Control Findings

REST API for retrieving compliance results for an asset.

Get asset compliance results

post

Retrieve compliance standard and control results for a specific asset ID, with optional filtering, sorting and pagination.

Required params:

• asset_id (string) - The asset identifier
• last_evaluation_time (integer) - Unix timestamp in milliseconds for the evaluation time

Filtering Support:

• String fields (standard, category, control, source): eq, neq, contains, not_contains
• Status fields (status, severity): eq, neq
• Status valid values: [FAILED, PASSED, NOT_ASSESSED]
• Severity valid values: [SEV_010_INFO, SEV_020_LOW, SEV_030_MEDIUM, SEV_040_HIGH, SEV_050_CRITICAL]

Sorting Support:

• Available fields: standard, category, control, severity, status
• Sort orders: asc, desc
• Default: standard in ascending order

Pagination: (max number of elements is 100)

Authorizations

x-xdr-auth-idstringRequired

XDR API Key ID for authentication

AuthorizationstringRequired

XDR API Key for authentication

Body

Request payload for retrieving asset compliance data. Supports filtering, sorting, and pagination.

Responses

200

Successfully retrieved control findings

application/json

Response containing asset compliance data including compliance status, findings, and associated standards.

400

Bad request - invalid parameters or request format

application/json

401

Authentication required

application/json

403

Access denied - insufficient permissions

application/json

500

Internal server error

application/json

post/public_api/v1/compliance/get_asset

POST /public_api/v1/compliance/get_asset HTTP/1.1
Host: api-cortex.paloaltonetworks.com
x-xdr-auth-id: YOUR_API_KEY
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 188

{
  "request_data": {
    "asset_id": "eea3102e81bc8cf10b43168a7a1ff27cb539a7325428f3cd956240472335c6da",
    "last_evaluation_time": 1763669115000,
    "filters": [],
    "sort": {},
    "search_from": 0,
    "search_to": 100
  }
}

{
  "reply": {
    "total_count": 5,
    "result_count": 5,
    "filter_count": 5,
    "assets": [
      {
        "STANDARD": "Secure Controls Framework (SCF) v2024.2",
        "STANDARD_REVISION": "-3633352044114537559",
        "CATEGORY": "Continuous Monitoring",
        "CONTROL_REVISION": "5207648284675893530",
        "CONTROL": "MON-05.1:Real-Time Alerts of Event Logging Failure",
        "SEVERITY": "SEV_030_MEDIUM",
        "RULE_IDS": [
          "ab0317ac-661a-4a7d-a28a-53f4fdf6d290"
        ],
        "LAST_EVALUATION_TIME": 1762718526,
        "STATUS": "FAILED",
        "SOURCE": "Finding"
      }
    ]
  }
}