Cloud Instance Management
These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex Cloud and you can enable, disable, or delete them. You can also edit the cloud instance configuration.
Create a template to facilitate the seamless setup of CSP data in Cortex. Define the scope and specify the scan mode. For full control of the setup, you can use the advanced settings. Based on the onboarding settings, Cortex generates an authentication template to establish trust to the CSP and grant permissions to Cortex. Cortex Cloud creates an instance in pending state. The API returns a link to download the template from the Cortex tenant.
Note: If the template execution in the CSP fails, there is currently no manual execution of the template by API. You must perform manual execution in the UI.
For scope modifications, the parameters are CSP-specific. For AWS, use accounts, for GCP, use projects, and for Azure, use subscriptions.
Required license: Cortex Cloud Posture Management
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Successful Response
The main payload of the response, containing instance information data. It includes a link to download the template file from your tenant. If you use automated upload (only for AWS), the link will take you directly to AWS CloudFormation to create the stack. Otherwise, download the template and upload it in your CSP and follow the instructions to manually upload the template:
Invalid Client Request Error
Internal Server Error
POST /public_api/v1/cloud_onboarding/create_instance_template HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 610
{
"request_data": {
"scope": "ACCOUNT",
"scan_mode": "MANAGED",
"instance_name": "AWS 1 Instance",
"scope_modifications": {
"regions": {
"enabled": true,
"type": "EXCLUDE",
"regions": [
"us-east-1"
]
}
},
"additional_capabilities": {
"xsiam_analytics": false,
"data_security_posture_management": true,
"registry_scanning": false,
"serverless_scanning": true,
"agentless_disk_scanning": true,
"upload_files_to_wildfire": true
},
"custom_resources_tags": [
{
"key": "managed_by",
"value": "paloaltonetworks"
}
],
"collection_configuration": {
"audit_logs": {
"enabled": true,
"collection_method": "AUTOMATED"
}
},
"cloud_provider": "AWS",
"cloud_partition": "COMMERCIAL"
}
}{
"reply": {
"automated": {
"link": "string",
"tracking_guid": "string"
},
"manual": {
"TF/ARM": "string"
}
}
}Get the configuration details of the specified cloud instance.
Required license: Cortex Cloud Posture Management
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Successful Response
Invalid Client Request Error
Internal Server Error
POST /public_api/v1/cloud_onboarding/get_instance_details HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 36
{
"request_data": {
"id": "instance-1"
}
}{
"reply": {
"id": "e21d20cc3cad49d79fffa968c64d688d",
"collector": "AWS",
"instance_name": "AWS-1",
"scope": "ACCOUNT",
"tags": [
{
"key": "managed_by",
"value": "paloaltonetworks"
}
],
"status": "ENABLED",
"cloud_provider": "AWS",
"scan": {
"scan_method": "MANAGED"
},
"security_capabilities": [
{
"name": "PERMISSIONS",
"description": "Permissions",
"status": 1
},
{
"name": "DISCOVERY",
"description": "Discovery Engine",
"status": 0
},
{
"name": "ADS",
"description": "Agentless Disk Scanning",
"status": 2
},
{
"name": "DSPM",
"description": "Data Security Scanning",
"status": 2
},
{
"name": "AUDIT_LOGS",
"description": "Audit Logs",
"status": 2
},
{
"name": "REGISTRY",
"description": "Registry Scanning",
"status": 2
},
{
"name": "SERVERLESS",
"description": "Serverless Scanning",
"status": 2
},
{
"name": "IDENTITY_SECURITY",
"description": "Identity Security",
"status": 0
},
{
"name": "AUTOMATION",
"description": "Automation",
"status": 2
},
{
"name": "KUBERNETES_SECURITY",
"description": "Kubernetes Security",
"status": 2
}
],
"upgrade_available": true,
"cloud_partition": "COMMERCIAL",
"collection_configuration": "{\"audit_logs\": {\"enabled\": false, \"data_events\": false}}",
"additional_capabilities": "{\"automation\": false, \"xsiam_analytics\": false, \"registry_scanning\": false, \"kubernetes_security\": false, \"serverless_scanning\": false, \"automation_log_level\": \"OFF\", \"agentless_disk_scanning\": false, \"registry_scanning_options\": {\"type\": \"ALL\"}, \"data_security_posture_management\": false}"
}
}Get the configuration details of all or filtered cloud instances. You can use a filter to exclude instances in a PENDING state.
Required license: Cortex Cloud Posture Management
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Successful Response
Invalid Client Request Error
Internal Server Error
POST /public_api/v1/cloud_onboarding/get_instances HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 198
{
"request_data": {
"filter_data": {
"sort": [
{
"FIELD": "STATUS",
"ORDER": "DESC"
}
],
"paging": {
"from": 0,
"to": 50
},
"filter": {
"AND": [
{
"SEARCH_FIELD": "CLOUD_PROVIDER",
"SEARCH_TYPE": "EQ",
"SEARCH_VALUE": "AWS"
}
]
}
}
}
}{
"reply": {
"DATA": [
{
"instance_id": "716e6a20f1ca41efb966bd9fa486fb60",
"cloud_provider": "AWS",
"instance_name": "aws-expanse-afr-sbx",
"account_name": "",
"accounts": 1,
"scope": "ACCOUNT",
"scan_mode": "MANAGED",
"cloud_partition": "COMMERCIAL",
"creation_time": 1768333922750,
"custom_resources_tags": "[{\"key\": \"managed_by\", \"value\": \"paloaltonetworks\"}]",
"provisioning_method": "CF",
"additional_capabilities": "{\"automation\": true, \"xsiam_analytics\": true, \"registry_scanning\": true}",
"update_status": "UPDATE_AVAILABLE",
"is_pending_changes": 0,
"status": "DISABLED",
"outpost_id": "6e1e2eb8fce34c6e889538ea177644f7"
}
],
"FILTER_COUNT": 1,
"TOTAL_COUNT": 1
}
}Edit the configuration settings of the specified cloud instance. After editing, there is a notice in the UI that there are pending changes. The changes are applied after you execute the template in the CSP after editing.
Required license: Cortex Cloud Posture Management
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Successful Response
Invalid Client Request Error
Internal Server Error
POST /public_api/v1/cloud_onboarding/edit_instance HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 804
{
"request_data": {
"id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"scan_env_id": "",
"instance_name": "AWS GOV Instance Updated",
"cloud_provider": "AWS",
"cloud_partition": "GOV",
"custom_resources_tags": [
{
"key": "managed_by",
"value": "paloaltonetworks"
}
],
"collection_configuration": {
"audit_logs": {
"enabled": true,
"collection_method": "AUTOMATED",
"data_events": true
}
},
"scope_modifications": {
"accounts": {
"enabled": true,
"type": "EXCLUDE",
"account_ids": [
"sample-account-1"
]
},
"regions": {
"enabled": false,
"type": null,
"regions": null
}
},
"additional_capabilities": {
"xsiam_analytics": true,
"data_security_posture_management": true,
"registry_scanning": true,
"serverless_scanning": true,
"agentless_disk_scanning": true,
"upload_files_to_wildfire": true,
"kubernetes_security": false,
"automation": false,
"registry_scanning_options": {
"type": "ALL"
}
}
}
}{
"reply": {
"automated": {
"link": "text",
"tracking_guid": "text"
},
"manual": {
"TF/ARM": "text"
}
}
}Enable or disable the cloud instances specified by their instance IDs. To obtain the instance IDs, use Get all or filtered cloud instances.
Required license: Cortex Cloud Posture Management
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Successful Response
The main payload of the response, containing operation-specific data.
Invalid Client Request Error
Internal Server Error
POST /public_api/v1/cloud_onboarding/enable_disable_instance HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 110
{
"request_data": {
"ids": [
"e22b3a29260c404183d1a0ea6cbd4418",
"d32d3b19730d414387d2a3ea7eac4218"
],
"enable": true
}
}{
"reply": {}
}Delete the specified cloud instances.
Required license: Cortex Cloud Posture Management
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Successful Response
The main payload of the response, containing operation-specific data.
Invalid Client Request Error
Internal Server Error
POST /public_api/v1/cloud_onboarding/delete_instance HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 52
{
"request_data": {
"ids": [
"instance-1",
"instance-2"
]
}
}{
"reply": {}
}List all of the identifiers roles for the cloud instance. In the UI, these details are listed under Authorization details of the cloud instance.
Required license: In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.
The cloud instance ID for which you want to list the authorization details.
The cloud service provider for which you want to list the authorization details.
Successful Response
Bad Request
Internal Server Error
POST /public_api/v1/cloud_onboarding/get_identifiers HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"instance_id": "text",
"cloud_provider": "GCP"
}{
"reply": {
"cortex_discovery_role": "text",
"cortex_scan_platform_role": "text",
"cortex_log_collection_role": "text",
"cortex_outpost_role": "text"
}
}Last updated
Was this helpful?