Endpoint Management
APIs for managing endpoints
Get a list of all the agent versions to use for creating a distribution list.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/distributions/get_versions HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"reply": {
"windows": [
"text"
],
"linux": [
"text"
],
"macos": [
"text"
]
}
}Gets a list of all of your endpoints. The response is concatenated using AND condition (OR is not supported).
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/endpoints/get_endpoints HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"reply": [
{
"agent_id": "<agent_id>",
"agent_status": "DISCONNECTED",
"operational_status": "PROTECTED",
"host_name": "<hostname>",
"agent_type": "Workstation",
"ip": [
"<ip_address>"
],
"last_seen": 1678012587521,
"tags": {
"server_tags": [],
"endpoint_tags": []
},
"users": [
"user"
]
}
]
}Get the policy name for a specific endpoint.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/endpoints/get_policy HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 48
{
"request_data": {
"endpoint_id": "<endpoint ID>"
}
}{
"reply": {
"policy_name": "Windows Default"
}
}Delete the selected endpoints. You can delete up to 1000 endpoints.
Note: Endpoints are deleted from Cortex UI, however they still exist in the database.
When filtering by multiple fields:
Response is concatenated using AND condition (OR is not supported).
Maximum result set size is 1000.
Offset is the zero-based number of cases from the start of the result set.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/endpoints/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 101
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<endpoint ID>"
]
}
]
}
}Create an installation package. This is an async call that returns the distribution ID; it does not mean that the creation succeeded. To confirm the package has been created, check the status of the distribution by running the Get Distribution Status API.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/distributions/create HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 317
{
"request_data": {
"name": "<installation package name>",
"package_type": "upgrade",
"agent_version": "windows_version",
"deployment_platform": "standard",
"default_namespace": "cortex-xdr",
"run_on_master_node": true,
"run_on_all_nodes": false,
"endpoint_tags": [
"Administrator",
"DevTeam"
],
"description": "Created using Public APIs"
}
}{
"reply": {
"distribution_id": "text"
}
}Retrieves a paginated list of existing agent installations and metadata based on optional filters and sorting criteria.
This endpoint allows you to:
Retrieve existing agent installations or filter by specific criteria
Paginate through large result sets
Sort results by any field in ascending or descending order
Get total count and filtered count of agent installations
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Successful response containing the list of distributions matching the criteria
Response object containing the list of distributions and metadata
Bad Request - Invalid request parameters or malformed JSON
Internal Server Error - An unexpected error occurred on the server
POST /public_api/v1/distributions/get_distributions HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 626
{
"request_data": {
"search_from": 0,
"search_to": 5,
"sort": {
"field": "distribution_id",
"keyword": "asc"
},
"filters": [
{
"field": "distribution_id",
"operator": "eq",
"value": "068bcaad02974ac5b223bfa786e7573c"
},
{
"field": "name",
"operator": "contains",
"value": "macos-369121"
},
{
"field": "description",
"operator": "contains",
"value": "Production-ready macos agent installer with enhanced monitoring capabilities"
},
{
"field": "package_type",
"operator": "eq",
"value": "standalone"
},
{
"field": "platform",
"operator": "eq",
"value": "macos"
},
{
"field": "agent_version",
"operator": "contains",
"value": "9.1."
},
{
"field": "status",
"operator": "eq",
"value": "completed"
}
]
}
}{
"reply": {
"data": [
{
"distribution_id": "068bcaad02974ac5b223bfa786e7573c",
"name": "macos-369121",
"description": "Production-ready macos agent installer with enhanced monitoring capabilities",
"package_type": "standalone",
"platform": "macos",
"agent_version": "9.1.0.9877",
"status": "completed",
"tags": [
"production",
"stable"
],
"eol_time": 1735689600,
"created_by": "John Doe",
"creation_time": 1704067200,
"modification_time": 1704153600,
"supported_packages": [
"pkg"
]
}
],
"filter_count": 1,
"total_count": 10
}
}Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.
When filtering by multiple fields:
Response is concatenated using AND condition (OR is not supported).
Maximum result set size is 100.
Offset is the zero-based number of cases from the start of the result set.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/device_control/get_violations HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"total_count": 1,
"result_count": 1,
"violations": [
{
"hostname": "text",
"username": "text",
"ip": "text",
"timestamp": 1,
"violation_id": 1,
"type": "text",
"vendor_id": "text",
"vendor": "text",
"product_id": "text",
"product": "text",
"serial": "text",
"endpoint_id": "text"
}
]
}
}Check the status of the installation package.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/distributions/get_status HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 43
{
"request_data": {
"distribution_id": "text"
}
}{
"reply": {
"status": "text"
}
}Get the distribution URL for downloading the installation package.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/distributions/get_dist_url HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 77
{
"request_data": {
"distribution_id": "<distribution ID>",
"package_type": "x86"
}
}{
"reply": {
"distribution_url": "<DOWNLOAD_URL>"
}
}Set or modify an Alias field for your endpoints.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
true=The alias name was set or modified successfully.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/endpoints/update_agent_name HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 128
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<distribution_id>"
]
}
],
"alias": "<alias_name>"
}
}trueCreate a new agent tag in the endpoint_tags family.
The tag name must be a string of no more than 64 characters and must not contain wildcard characters (for example, *). If a tag with the same name already exists, the request fails with a 409 error.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Confirmation message, for example: "Successfully created a new tag - my-tag".
Bad Request. The tag is missing, not a string, exceeds 64 characters, or contains invalid characters.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Conflict. A tag with the same name already exists.
POST /public_api/v1/tags/agents/create HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 33
{
"request_data": {
"tag": "my-tag"
}
}textAssign one or more tags to one or more endpoints.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
true=The tag name was assigned successfully.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
x Internal server error. A unified status for API communication type errors.
POST /public_api/v1/tags/agents/assign HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 124
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<distribution_id>"
]
}
],
"tag": "<tag_name>"
}
}trueRemove one or more tags from one or more endpoints.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
true=tag name removed successfully.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Unauthorized access. User does not have the required license type to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/tags/agents/remove HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 124
{
"request_data": {
"filters": [
{
"field": "endpoint_id_list",
"operator": "in",
"value": [
"<distribution_id>"
]
}
],
"tag": "<tag_name>"
}
}trueGets a list of filtered endpoints.
The response is concatenated using AND condition (OR is not supported).
The maximum result set size is 100.
Offset is the zero-based number of endpoints from the start of the result set.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/endpoints/get_endpoint HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 444
{
"request_data": {
"search_from": 0,
"search_to": 1,
"sort": {
"field": "endpoint_id",
"keyword": "asc"
},
"filters": [
{
"field": "group_name",
"operator": "in",
"value": [
"Test-Group-01"
]
},
{
"field": "endpoint_status",
"operator": "in",
"value": [
"disconnected"
]
},
{
"field": "dist_name",
"operator": "in",
"value": [
"papi-test"
]
},
{
"field": "scan_status",
"operator": "in",
"value": [
"none",
"pending",
"in_progress",
"pending_cancellation",
"aborted",
"success",
"canceled",
"error"
]
}
]
}
}{
"reply": {
"total_count": 1,
"result_count": 1,
"endpoints": [
{
"endpoint_id": "<endpoint ID>",
"endpoint_name": "<endpoint name>",
"endpointTags": "<tag name>",
"endpoint_type": "<endpoint type>",
"endpoint_status": "CONNECTED",
"operational_status_details": [
{
"title": "XDR Data Collection not running or not sent",
"reason": "Linux kernel version is not supported"
},
{
"title": "BTP not working",
"reason": "Linux kernel version is not supported"
},
{
"title": "Antimalware flow is asynchronous",
"reason": "Linux kernel version is not supported"
},
{
"title": "Local privilege escalation",
"reason": "Linux kernel version is not supported"
}
],
"os_type": "AGENT_OS_WINDOWS",
"os_version": "8.0.xxx",
"ip": [
"<IP address>"
],
"ipv6": [],
"public_ip": "<IP address>",
"users": [
"XDR"
],
"domain": "WORKGROUP",
"alias": "",
"first_seen": 1606218761377,
"last_seen": 1606218769163,
"content_version": "",
"installation_package": "XDR",
"active_directory": null,
"install_date": 1606218762089,
"endpoint_version": "<version>",
"is_isolated": "AGENT_UNISOLATED",
"isolated_date": null,
"group_name": [],
"operational_status": "PARTIALLY_PROTECTED",
"scan_status": "SCAN_STATUS_NONE",
"content_release_timestamp": 1636285746000,
"last_content_update_time": 1636381954285,
"content_status": "up_to_date",
"operating_system": "Debian 10.11",
"mac_address": [
"42:00:00:00:00:00"
],
"assigned_prevention_policy": "Linux Default",
"assigned_extensions_policy": ""
}
]
}
}Initiate forensics triage for the specified agents.
Maximum of 10 concurrent triage actions at a time.
Specified agents must have Forensics License enabled.
Specified agents must be the same OS, Windows or macOS, but not a mixture of both.
Specified configuration must have type "Online = True".
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
OK
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/triage_endpoint HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 63
{
"request_data": {
"agent_ids": [
"text"
],
"collector_uuid": "text"
}
}{
"reply": {
"group_action_id": 325,
"successful_agent_ids": [
"5111c5eb93944e2f97674db4f36b4211"
],
"unsuccessful_agent_ids": []
}
}Permanently delete one or more endpoint tags from the system. Tags that are currently assigned to endpoints cannot be deleted. A maximum of 10 tags can be deleted per API call.
Required role: Admin
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
Successful response — tags were permanently deleted from the system.
Bad Request. The request failed validation or the specified tags could not be deleted.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. Missing required license.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error.
POST /public_api/v1/tags/agents/delete_permanently HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 50
{
"request_data": {
"tags": [
"text"
],
"reason": "text"
}
}{
"reply": {
"message": "Tags were successfully deleted from the system"
}
}Creates an upgrade action for the specified endpoints to upgrade their agents to the target versions.
You can specify target versions per operating system and optionally define a timeframe window for the upgrade.
Required license: Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.
{api_key}
{api_key_id}
Successful response
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/endpoints/upgrade HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 131
{
"request_data": {
"endpoint_ids": [
"endpoint_id_1",
"endpoint_id_2"
],
"target_versions": {
"windows": "8.6.0.1234",
"linux": "8.6.0.5678"
}
}
}{
"reply": {
"summary": "Upgrade action created successfully.",
"details": [
"Windows: 2 endpoints queued for upgrade to 8.6.0.1234",
"Linux: 1 endpoint queued for upgrade to 8.6.0.5678"
]
}
}Returns a list of endpoint security profiles of the requested type. Optionally filters by a list of profile IDs.
Required permission: profiles_view
Notes:
File-Integrity-Monitoring (FIM) extension profiles are omitted when FIM is disabled for the profile's OS type.
is_in_user_scopeandat_riskare removed from every profile object before the response is returned.
{api_key}
{api_key_id}
OK. Profiles retrieved successfully
Successful response envelope
Bad request. Possible causes:
typefield is missing (TypeIsMandatory)typevalue is notpreventionorextension(TypeNotSupported)profile_idsis provided but is not a list (ProfileIDsMustBeAList)- Any internal error during profile retrieval (
GeneralError)
Unauthorized – missing or invalid API-key headers
Forbidden. Possible causes:
- The API Key does not have the
profiles_viewpermission - The feature flag
ALPHAFEATURES_PUBLIC_API_GET_POLICIESis disabled - The tenant is a secondary HA replica
Internal Server Error
POST /public_api/v1/endpoints/get_profiles HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 38
{
"request_data": {
"type": "prevention"
}
}{
"reply": [
{
"id": 1,
"uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"name": "Default Malware Profile",
"type": "AGENT_OS_LINUX",
"platform": "AGENT_OS_WINDOWS",
"is_default": true,
"is_global": false,
"is_disabled": false,
"associated_targets": [
"All endpoints"
],
"usage_count": 5,
"description": "Default anti-malware profile for Windows",
"created_by": "system",
"created_by_pretty": "Palo Alto Networks",
"creation_time": 1700000000000,
"modified_by": "admin@example.com",
"modified_by_pretty": "Admin User",
"modification_time": 1710000000000,
"modules": {
"malware": {
"mode": "prevent"
}
}
},
{
"id": 2,
"uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
"name": "Custom Exploit Profile",
"type": "AGENT_OS_IOS",
"platform": "AGENT_OS_MAC",
"is_default": false,
"is_global": false,
"is_disabled": false,
"associated_targets": [
"macOS Servers"
],
"usage_count": 2,
"description": null,
"created_by": "admin@example.com",
"created_by_pretty": "Admin User",
"creation_time": 1705000000000,
"modified_by": "admin@example.com",
"modified_by_pretty": "Admin User",
"modification_time": 1705000000000,
"modules": {}
}
]
}Get a list of supported legacy exception modules available in the tenant. Each module entry includes its module_id, supported platforms, and the conditions_definition schema that must be used when creating or editing a legacy exception rule for that module.
Note: No request body required. Send an empty body.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241OK
Bad Request. Invalid Input.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal Server Error.
POST /public_api/v1/legacy_exceptions/get_modules HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"reply": [
{
"module_id": 1,
"pretty_name": "Malware > Respond to Malicious Causality Chains",
"title": "Respond to Malicious Causality Chains",
"label": "Allow List of Remote Ipv4/ipv6 Ip Address, Range or Cidr",
"profile_type": "Malware",
"platforms": [
"Windows",
"macOS"
],
"conditions_definition": {
"remoteIpsWhitelist": {
"schema": {
"type": "array",
"items": {
"type": "string"
},
"minItems": 1
},
"description": "List of valid Ipv4/ipv6 Ip Address, Ranges or Cidrs"
}
}
}
]
}Retrieves a paginated list of Legacy Exception rules for agents based on optional filters and sorting criteria.
This endpoint allows you to:
Retrieve all rules or filter by specific criteria
Sort results by any field in ascending or descending order
Paginate through large result sets
Get total count and filtered count of rules
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241OK
A legacy exception record as returned by the fetch API.
Bad Request
POST /public_api/v1/legacy_exceptions/fetch HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 208
{
"request_data": {
"search_from": 0,
"search_to": 10,
"sort": {
"field": "id",
"keyword": "desc"
},
"filters": [
{
"field": "status",
"operator": "eq",
"value": "ENABLED"
},
{
"field": "platform",
"operator": "eq",
"value": "Windows"
}
]
}
}{
"reply": {
"DATA": [
{
"id": "d9c06bfa3f9b45a7a0196244e68d181d",
"rule_name": "Legacy Exception Rule 1",
"platform": "Linux",
"conditions": "Process Name = Another test process AND Modules = Disable Injection OR Process Name = Test process AND Modules = Child Process Protection",
"module": 43,
"module_name": "Exceptions > Process Exceptions",
"description": "rule 1",
"generating_alert_id": null,
"created_by": "John Doe",
"modification_time": 1772111647000,
"user_email": "john.doe@example.com",
"status": "ENABLED",
"profile_ids": [
27
],
"associated_targets": [
"Any"
],
"is_in_user_scope": true
},
{
"id": "0a2661779a2d4a87b051158ea47f0022",
"rule_name": "Legacy Exception Rule 2",
"platform": "Windows",
"conditions": "Remote IP Address : 192.168.1.45",
"module": 1,
"module_name": "Malware > Respond to Malicious Causality Chains",
"description": "test",
"generating_alert_id": null,
"created_by": "Jane Doe",
"modification_time": 1772089294000,
"user_email": "jane.doe@example.com",
"status": "ENABLED",
"profile_ids": [
29
],
"associated_targets": [],
"is_in_user_scope": true
}
],
"FILTER_COUNT": 2,
"TOTAL_COUNT": 2
}
}Create a new legacy exception rule.
Prerequisites:
Use Get Legacy Exceptions Modules API to discover available
moduleIDs, supportedplatforms, and the requiredconditionsstructure.Use Get endpoint security profiles to discover existing profile IDs to pass as
profile_ids.New profiles can be created via Add Prevention Profile.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241OK
The ID of the newly created legacy exception rule.
f87c6f24205249d896677ab63626d4f4POST /public_api/v1/legacy_exceptions/add HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 233
{
"request_data": {
"name": "Test Legacy Exception rule 1",
"platform": "Windows",
"module": 1,
"profile_ids": [
29
],
"status": "ENABLED",
"scope": "PROFILE",
"description": "my legacy rule desc",
"conditions": {
"remoteIpsWhitelist": [
"192.168.1.45"
]
}
}
}OK
{
"reply": "f87c6f24205249d896677ab63626d4f4"
}Update an existing legacy exception rule.
Prerequisites:
To get the required fields:
Use Fetch Legacy Exception Rules to retrieve existing exception details.
The
idfield in the fetch API response corresponds toexception_idin this request.The
rule_namefield in the fetch API response corresponds tonamein this request.The
scopefield is not returned by the fetch API. Use"PROFILE"ifprofile_idsis non-empty in the fetch response; use"GLOBAL"ifprofile_idsis[].
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241OK
The ID of the edited legacy exception rule.
f87c6f24205249d896677ab63626d4f4POST /public_api/v1/legacy_exceptions/edit HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 315
{
"request_data": {
"exception_id": "f87c6f24205249d896677ab63626d4f4",
"update_data": {
"name": "Edit legacy exception rule",
"platform": "Windows",
"module": 1,
"profile_ids": [
29
],
"status": "DISABLED",
"scope": "PROFILE",
"description": "my legacy desc",
"conditions": {
"remoteIpsWhitelist": [
"192.168.1.45",
"10.0.0.10-10.0.0.20"
]
}
}
}
}OK
{
"reply": "f87c6f24205249d896677ab63626d4f4"
}Deletes one or more legacy exception rules by their IDs.
Use Fetch Legacy Exception Rules endpoint to retrieve the id values of the exceptions you want to delete.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241OK
The number of successfully deleted legacy exception rules.
1POST /public_api/v1/legacy_exceptions/delete HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 71
{
"request_data": {
"exception_ids": [
"f87c6f24205249d896677ab63626d4f4"
]
}
}OK
{
"reply": 1
}Create a new prevention profile with specified configuration.
{api_key}
{api_key_id}
Name of the profile.
Type of the prevention profile.
Platform (OS) for the profile.
Optional description of the profile.
Successful response
The ID of the newly created profile.
Bad Request. Invalid Input.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal Server Error.
POST /public_api/v1/profiles/prevention/add HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 245
{
"name": "Windows_Malware_Prevention",
"profile_type": "malware",
"platform": "windows",
"description": "Standard prevention profile for Windows endpoints",
"modules": {
"wildfire": {
"status": "enabled"
},
"behavioral_threat_protection": {
"status": "enabled"
}
}
}{
"reply": 12345
}Add one or more signer common names to the allowlist of a specific Windows malware prevention profile. This endpoint only works on Windows Malware profiles.
{api_key}
{api_key_id}
The name of the Windows malware prevention profile. Cannot be 'Default'.
A single signer CN string or a list of signer CN strings to add. Total signers cap is 1000.
Successful response
Bad Request. Invalid Input.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal Server Error.
POST /public_api/v1/profiles/add_signer_cn_to_allowlist HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 221
{
"profile_name": "Windows_Malware_Prevention",
"signers": [
"CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
"CN=Palo Alto Networks, O=Palo Alto Networks, L=Santa Clara, S=California, C=US"
]
}{
"reply": null
}Update an existing prevention profile with new configuration. At least one field in update_data (name, description, or modules) must be provided.
Note: Default profiles cannot be edited.
{api_key}
{api_key_id}
The ID of the profile to edit.
Successful response
True if the profile was successfully updated.
Bad Request. Invalid Input.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal Server Error.
POST /public_api/v1/profiles/prevention/edit HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 132
{
"profile_id": 12345,
"update_data": {
"description": "Updated description for the profile",
"modules": {
"wildfire": {
"status": "enabled"
}
}
}
}{
"reply": true
}Get a list of modules for a specific prevention profile type and platform.
{api_key}
{api_key_id}
The type of prevention profile.
The platform (OS) for the profile.
Successful response
Module definition object.
Bad Request. Invalid Input.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal Server Error.
POST /public_api/v1/profiles/prevention/get_modules HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 47
{
"profile_type": "malware",
"platform": "windows"
}{
"reply": [
{
"id": "additionalProcesses",
"profile_type": "Exploit",
"platform": "macOS",
"pretty_name": "Exploit Protection for Additional Processes",
"schema": {
"type": "object",
"properties": {
"mode": {
"type": "string",
"enum": [
"block",
"report",
"disabled"
],
"description": "Action Mode"
},
"processes": {
"type": "array",
"items": {
"type": "string",
"description": "Path Array"
}
}
},
"required": [
"mode",
"processes"
],
"additionalProperties": false
}
}
]
}Updates one or more prevention policy rules. Each item in edit_requests specifies a rule by its 32-character hexadecimal UUID and includes the fields to modify. Only explicitly provided (non-null) fields are updated; all others remain unchanged.
Constraints
The default (catch-all) rule (
is_any = true) cannot be modified forname,description, ortarget_filter.Profile IDs must exist, correspond to the correct profile type (exploit, malware, restrictions, agent_settings, or exceptions), and match the OS platform of the target rule.
Updates are applied atomically. If the policy has been modified since it was last retrieved, the request fails with a
409 Conflicterror due to stale data.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
All requested edits were applied successfully.
Always true on success.
trueBad request. Possible causes include:
- Missing required parameters (for example,
edit_requestsorid). - Invalid field values (for example, incorrect type or empty string).
- Invalid
target_filterstructure. - Unsupported filter field.
- Invalid operator for the specified filter field.
- Invalid value for the specified filter field.
- Attempt to modify metadata or
target_filterof the default (catch-all) rule. - Profile type does not match the expected type for the slot.
- Profile OS does not match the rule's platform.
A referenced rule ID or profile ID was not found.
Stale data conflict. The policy was modified by another actor since it was last read. Retry the operation.
Internal server error. The policy update failed for an unexpected reason, or the saved policy failed internal validation.
POST /public_api/v1/policies/prevention/edit HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 121
{
"request_data": {
"edit_requests": [
{
"id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4",
"name": "Updated Rule Name",
"malware_id": 42
}
]
}
}{
"reply": true
}Last updated
Was this helpful?