Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Scan Management

APIs for managing scans

Get unscanned AppSec scan management repositories

get

Get a list of Application Security repositories that have not been scanned. You can optionally filter by specifying the number of days past during which the repositories were not scanned.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters
daysnumber · doubleOptional

Define the time period in days previous to now

Default: 7
Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Responses
200

Ok

application/json
organizationIdstringOptional

Organization ID

repoNamestringOptional

Name of the repository

repoIdstringOptional

ID of the repository

get/public_api/appsec/v1/scans/unscanned-repositories
GET /public_api/appsec/v1/scans/unscanned-repositories HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*
200

Ok

[
  {
    "organizationId": "text",
    "repoName": "text",
    "repoId": "text"
  }
]

Get AppSec branch periodic scans

get

Branch periodic scans are automated checks that assess the security posture of applications and infrastructure.

Get the details of branch periodic scans.

How to access branch periodic scans in the UI: Under Modules select Application Security > Branch Periodic Scanning (under Scans).

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters
organizationNamestringOptional
repositoriesstring[]Optional
branchNamestringOptional
scanHealthstring · enumOptional

The health of the scan. Valid values include:

  • ERROR: Indicates an error with the scan
  • PARTIALLY_COMPLETED: Indicates that the scan executed partially with some scan modules succeeded and others failing
  • IN_PROGRESS: The scan is in progress
  • COMPLETED: Indicates that the scan is complete
Possible values:
daysnumber · doubleOptionalDefault: 7
offsetnumber · doubleOptionalDefault: 0
limitnumber · doubleOptionalDefault: 100
Header parameters
AuthorizationstringRequired

{api_key}

Example: your-api-key-here
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Responses
200

Ok

application/json
repositoryIdstringOptional

ID of the scanned repository

integrationIdstringOptional
providerstringOptional
scanIdstringOptional

Scan ID

scanHealthstring · enumOptional

The health of the scan. Valid values include:

  • ERROR: Indicates an error with the scan
  • PARTIALLY_COMPLETED: Indicates that the scan executed partially with some scan modules succeeded and others failing
  • IN_PROGRESS: The scan is in progress
  • COMPLETED: Indicates that the scan is complete
Possible values:
scanDatestringOptional

Timestamp of the last scan execution

branchNamestringOptional

The branch analyzed during the scan

organizationNamestringOptional

The organization owning the repository

repoNamestringOptional

Name of the scanned repository

get/public_api/appsec/v1/scans/periodic
GET /public_api/appsec/v1/scans/periodic HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key-here
x-xdr-auth-id: 241
Accept: */*
200

Ok

[
  {
    "issuesFound": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "findingsSeverityBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "findingsTypesBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "issuesTypesBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "repositoryId": "text",
    "integrationId": "text",
    "provider": "text",
    "scanId": "text",
    "scanHealth": "COMPLETED",
    "scanDate": "text",
    "branchName": "text",
    "organizationName": "text",
    "repoName": "text"
  }
]

Get AppSec Pull Request scans

get

Pull Request (PR) scans are initiated by events triggered by version control systems such as GitHub, GitLab, Bitbucket and Azure Repos, or via webhooks. These scans are run on default or non-default branches containing open PRs or Merge Requests (MR) from your integrated repositories.

Get the details of PR scans.

How to access Pull Request scans in the UI: Under Modules select Application Security Pull Request Scans (under Scans).

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters
organizationNamestringOptional
repositoriesstring[]Optional
branchNamestringOptional
prIdstringOptional
prTitlestringOptional
prStatusstring · enumOptional

Status of the PR scan. Valid values include:

  • PASSED
  • PASSED_WITH_ISSUES
  • BLOCKED
  • IN_PROGRESS
  • ERROR
  • FAILED
Possible values:
scanHealthstring · enumOptional

The health of the scan. Valid values include:

  • ERROR: Indicates an error with the scan
  • PARTIALLY_COMPLETED: Indicates that the scan executed partially with some scan modules succeeded and others failing
  • IN_PROGRESS: The scan is in progress
  • COMPLETED: Indicates that the scan is complete
Possible values:
daysnumber · doubleOptionalDefault: 7
offsetnumber · doubleOptionalDefault: 0
limitnumber · doubleOptionalDefault: 100
Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Responses
200

Ok

application/json
pullRequestTitlestringOptional
integrationIdstringOptional
repositoryIdstringOptional

ID of the scanned repository

scanIdstringOptional
providerstringOptional
userEmailstringOptional
blockingPolicyNamestringOptional
blockingPolicyIdstringOptional
scanHealthstring · enumOptional

The health of the scan. Valid values include:

  • ERROR: Indicates an error with the scan
  • PARTIALLY_COMPLETED: Indicates that the scan executed partially with some scan modules succeeded and others failing
  • IN_PROGRESS: The scan is in progress
  • COMPLETED: Indicates that the scan is complete
Possible values:
scanDatestringOptional

The timestamp of the last scan execution

commitIdstringOptional

The commit included in the PR

pullRequestStatusstring · enumOptional

Status of the PR scan. Valid values include:

  • PASSED
  • PASSED_WITH_ISSUES
  • BLOCKED
  • IN_PROGRESS
  • ERROR
  • FAILED
Possible values:
pullRequestIdstringOptional

The ID of the PR

branchNamestringOptional

Name of the branch analyzed during the scan

organizationNamestringOptional

Specifies the organization owning the repository

repoNamestringOptional
get/public_api/appsec/v1/scans/pr
GET /public_api/appsec/v1/scans/pr HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*
200

Ok

[
  {
    "issuesFound": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "findingsSeverityBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "findingsTypesBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "issuesTypesBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "pullRequestTitle": "text",
    "integrationId": "text",
    "repositoryId": "text",
    "scanId": "text",
    "provider": "text",
    "userEmail": "text",
    "blockingPolicyName": "text",
    "blockingPolicyId": "text",
    "scanHealth": "COMPLETED",
    "scanDate": "text",
    "commitId": "text",
    "pullRequestStatus": "ERROR",
    "pullRequestId": "text",
    "branchName": "text",
    "organizationName": "text",
    "repoName": "text"
  }
]

Get AppSec CI scans

get

CI scans detect exposed secrets, misconfigurations in your infrastructure-as-code (IaC) files, vulnerabilities in your software composition analysis (SCA) packages, and license non-compliance in your CI pipelines.

Get the details of CI scans.

How to access CI scans in the UI: Under Modules select Application Security > CI Scans (under Scans).

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters
organizationNamestringOptional
repositoriesstring[]Optional
ciStatusstring · enumOptional

Status of the PR scan. Valid values include:

  • PASSED
  • PASSED_WITH_ISSUES
  • BLOCKED
  • IN_PROGRESS
  • ERROR
  • FAILED
Possible values:
scanHealthstring · enumOptional

The health of the scan. Valid values include:

  • ERROR: Indicates an error with the scan
  • PARTIALLY_COMPLETED: Indicates that the scan executed partially with some scan modules succeeded and others failing
  • IN_PROGRESS: The scan is in progress
  • COMPLETED: Indicates that the scan is complete
Possible values:
daysnumber · doubleOptionalDefault: 7
offsetnumber · doubleOptionalDefault: 0
limitnumber · doubleOptionalDefault: 100
Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Responses
200

Ok

application/json
repositoryIdstringOptional

ID of the scanned repository

integrationIdstringOptional
scanIdstringOptional
providerstringOptional
blockingPolicyNamestringOptional
blockingPolicyIdstringOptional
ciStatusstring · enumOptional

Status of the PR scan. Valid values include:

  • PASSED
  • PASSED_WITH_ISSUES
  • BLOCKED
  • IN_PROGRESS
  • ERROR
  • FAILED
Possible values:
scanHealthstring · enumOptional

The health of the scan. Valid values include:

  • ERROR: Indicates an error with the scan
  • PARTIALLY_COMPLETED: Indicates that the scan executed partially with some scan modules succeeded and others failing
  • IN_PROGRESS: The scan is in progress
  • COMPLETED: Indicates that the scan is complete
Possible values:
scanDatestringOptional

The timestamp of the last scan execution

branchNamestringOptional

The name of the branch analyzed during the scan

organizationNamestringOptional

Name of the organization owning the repository

repoNamestringOptional

Name of the scanned repository

get/public_api/appsec/v1/scans/ci
GET /public_api/appsec/v1/scans/ci HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*
200

Ok

[
  {
    "issuesFound": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "findingsSeverityBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "findingsTypesBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "issuesTypesBreakdown": {
      "ANY_ADDITIONAL_PROPERTY": 1
    },
    "repositoryId": "text",
    "integrationId": "text",
    "scanId": "text",
    "provider": "text",
    "blockingPolicyName": "text",
    "blockingPolicyId": "text",
    "ciStatus": "ERROR",
    "scanHealth": "COMPLETED",
    "scanDate": "text",
    "branchName": "text",
    "organizationName": "text",
    "repoName": "text"
  }
]

List AppSec scan issues

get

Get a list of the issues discovered in the scan specified by scan ID.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters
scanIdstringRequired
Query parameters
severitystring · enumOptionalPossible values:
offsetnumber · doubleOptionalDefault: 0
limitnumber · doubleOptionalDefault: 100
Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Responses
200

Ok

application/json
resolution_commentstringRequired
resolution_reasonstring · enumRequiredPossible values:
resolution_statusstring · enumRequiredPossible values:
assigneestringRequired
branchstringRequired
run_idstringRequired
pull_request_idstringRequired
repo_idstringRequired
createdstringRequired
file_pathstringRequired
asset_namestringRequired
detection_methodstring · enumRequiredPossible values:
alert_namestringRequired
severitystring · enumRequiredPossible values:
scan_idstringRequired
issue_idstringRequired
get/public_api/appsec/v1/scans/{scanId}/issues
GET /public_api/appsec/v1/scans/{scanId}/issues HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*
200

Ok

[
  {
    "resolution_comment": "text",
    "resolution_reason": "Resolved - Known Issue",
    "resolution_status": "New",
    "assignee": "text",
    "branch": "text",
    "run_id": "text",
    "pull_request_id": "text",
    "repo_id": "text",
    "created": "text",
    "file_path": "text",
    "asset_name": "text",
    "detection_method": "Secrets Security",
    "alert_name": "text",
    "severity": "Critical",
    "scan_id": "text",
    "issue_id": "text"
  }
]

List AppSec scan findings

get

Get a list of the findings discovered in the scan specified by scan ID.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters
scanIdstringRequired
Query parameters
severitystring · enumOptionalPossible values:
offsetnumber · doubleOptionalDefault: 0
limitnumber · doubleOptionalDefault: 100
Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Responses
200

Ok

application/json
scan_sourcestring · enumRequiredPossible values:
git_userstringRequired
first_hash_timestringRequired
first_hashstringRequired
platform_idstringRequired
branchstringRequired
detection_methodstring · enumRequiredPossible values:
file_pathstringRequired
descriptionstringRequired
last_observedstringRequired
first_observedstringRequired
suppression_typestring · enumRequiredPossible values:
data_sourcestring · enumRequiredPossible values:
namestringRequired
categorystringRequired
asset_idstringRequired
asset_namestringRequired
severitystring · enumRequiredPossible values:
scan_idstringRequired
issue_namestringRequired
get/public_api/appsec/v1/scans/{scanId}/findings
GET /public_api/appsec/v1/scans/{scanId}/findings HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*
200

Ok

[
  {
    "scan_source": "pr",
    "git_user": "text",
    "first_hash_time": "text",
    "first_hash": "text",
    "platform_id": "text",
    "branch": "text",
    "detection_method": "Secrets Security",
    "file_path": "text",
    "description": "text",
    "last_observed": "text",
    "first_observed": "text",
    "suppression_type": "Inline",
    "data_source": "GitHub",
    "name": "text",
    "category": "text",
    "asset_id": "text",
    "asset_name": "text",
    "severity": "Critical",
    "scan_id": "text",
    "issue_name": "text"
  }
]

Rerun a repository scan

post

Create a repository scan by specifying the branch name.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters
repositoryIdstringRequired
Query parameters
scanFullGitHistorybooleanOptional
Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
branchNamestringOptional
Responses
200

Ok

application/json
or
post/public_api/appsec/v1/scan/repository/{repositoryId}
POST /public_api/appsec/v1/scan/repository/{repositoryId} HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 21

{
  "branchName": "text"
}
200

Ok

{
  "metadata": {
    "scan_id": "text"
  }
}
PreviousSBOM Management
NextCloud Coverage

Last updated

Was this helpful?