Attack Surface Management
APIs for attack surface management
Get service details according to the service ID. You can send up to 20 IDs.
Header parameters
AuthorizationstringRequired
{api_key}
x-xdr-auth-idstringRequired
{api_key_id}
Body
Responses
200
OK
application/json
400
Bad Request. Got an invalid JSON.
application/json
401
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
application/json
402
Unauthorized access. User does not have the required license type to run this API.
application/json
403
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
application/json
500
Internal server error. A unified status for API communication type errors.
application/json
post/public_api/v1/assets/get_external_service
POST /public_api/v1/assets/get_external_service HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"request_data": {
"service_id_list": [
"text"
]
}
}{
"reply": {
"details": [
{
"service_id": "text",
"service_name": "text",
"service_type": "text",
"ip_address": [
"text"
],
"domain": [
{}
],
"externally_detected_providers": [
"text"
],
"is_active": "text",
"first_observed": 1,
"last_observed": 1,
"port": 1,
"protocol": "text",
"active_classifications": [
"text"
],
"inactive_classifications": [
{}
],
"discovery_type": "text",
"business_units": [
"text"
],
"externally_inferred_vulnerability_score": {},
"externally_inferred_cves": [
{}
],
"details": {
"serviceKey": "text",
"serviceKeyType": "text",
"businessUnits": [
{
"name": "text"
}
],
"providerDetails": [
{
"name": "text",
"firstObserved": 1,
"lastObserved": 1
}
],
"certificates": [
{
"certificate": {
"issuer": "text",
"issuerAlternativeNames": "text",
"issuerCountry": "text",
"issuerEmail": "text",
"issuerLocality": "text",
"issuerName": "text",
"issuerOrg": "text",
"formattedIssuerOrg": "text",
"issuerOrgUnit": "text",
"issuerState": "text",
"publicKey": "text",
"publicKeyAlgorithm": "text",
"publicKeyRsaExponent": 1,
"signatureAlgorithm": "text",
"subject": "text",
"subjectAlternativeNames": "text",
"subjectCountry": "text",
"subjectEmail": "text",
"subjectLocality": "text",
"subjectName": "text",
"subjectOrg": "text",
"subjectOrgUnit": "text",
"subjectState": "text",
"serialNumber": "text",
"validNotBefore": 1,
"validNotAfter": 1,
"version": "text",
"publicKeyBits": 1,
"publicKeyModulus": "text",
"publicKeySpki": "text",
"sha1Fingerprint": "text",
"sha256Fingerprint": "text",
"md5Fingerprint": "text"
},
"activityStatus": "text",
"lastObserved": 1,
"firstObserved": 1
}
],
"domains": [
{}
],
"ips": [
{
"ip": "text",
"protocol": "text",
"provider": "text",
"geolocation": {
"latitude": 1,
"longitude": 1,
"countryCode": "text",
"city": "text",
"regionCode": "text",
"timeZone": 1
},
"activityStatus": "text",
"lastObserved": 1,
"firstObserved": 1
}
],
"classifications": [
{
"name": "text",
"activityStatus": "text",
"values": [
{
"jsonValue": "text",
"firstObserved": 1,
"lastObserved": 1
}
],
"firstObserved": 1,
"lastObserved": 1
}
],
"tlsVersions": [
{
"tlsVersion": "text",
"cipherSuite": "text",
"firstObserved": 1,
"lastObserved": 1,
"activityStatus": "text"
}
],
"inferredCvesObserved": [
{}
],
"enrichedObservationSource": "text",
"ip_ranges": {}
}
}
]
}
}Get a complete or filtered list of all your external services.
The maximum result limit is 500.
Header parameters
authorizationstringRequired
api-key
x-xdr-auth-idstringRequired
api-key-id
Body
Responses
200
OK
application/json
400
Bad Request. Got invalid JSON.
application/json
401
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
402
Unauthorized access. User does not have the required license type to run this API.
application/json
403
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
application/json
500
Internal server error. A unified status for API communication type errors.
application/json
post/public_api/v1/assets/get_external_services
POST /public_api/v1/assets/get_external_services HTTP/1.1
Host: api-yourfqdn
authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 108
{
"request_data": {
"filters": [
{
"field": "string",
"operator": "string",
"value": "string"
}
],
"use_page_token": true
}
}{
"reply": {
"total_count": 0,
"result_count": 0,
"external_services": [
{
"service_id": "string",
"service_name": "string",
"service_type": "string",
"ip_address": [
"string"
],
"domain": [
"string"
],
"externally_detected_providers": [
"string"
],
"is_active": "string",
"first_observed": 0,
"last_observed": 0,
"port": 0,
"protocol": "string",
"active_classifications": [
"string"
],
"inactive_classifications": [
"string"
],
"discovery_type": "string",
"business_units": [
"string"
],
"externally_inferred_vulnerability_score": "null",
"externally_inferred_cves": [
{}
],
"tls_versions": [
{}
],
"inferred_cves_observed": [
{}
],
"cloud_management_status": "null"
}
]
}
}Get a complete or filtered list of vulnerability tests. Results include details about each test, including the number of services confirmed vulnerable.
Header parameters
AuthorizationstringRequired
{api_key}
x-xdr-auth-idstringRequired
{api_key_id}
Body
Responses
200
OK
application/json
post/public_api/v1/assets/get_vulnerability_tests
POST /public_api/v1/assets/get_vulnerability_tests HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 86
{
"request_data": {
"filters": [
{
"field": "name",
"operator": "contains",
"value": "apache"
}
]
}
}200
OK
{
"reply": {
"total_count": 1,
"result_count": 1,
"vulnerability_tests": [
{
"id": "69527826-e1c5-42d8-b8d8-2c2005b75cbe",
"name": "Apache Solr DataImportHandler Code Injection Vulnerability",
"vulnerability_ids": [
"CVE-2019-0193"
],
"description": "Apache Solr, a popular open-source search platform built on Apache Lucene, is affected by a remote code execution vulnerability. Solr's DataImportHandler (DIH), an optional module widely used to import data from databases and other sources, allows the entire DIH configuration to come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this feature for convenient debugging and development of a DIH configuration. However, since a DIH configuration can contain scripts, this parameter poses a security risk. The affected products can potentially be exposed to the public internet, making them vulnerable to exploitation.\n",
"status": "DISABLED",
"vendor_names": [
"apache"
],
"affected_software": [
{
"NAME": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*",
"VERSION_START_INCLUDING": null,
"VERSION_START_EXCLUDING": null,
"VERSION_END_INCLUDING": null,
"VERSION_END_EXCLUDING": "8.2.0",
"VENDOR": "apache",
"PRODUCT": "solr",
"VERSION": "*"
}
],
"severity_score": 7.2,
"cwe_ids": [
"CWE-94"
],
"epss_score": 0.9605,
"references": [
"https://issues.apache.org/jira/browse/SOLR-13669"
],
"remediation_guidance": "Exploiting this vulnerability may lead to remote code execution, which could compromise the security and integrity of the affected system. To address this issue, follow these steps:\n\n1. Upgrade to Apache Solr 8.2.0 or later, which is secure by default.\n2. Alternatively, edit the solrconfig.xml to configure all DataImportHandler usages with an \"invariants\" section listing the \"dataConfig\" parameter set to an empty string.\n3. Ensure your network settings are configured so that only trusted traffic communicates with Solr, especially to the DIH request handler. This is a best practice for all Solr installations.\n\nBy implementing these fixes and mitigations, you can protect your Apache Solr installation from the remote code execution vulnerability described in CVE-2019-0193.\n",
"first_published": 1699326060000,
"created": 1711058940000,
"count_vulnerable_services": null
}
]
}
}Enable or disable vulnerability tests.
To view vulnerability test results, use the Get All Services or Get Service Details endpoints.
Header parameters
AuthorizationstringRequired
{api_key}
x-xdr-auth-idstringRequired
{api_key_id}
Body
Responses
200
OK
No content
post/public_api/v1/assets/bulk_update_vulnerability_tests
POST /public_api/v1/assets/bulk_update_vulnerability_tests HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 113
{
"request_data": {
"test_names": [
"Apache Solr DataImportHandler Code Injection Vulnerability"
],
"status": "Enabled"
}
}200
OK
No content
Last updated
Was this helpful?