CIEM

APIs for searching and retrieving access information and least privilege access (LPA) recommendations within the Cloud Infrastructure Entitlement Management (CIEM) module.

Least Privilege Access suggestion for an asset

get

Returns least privilege access (LPA) recommendations based on the asset's existing IAM policies or roles. The recommendations preserve all actions performed by the asset during the specified lookback period while minimizing the number of existing policies or roles required.

Use this endpoint to apply the returned configuration snippets to remediate over-privileged identities.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security.

Path parameters

assetIdstringRequired

Unique identifier of the asset.

Query parameters

output_formatstring · enumRequired

Format of the remediation configuration snippets returned in recommendationSnippets. Supported values depend on the selected cloud_type:

• JSON — Supported for AWS, Azure, and GCP
• TERRAFORM — Supported for AWS, Azure, and GCP
• CF — Supported only for AWS (CloudFormation)
• CLI — Supported only for GCP
• ALL — Returns all supported formats available for the asset's cloud provider (AWS, Azure, or GCP)

Example: JSONPossible values:

lookback_duration_daysinteger · min: 1 · max: 365Required

Number of days to look back when evaluating actions performed by the asset. Only actions observed during this lookback period are used to generate the least-privilege configuration.

Example: 90

cloud_typestring · enumRequired

Cloud service provider associated with the asset. This value must match the asset's actual cloud provider. The supported output_format values depend on the selected cloud provider.

Example: AWSPossible values:

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

200

OK. Indicates that the Least Privilege Access suggestion generated successfully.

application/json

Response containing the generated Least Privilege Access configuration for the asset.

recommendedActionTypestring · enumOptional

The recommended remediation action based on the evaluation of the asset's permissions.

• applySnippets — The asset has excess permissions. Apply the configuration snippets in recommendationSnippets to enforce least-privilege access.
• removeAllPolicies — No actions were observed during the lookback period. Remove all policies or roles currently assigned to the asset.
• noActionRequired — The asset's current permissions already satisfy least-privilege requirements. No remediation is needed.
• manuallyRemoveUnusedActions — The asset has unused permissions that cannot be automatically remediated using configuration snippets. Review and remove the unused permissions manually.

Possible values:

400

Bad Request — The request is malformed or contains invalid parameter values.

401

Unauthorized — The Authorization header is missing or contains an invalid API key.

500

Internal Server Error — The server encountered an unexpected error. This may occur if the specified assetId does not exist, or if the output_format and cloud_type combination is not supported for the asset's cloud provider.

get/public_api/ciem/v1/assets/{assetId}/least-privileged-access

GET /public_api/ciem/v1/assets/{assetId}/least-privileged-access?output_format=JSON&lookback_duration_days=90&cloud_type=AWS HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key
x-xdr-auth-id: 1
Accept: */*

{
  "recommendationSnippets": {
    "json": [
      "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Resource\":[\"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/example-lambda-function:*\"],\"Action\":[\"logs:PutLogEvents\"],\"Condition\":{},\"Effect\":\"Allow\"}]}"
    ]
  },
  "verdicts": [
    {
      "actionName": "logs:CreateLogGroup",
      "policyName": "AWSLambdaBasicExecutionRole",
      "recommendation": "Remove",
      "source": "CIEM_LAST_ACCESS"
    },
    {
      "actionName": "logs:PutLogEvents",
      "policyName": "AWSLambdaBasicExecutionRole",
      "recommendation": "Keep",
      "source": "CIEM_LAST_ACCESS"
    }
  ],
  "recommendedActionType": "applySnippets"
}

Retrieve the resources a source identity can access

get

Retrieves access data for a specific source identity or cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this asset is the source of permissions, mapping out every resource it can reach.

Use this endpoint to answer "what can this identity access?". Typical source assets are human identities and non-human identities such as compute instances (for example, AWS::EC2::Instance), service accounts, and serverless functions.

Supports optional filtering, sorting, and pagination via an optional request body and query parameter.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security.

Path parameters

source_uaistringRequired

The Unique Asset Identifier (UAI) of the source identity or cloud resource whose outbound access you want to retrieve.

Example: dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277

Query parameters

next_page_tokenstringOptional

Base64-encoded pagination token from a previous response to fetch the next page of results.

Header parameters

x-xdr-auth-idstringRequired

{api_key_id}

AuthorizationstringRequired

{api_key}

Content-Typestring · enumRequired

Specifies the request body format.

Possible values:

Body

Optional request body for CIEM access GET endpoints, supporting filtering and sorting.

Responses

200

Successful response with access details for the specified source.

application/json

Response object for CIEM access GET endpoints.

FILTER_COUNTinteger · int32Optional

The number of results matching the applied filters.

TOTAL_COUNTinteger · int32Optional

The total number of available access records.

400

Bad Request. Invalid parameters or pagination token.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

404

Not Found. The specified source UAI does not exist.

application/json

429

Too Many Requests. The request rate limit has been exceeded.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

502

Bad Gateway. The server received an invalid response from an upstream server.

application/json

503

Service Unavailable. The service is temporarily unavailable.

application/json

get/public_api/ciem/v1/access/source/{source_uai}

GET /public_api/ciem/v1/access/source/{source_uai} HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id: text
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 161

{
  "filter": {
    "AND": [
      {
        "SEARCH_FIELD": "dest_cloud_resource_id",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": "abc"
      }
    ]
  },
  "sort": [
    {
      "field": "dest_cloud_resource_id",
      "order": "DESC"
    }
  ]
}

{
  "FILTER_COUNT": 2,
  "TOTAL_COUNT": 150,
  "DATA": [
    {
      "source_cloud_resource_name": "EC2 Instance",
      "source_cloud_resource_id": "i-0abc123def456",
      "source_cloud_resource_uai": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277",
      "source_cloud_resource_type": "AWS::EC2::Instance",
      "source_cloud_service_name": "Amazon EC2",
      "source_cloud_region": "us-east-1",
      "sourceCategory": "Non-human",
      "source_grouping_value": "group-1",
      "source_cloud_account_id": "123456789012",
      "source_cloud_account_name": "dev-account",
      "source_cloud_account_is_vendor": false,
      "sourceVendorName": "AWS",
      "dest_cloud_account_id": "987654321098",
      "dest_cloud_account_name": "prod-account",
      "dest_cloud_resource_name": "S3 Bucket",
      "dest_cloud_resource_id": "my-bucket",
      "dest_cloud_resource_uai": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "dest_cloud_resource_type": "AWS::S3::Bucket",
      "dest_cloud_service_name": "Amazon S3",
      "dest_cloud_region": "us-east-1",
      "destCategory": "Cloud Service Account",
      "dest_grouping_value": "group-2",
      "destination_access_labels": [],
      "grantedby_cloud_entity_name": "AdminRole",
      "grantedby_cloud_entity_id": "AROA1234567890EXAMPLE",
      "grantedby_cloud_entity_uai": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
      "grantedby_cloud_entity_type": "IAM Role",
      "granterCategory": "IAM Group",
      "granter_grouping_value": "group-3",
      "access_levels": [
        "Read",
        "Write"
      ],
      "actions": {
        "Read": [
          "s3:GetObject",
          "s3:ListBucket"
        ],
        "Write": [
          "s3:PutObject"
        ]
      },
      "actions_count": 2,
      "last_used": "2023-01-15T10:30:00Z",
      "account_access_transformed": "admin_access",
      "permission_scope": "Global",
      "excessive_policies_count": 5,
      "unused_actions_count": 10,
      "is_last_access_supported": true
    }
  ],
  "metadata": {
    "next_page_token": "eyJwYWdlIjogMn0="
  }
}

Retrieve the access conferred by a permission-granting entity

get

Retrieves access data for a specific granter entity, identified by its Unique Asset Identifier (UAI). A granter is the entity that confers permissions rather than the identity using them or the resource being reached. Returns all access entries mediated by this entity.

Use this endpoint to answer "what access does this permission grant confer, and to whom?". Typical granter entities are permission constructs such as IAM roles, IAM groups, and IAM policies.

Supports optional filtering, sorting, and pagination via an optional request body and query parameter.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security.

Path parameters

granter_uaistringRequired

The Unique Asset Identifier (UAI) of the granter entity whose conferred access you want to retrieve.

Example: dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277

Query parameters

next_page_tokenstringOptional

Base64-encoded pagination token from a previous response to fetch the next page of results.

Header parameters

x-xdr-auth-idstringRequired

{api_key_id}

AuthorizationstringRequired

{api_key}

Content-Typestring · enumRequired

Specifies the request body format.

Possible values:

Body

Optional request body for CIEM access GET endpoints, supporting filtering and sorting.

Responses

200

Successful response with access details for the specified granter.

application/json

Response object for CIEM access GET endpoints.

FILTER_COUNTinteger · int32Optional

The number of results matching the applied filters.

TOTAL_COUNTinteger · int32Optional

The total number of available access records.

400

Bad Request. Invalid parameters or pagination token.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

404

Not Found. The specified granter UAI does not exist.

application/json

429

Too Many Requests. The request rate limit has been exceeded.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

502

Bad Gateway. The server received an invalid response from an upstream server.

application/json

503

Service Unavailable. The service is temporarily unavailable.

application/json

get/public_api/ciem/v1/access/granter/{granter_uai}

GET /public_api/ciem/v1/access/granter/{granter_uai} HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id: text
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 161

{
  "filter": {
    "AND": [
      {
        "SEARCH_FIELD": "dest_cloud_resource_id",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": "abc"
      }
    ]
  },
  "sort": [
    {
      "field": "dest_cloud_resource_id",
      "order": "DESC"
    }
  ]
}

{
  "FILTER_COUNT": 2,
  "TOTAL_COUNT": 150,
  "DATA": [
    {
      "source_cloud_resource_name": "EC2 Instance",
      "source_cloud_resource_id": "i-0abc123def456",
      "source_cloud_resource_uai": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277",
      "source_cloud_resource_type": "AWS::EC2::Instance",
      "source_cloud_service_name": "Amazon EC2",
      "source_cloud_region": "us-east-1",
      "sourceCategory": "Non-human",
      "source_grouping_value": "group-1",
      "source_cloud_account_id": "123456789012",
      "source_cloud_account_name": "dev-account",
      "source_cloud_account_is_vendor": false,
      "sourceVendorName": "AWS",
      "dest_cloud_account_id": "987654321098",
      "dest_cloud_account_name": "prod-account",
      "dest_cloud_resource_name": "S3 Bucket",
      "dest_cloud_resource_id": "my-bucket",
      "dest_cloud_resource_uai": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "dest_cloud_resource_type": "AWS::S3::Bucket",
      "dest_cloud_service_name": "Amazon S3",
      "dest_cloud_region": "us-east-1",
      "destCategory": "Cloud Service Account",
      "dest_grouping_value": "group-2",
      "destination_access_labels": [],
      "grantedby_cloud_entity_name": "AdminRole",
      "grantedby_cloud_entity_id": "AROA1234567890EXAMPLE",
      "grantedby_cloud_entity_uai": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
      "grantedby_cloud_entity_type": "IAM Role",
      "granterCategory": "IAM Group",
      "granter_grouping_value": "group-3",
      "access_levels": [
        "Read",
        "Write"
      ],
      "actions": {
        "Read": [
          "s3:GetObject",
          "s3:ListBucket"
        ],
        "Write": [
          "s3:PutObject"
        ]
      },
      "actions_count": 2,
      "last_used": "2023-01-15T10:30:00Z",
      "account_access_transformed": "admin_access",
      "permission_scope": "Global",
      "excessive_policies_count": 5,
      "unused_actions_count": 10,
      "is_last_access_supported": true
    }
  ],
  "metadata": {
    "next_page_token": "eyJwYWdlIjogMn0="
  }
}

Retrieve the identities that can access a destination resource

get

Retrieves access data for a specific destination cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this resource is the target, mapping out every identity that holds access to it.

Use this endpoint to answer "who has access to this resource?". Typical destination assets are storage, data, and compute resources (for example, AWS::S3::Bucket), and the identities returned include both human users and non-human identities such as service accounts.

Supports optional filtering, sorting, and pagination via an optional request body and query parameter.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security.

Path parameters

destination_uaistringRequired

The Unique Asset Identifier (UAI) of the destination cloud resource whose inbound access you want to retrieve.

Example: dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277

Query parameters

next_page_tokenstringOptional

Base64-encoded pagination token from a previous response to fetch the next page of results.

Header parameters

x-xdr-auth-idstringRequired

{api_key_id}

AuthorizationstringRequired

{api_key}

Content-Typestring · enumRequired

Specifies the request body format.

Possible values:

Body

Optional request body for CIEM access GET endpoints, supporting filtering and sorting.

Responses

200

Successful response with access details for the specified destination.

application/json

Response object for CIEM access GET endpoints.

FILTER_COUNTinteger · int32Optional

The number of results matching the applied filters.

TOTAL_COUNTinteger · int32Optional

The total number of available access records.

400

Bad Request. Invalid parameters or pagination token.

application/json

401

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

application/json

403

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

application/json

404

Not Found. The specified destination UAI does not exist.

application/json

429

Too Many Requests. The request rate limit has been exceeded.

application/json

500

Internal server error. A unified status for API communication type errors.

application/json

502

Bad Gateway. The server received an invalid response from an upstream server.

application/json

503

Service Unavailable. The service is temporarily unavailable.

application/json

get/public_api/ciem/v1/access/destination/{destination_uai}

GET /public_api/ciem/v1/access/destination/{destination_uai} HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id: text
Authorization: text
Content-Type: application/json
Accept: */*
Content-Length: 161

{
  "filter": {
    "AND": [
      {
        "SEARCH_FIELD": "dest_cloud_resource_id",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": "abc"
      }
    ]
  },
  "sort": [
    {
      "field": "dest_cloud_resource_id",
      "order": "DESC"
    }
  ]
}

{
  "FILTER_COUNT": 2,
  "TOTAL_COUNT": 150,
  "DATA": [
    {
      "source_cloud_resource_name": "EC2 Instance",
      "source_cloud_resource_id": "i-0abc123def456",
      "source_cloud_resource_uai": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277",
      "source_cloud_resource_type": "AWS::EC2::Instance",
      "source_cloud_service_name": "Amazon EC2",
      "source_cloud_region": "us-east-1",
      "sourceCategory": "Non-human",
      "source_grouping_value": "group-1",
      "source_cloud_account_id": "123456789012",
      "source_cloud_account_name": "dev-account",
      "source_cloud_account_is_vendor": false,
      "sourceVendorName": "AWS",
      "dest_cloud_account_id": "987654321098",
      "dest_cloud_account_name": "prod-account",
      "dest_cloud_resource_name": "S3 Bucket",
      "dest_cloud_resource_id": "my-bucket",
      "dest_cloud_resource_uai": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
      "dest_cloud_resource_type": "AWS::S3::Bucket",
      "dest_cloud_service_name": "Amazon S3",
      "dest_cloud_region": "us-east-1",
      "destCategory": "Cloud Service Account",
      "dest_grouping_value": "group-2",
      "destination_access_labels": [],
      "grantedby_cloud_entity_name": "AdminRole",
      "grantedby_cloud_entity_id": "AROA1234567890EXAMPLE",
      "grantedby_cloud_entity_uai": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
      "grantedby_cloud_entity_type": "IAM Role",
      "granterCategory": "IAM Group",
      "granter_grouping_value": "group-3",
      "access_levels": [
        "Read",
        "Write"
      ],
      "actions": {
        "Read": [
          "s3:GetObject",
          "s3:ListBucket"
        ],
        "Write": [
          "s3:PutObject"
        ]
      },
      "actions_count": 2,
      "last_used": "2023-01-15T10:30:00Z",
      "account_access_transformed": "admin_access",
      "permission_scope": "Global",
      "excessive_policies_count": 5,
      "unused_actions_count": 10,
      "is_last_access_supported": true
    }
  ],
  "metadata": {
    "next_page_token": "eyJwYWdlIjogMn0="
  }
}