/appsec/v1/data_source_instances - POST /public_api/appsec/v1/data_source_instances - GET /public_api/appsec/v1/data_source_instances/{id} - PUT /public_api/appsec/v1/data_source_instances/{id} - DELETE /public_api/appsec/v1/data_source_instances/{id}
Asset Compliance	No Changes in this release.
CIEM	No Changes in this release.
Cloud Onboarding	Updated Schemas - CreateInstanceTemplateRequestData: Added ALIBABA_CLOUD and gcp_workspace. - EditInstanceRequestData: Added ALIBABA_CLOUD, connector_name, and gcp_workspace. - InstanceAdditionalCapabilities: Added automation, automation_log_level, and kubernetes_security. Schemas Added - AccountItem: Added schema for cloud account items. - EditOutpostRequest: Added schema for outpost edit requests. - EditOutpostRequestData: Added schema for outpost edit request data. - InstanceListItem: Added schema for cloud instance list items. Updated Paths - Terminology shift from "integration instance" to "cloud instance" across all endpoints. - POST /public_api/v1/cloud_onboarding/edit_outpost: Updated request/response schemas.
Compliance	No Changes in this release.
Cortex Cloud Platform	Updated Schemas - ErrorResponse: Standardized error structure. Schemas Added - CreateIssueException: Schema for creating issue exceptions. - IssueException: Full object representation for issue exceptions. - EditPreventionPolicyRequest: Wrapper for prevention policy edit requests. - EditPreventionPolicyRequestData: List of rule edits to apply. - PreventionPolicyEditParameters: Parameters for editing prevention rules. - TargetFilter: Structured condition tree for targeting endpoints. - SearchCondition: Individual filter criteria. - SuccessResponse: Simple boolean success indicator. Paths Added - POST /public_api/v1/issue_exceptions/: Create issue exceptions. - POST /public_api/v1/issue_exceptions/disable/: Disable exceptions. - POST /public_api/v1/issue_exceptions/search/: Search exceptions. - POST /public_api/v1/policies/prevention/edit: Atomic prevention rule edits. Updated Paths - POST /public_api/v1/distributions/create: Added caas_embedded package type. Spec reorganization The Issues, Cases, and Issue Exceptions endpoint groups have been relocated out of the platform spec into dedicated standalone specs (issues-papi.json, cases-papi.json). Operations and contracts are unchanged. See the new "Issues APIs" and "Cases APIs" entries above.
Cases APIs	Standalone spec published Cases endpoints now live in a dedicated standalone spec (cases-papi.json), separated from the platform spec for cleaner navigation. No contract changes — same operations, schemas, and components. Paths included - POST /public_api/v1/case/search: Search and filter cases. - POST /public_api/v1/case/update/{case-id}: Update an existing case. - POST /public_api/v1/case/artifacts/{case-id}/: Retrieve case artifacts. - POST /public_api/v1/case/schema: Retrieve the case field schema. - POST /public_api/v1/entries/get: Retrieve case entries. - POST /public_api/v1/entries/insert: Add an entry to a case or alert War Room. Schema and description alignments - Case: Updated field types, descriptions, and required-field lists to align with current API behavior. - CaseArtifact: Updated to reflect the current artifact structure. - UpdateCase: Updated request schema for case updates.
Issues APIs	Standalone spec published Issues endpoints now live in a dedicated standalone spec (issues-papi.json), separated from the platform spec for cleaner navigation. No contract changes for the relocated endpoints. Paths included - POST /public_api/v1/issue: Create a new issue. - POST /public_api/v1/issue/{issue-id}: Update an existing issue. - POST /public_api/v1/issue/search: Search and filter issues. - POST /public_api/v1/issue/schema/: Retrieve the dynamic issue field schema (trailing slash; aligned with current API behavior). - POST /public_api/v1/issue_exceptions/: Create an issue exception. - POST /public_api/v1/issue_exceptions/disable/: Disable an issue exception. - POST /public_api/v1/issue_exceptions/search/: Search issue exceptions. Schema and description alignments The Issue schema and issue/search response wrapper have been updated to reflect current API behavior: - Issue: Added 11 fields previously missing from the documented schema: action_status, agentic_assistant_id, agentic_response_conversation_id, agentic_response_status, asset_cloud_account_names, asset_external_provider_ids, case_ids, exception_expiration, exception_ids, initial_evidence, is_excepted. - issue/search response wrapper: Renamed total_count → TOTAL_COUNT, result_count → FILTER_COUNT, and issues → DATA to match current API behavior. - issue/schema/ response wrapper: Updated from reply.data to reply.DATA. - IssueSchemaField.data_type example: Expanded to include TEXT, BIGINT, INT, FLOAT, BOOLEAN, TIMESTAMP, ENUM, JSON, COMPLEX, and ARRAY representative values returned by the API.
CSPM Policies	No Changes in this release.
CWP	No Changes in this release.
Detection Rules	No Changes in this release.
IAM Platform	No Changes in this release.
UVEM	Bring Your Own Scanner (BYOS) Import vulnerability findings from external scanners into Cortex vulnerability management. Paths Added - POST /public_api/vulnerability-management/v1/external-scans/assets: Submit assets and CVE findings from a third-party scanner; returns a job_id for async status polling. - GET /public_api/vulnerability-management/v1/external-scans/assets/jobs/{job_id}: Poll the status of a BYOS import job. Schemas Added - VulnerableAssetImportRequest, VulnerableAssetImportResponse, ImportJobResponse.
Vulnerability Intelligence	Updated Schemas - VulnerabilityFinding: Comprehensive schema for CVE/asset records. Schemas Added - FilterBlock: Logical filter block supporting AND/OR connectors. - FilterTriplet: Individual filter condition. - FindingsErrorResponse: Standardized error response. - FindingsSortObject: Sort criteria for findings. - GetVulnerabilityFindingByIdResponse: Response for single finding lookups. - GetVulnerabilityFindingsRequest: Request for paginated searches. - GetVulnerabilityFindingsResponse: Response for paginated searches. - GetVulnerabilityFindingsSnapshotRequest: Parameters for bulk snapshot exports. - TimeframeAbsolute: Absolute time range schema. Paths Added - POST /vulnerability-management/v1/vulnerability-finding/search/: Paginated search. - POST /vulnerability-management/v1/vulnerability-finding/snapshot/: Bulk export (NDJSON). - POST /vulnerability-management/v1/vulnerability-finding/{platform_id}: Get finding by ID.

Cortex Cloud 2.0

Product Name	Details
Application Security	Schemas Added - ApplicationAssetSelectionFilter: Defines filter criteria to dynamically select application assets. - ApplicationAssetSelectionFilterValues: Container for filter values used to match application assets (orgUrl, repositoryId, projectUrl, etc.). - ManualAndRunCriteriaApplicationAssetSelectionFilter: Specific filter for manual and run criteria. - ApplicationMetadataCode: Metadata for code-based assets, including business owner and criticality. - BusinessOwnerMetaData: Enum for business owner types (organizationOwner, projectOwner, etc.). - CodeCriteriaConfig: Configuration for code-based criteria, including unification settings. - CriteriaDTOCode: Detailed data transfer object for code criteria. - IACSecurity: Configuration for Infrastructure as Code (IaC) security scanners. - secretsSecurity: Configuration for secrets security scanners. - CriteriaType.Code: Enum for criteria types. Updated Schemas - ApplicationAssetSelection: Updated description and properties. - ApplicationConfigurationSettings: Added sla (Service Level Agreement) configurations for different severity levels (CRITICAL, HIGH, MEDIUM, LOW). - CreateApplicationRequest: Updated required fields and added detailed descriptions for owners (DevOps, Dev, Product Manager). - DetectionRule: Extensive updates to properties including detectionMethod, frameworks, and scanner. - ExtendedFields: Added unifyAcrossProviders and unifyWithinProvider flags. - FrameworkName: Expanded enum with many new values (e.g., CI_CD_GITHUB_REPO, TERRAFORMPLAN, OPENAPI). Paths Added - None Updated Paths - GET /public_api/appsec/v1/application: Updated descriptions and added mandatory Authorization and x-xdr-auth-id headers. - POST /public_api/appsec/v1/application: Updated descriptions and added mandatory Authorization and x-xdr-auth-id headers.
Cloud Onboarding	Updated Schemas - CreateInstanceTemplateRequestData: Added cloud_partition field (COMMERCIAL/GOV) to request_data. - CreateOutpostTemplateRequestData: Added cloud_partition field (COMMERCIAL/GOV) to request_data. - EditInstanceRequestData: Added cloud_partition field (COMMERCIAL/GOV) to request_data. - ListCloudProviderRegionsRequestData: Added cloud_partition field (COMMERCIAL/GOV) to request_data. - ListCloudProviderRegionsResponse: Changed reply type from object to array and updated its items to include name, value, and type. Schemas Added - None Paths Added - None Updated Paths - POST /public_api/v1/cloud_onboarding/create_instance_template: Updated request body examples to include cloud_partition. - POST /public_api/v1/cloud_onboarding/edit_instance: Updated request body examples to include cloud_partition. - POST /public_api/v1/cloud_onboarding/get_azure_approved_tenants: Added cloud_parition to the request body schema. - POST /public_api/v1/cloud_onboarding/get_instance_details: Updated summary from "Get integration instance details" to "Get cloud instance details" and updated response examples to include cloud_partition. Note: The primary change in this version is the introduction of the cloud_partition parameter across onboarding APIs to support both COMMERCIAL and GOV (government) cloud environments.
Compliance	No Changes in this release.
Cortex Cloud Platform	The following new APIs have been added under Endpoint Management: - POST /public_api/v1/distributions/get_distributions - POST /public_api/v1/endpoints/get_profiles - POST /public_api/v1/legacy_exceptions/get_modules - POST /public_api/v1/legacy_exceptions/fetch - POST /public_api/v1/legacy_exceptions/add - POST /public_api/v1/legacy_exceptions/edit - POST /public_api/v1/legacy_exceptions/delete Updated Paths - POST /public_api/v1/distributions/create: Updated serverless support
Cloud CIEM	No Changes in this release.
Compute(CWP)	The following new APIs have been added: - POST /public_api/v1/cwp/registry_onboarding/instances - GET /public_api/v1/cwp/registry_onboarding/instances/{connectorID} - PUT /public_api/v1/cwp/registry_onboarding/instances/{connectorID} - DELETE /public_api/v1/cwp/registry_onboarding/instances/{connectorID}
Detection Rules Management	The following new APIs have been added: - POST /public_api/v1/rule - POST /public_api/v1/rule/search - GET /public_api/v1/rule/{id} - PATCH /public_api/v1/rule/{id} - DELETE /public_api/v1/rule/{id}
Disable Prevention Rule	The following new APIs have been added: - POST /public_api/v1/disable_prevention/get_modules - POST /public_api/v1/disable_prevention/fetch - POST /public_api/v1/disable_prevention/edit - POST /public_api/v1/disable_prevention/add - POST /public_api/v1/disable_prevention/delete
Disable Injection and Prevention Rules	The following new APIs have been added: - POST /public_api/v1/disable_injection_prevention_rules/fetch - POST /public_api/v1/disable_injection_prevention_rules/add - POST /public_api/v1/disable_injection_prevention_rules/disable
DSPM	No Changes in this release.
IAM Platform	Schemas Added - AssetGroup - AssetsScope - AssetsScopeRequest - CasesIssuesScope - CasesIssuesScopeRequest - DatasetFilter - DatasetsRowsScope - EndpointGroupsScope - EndpointGroupsScopeRequest - EndpointTagsScope - EndpointTagsScopeRequest - EndpointsScope - EndpointsScopeRequest - Role - Tag Updated Schemas - UnauthorizedImproperPermissions: Updated example and properties for the reply object; added data and reply to required fields. - ApiKeyEditRequest: Updated descriptions for comment, roles, and security_level. - RoleCreateRequest: Updated description for request_data. - ScopeEditRequest: Added request_data properties including assets, cases_issues, datasets_rows, endpoints, tagless_scope, and tags_scope. - UserEditRequest: Updated descriptions for is_hidden, phone_number, role_id, status, user_first_name, user_groups, and user_last_name. - UserGroupCreateRequest: Updated descriptions for description, group_name, idp_groups, nested_group_ids, role_id, and users. - UserGroupEditRequest: Updated descriptions for description, group_name, idp_groups, nested_group_ids, role_id, and users. Paths Added - None Updated Paths - /platform/iam/v1/api-key/{api_key_id}: Updated GET response schema and PUT request body description. - /platform/iam/v1/role: Updated GET response schema (now uses Role schema) and POST request body description. - /platform/iam/v1/role/permission-config: Updated GET response schema. - /platform/iam/v1/scope/{entity_type}/{entity_id}: Updated GET response schema and PUT request body description. - /platform/iam/v1/user: Updated GET response schema. - /platform/iam/v1/user-group: Updated GET response schema and POST request body description. - /platform/iam/v1/user-group/{group_id}: Updated GET response schema and PUT request body description.
Managed Services	The following new APIs have been added: - POST /public_api/v1/mth/child/add_comment - POST /public_api/v1/mth/child/get_comments - POST /public_api/v1/mth/child/report/update/assign - POST /public_api/v1/mth/child/get_reports_by_source_id - POST /public_api/v1/mth/child/get_reports_by_incident_id
Platform External Application	The following new APIs have been added: - GET /platform/integration/v1/external-application - GET /platform/integration/v1/external-application/{application_id} - DELETE /platform/integration/v1/external-application/{application_type}/id/{application_id}
Platform Notifications	The following new APIs have been added: - GET /platform/notifications/v1/list-rules - POST /platform/notifications/v1/rule - GET /platform/notifications/v1/rule/{rule_uuid} - PUT /platform/notifications/v1/update-rule-status/{rule_uuid}
Trusted Images	No Changes in this release.
UVEM	Schemas Added - ScanRequest: Request model for triggering a vulnerability scan. - ScanResponse: Response model for scan trigger operation. - ScannerType: Enum for vulnerability scanner types (CORTEX_NETWORK_SCANNER, CORTEX_XDR_AGENT, CORTEX_XDR_AGENTLESS). Updated Schemas - CreatePolicy: Refined property definitions for policy_type, severity, and status using allOf. - Filter-Input: Refined paging property definition using allOf. - PolicyView: Refined POLICY_TYPE and SEVERITY property definitions using allOf. Paths Added - POST /public_api/vulnerability-management/v1/scan Updated Paths - /public_api/uvm_public/v1/create_policy: Added description to requestBody. - /public_api/uvm_public/v1/list_policies: Added description to requestBody. - /public_api/uvm_public/v1/update_policy/{id}: Added description to requestBody.
Vulnerability	No Changes in this release.