> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/response-action.md).

# Response Action

APIs for response actions

## Restore File

> Restore a quarantined file on a requested endpoints.\
> When filtering by multiple fields:\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Maximum result set size is 100.\
> \- Offset is the zero-based number of cases from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/restore":{"post":{"tags":["Response Action"],"summary":"Restore File","description":"Restore a quarantined file on a requested endpoints.\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 100.\n- Offset is the zero-based number of cases from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postRestore","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"file_hash":{"type":"string","description":"String that represents the file in hash. Hash must be a valid SHA256."},"endpoint_id":{"type":"string","description":"String that represents the endpoint ID.\nNote: if it is not specified, the request will run restore on all endpoints which relate to the quarantined file you defined."},"incident_id":{"type":"integer","description":"String representing the case ID.\nWhen included in the request, the Restore File action will appear in the Cortex Case View Timeline tab."}},"required":["file_hash"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"action_id":{"type":"string"},"endpoints_count":{"type":"string"}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## File Retrieval Details

> View the API required to call in order to download the file retrieved by the \[Retrieve File]\(<https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public\\_api-v1-endpoints-file\\_retrieval>) API request according to the action ID.\
> \
> The response contains a file hash you need to download and then unzip to view:\
> 1\. Download the file.\
> \
> \<!--\
> title: "Request Example"\
> \-->\
> \`\`\` curl\
> curl -XPOST "<https://api-{fqdn}/public\\_api/v1/download/\\>\<api\_value>" \
> -H "x-xdr-auth-id:{API\_KEY\_ID}"  \
> -H "Authorization:{API\_KEY}" \
> -H 'Content-Type:application/json' \
> \--output /tmp/file.zip\
> \`\`\`\
> 2\. Unzip the file: \`unzip /tmp/file.zip\`\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

````json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/actions/file_retrieval_details":{"post":{"tags":["Response Action"],"summary":"File Retrieval Details","description":"View the API required to call in order to download the file retrieved by the [Retrieve File](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public_api-v1-endpoints-file_retrieval) API request according to the action ID.\n\nThe response contains a file hash you need to download and then unzip to view:\n1. Download the file.\n\n<!--\ntitle: \"Request Example\"\n-->\n``` curl\ncurl -XPOST \"https://api-{fqdn}/public_api/v1/download/<api_value>\" \n-H \"x-xdr-auth-id:{API_KEY_ID}\"  \n-H \"Authorization:{API_KEY}\" \n-H 'Content-Type:application/json' \n--output /tmp/file.zip\n```\n2. Unzip the file: `unzip /tmp/file.zip`\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postFileRetrievalDetails","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"group_action_id":{"type":"string","description":"The action ID of the [Retrieve File](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public_api-v1-endpoints-file_retrieval) API response."}},"required":["group_action_id"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"object","properties":{"endpoint_ID":{"type":"string","description":"API required to call in order to download the retrieved result."}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
````

## Allow List Files

> Add files which do not exist in the allow or block lists to an allow list.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/hash_exceptions/allowlist":{"post":{"tags":["Response Action"],"summary":"Allow List Files","description":"Add files which do not exist in the allow or block lists to an allow list.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postAllowlist","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"hash_list":{"type":"array","description":"A list of hashed files you want to add to the allow list. Hash must be a valid SH256.","items":{"type":"string"}},"comment":{"type":"string","description":"Additional information regarding the action."},"incident_id":{"type":"integer","description":"The case ID related to the hash.\nWhen included in the request, the **Allow List** action will appear in the **Cortex Case View Timeline** tab."}},"required":["hash_list"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=File successfully added to the allow list."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Quarantine Status

> Retrieve the quarantine status for specified files.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/quarantine/status":{"post":{"tags":["Response Action"],"summary":"Get Quarantine Status","description":"Retrieve the quarantine status for specified files.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postStatus","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"files":{"type":"array","description":"Array of endpoint IDs, filepaths, and file hash.","items":{"type":"object","properties":{"endpoint_id":{"type":"string","description":"Endpoint ID"},"file_path":{"type":"string","description":"File hash. Must be a valid SHA256."},"file_hash":{"type":"string","description":"File path."}}}}},"required":["files"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","properties":{"endpoint_id":{"type":"string","description":"Endpoint ID."},"file_path":{"type":"string","description":"File path."},"file_hash":{"type":"string","description":"File hash."},"status":{"type":"boolean","description":"The file's status.\nTrue: The file is quarantined.\nFalse: The file is not quarantined."}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Quarantine Files

> Quarantine file on selected endpoints. You can select up to 1000 endpoints.\
> \
> Note: A success response means that the request reached the defined endpoints, however if the file was not found there, no quarantine action will take place. To ensure if the file has been quarantined, check the Cortex XDR Action Center.\
> \
> When filtering by multiple fields:\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Maximum result set size is 1000.\
> \- Offset is the zero-based number of cases from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/quarantine":{"post":{"tags":["Response Action"],"summary":"Quarantine Files","description":"Quarantine file on selected endpoints. You can select up to 1000 endpoints.\n\nNote: A success response means that the request reached the defined endpoints, however if the file was not found there, no quarantine action will take place. To ensure if the file has been quarantined, check the Cortex XDR Action Center.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 1000.\n- Offset is the zero-based number of cases from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postQuarantine","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list"],"description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs."},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings"},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: Array of strings","items":{"type":"string"}}},"required":["field","operator","value"]}},"file_path":{"type":"string","description":"The path of the file you want to quarantine. You must enter a proper path and not symbolic links."},"file_hash":{"type":"string","description":"Case ID.\nWhen included in the request, the **Quarantine File** action will appear in the **Cortex Case View Timeline** tab."}},"required":["filters","file_path","file_hash"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"Action ID of action to quarantine selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the file quarantine succeeded either:\n- In the Cortex console, navigate to **Response** > **Action Center** and search for the action ID. Make sure the **Action ID** field is selected in the table **Layout** settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public_api-v1-actions-get_action_status) API request."},"status":{"type":"string","description":"Integer representing whether the action:\n- 1: succeeded\n- 0: failed"},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Block List Files

> Add files which do not exist in the allow or block lists to a block list. You can view the block list in the UI at \*\*Investigation & Response\*\* > Response > \*\*Action Center\*\* > \*\*Block List\*\*.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/hash_exceptions/blocklist":{"post":{"tags":["Response Action"],"summary":"Block List Files","description":"Add files which do not exist in the allow or block lists to a block list. You can view the block list in the UI at **Investigation & Response** > Response > **Action Center** > **Block List**.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postBlocklist","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"hash_list":{"type":"array","description":"A list of hashed files you want add to a block list. Hash must be a valid SH256.","items":{"type":"string"}},"comment":{"type":"string","description":"Additional information regarding the action."},"incident_id":{"type":"integer","description":"The case ID related to the hash.\nWhen included in the request, the **Block List** action appears in the **Cortex Case View Timeline** tab."}},"required":["hash_list"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=File successfully added to block list."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Unisolate Endpoints

> Reverse the isolation of one or more endpoints in single request.\
> \
> Note: You can only send a request with either \`endpoint\_id\` to unisolate one endpoint or with filters to unisolate more than one endpoint. An error is raised if you try to use both \`endpoint\_id\` and the filters.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/unisolate":{"post":{"tags":["Response Action"],"summary":"Unisolate Endpoints","description":"Reverse the isolation of one or more endpoints in single request.\n\nNote: You can only send a request with either `endpoint_id` to unisolate one endpoint or with filters to unisolate more than one endpoint. An error is raised if you try to use both `endpoint_id` and the filters.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postUnisolate","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"One of `endpoint_id` of `filters` is required, but not both.","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"filters":{"type":"array","description":"An array of filter fields for unisolating a number of endpoints at once.\nNote: This field is only required if unisolating more than one endpoint.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list"],"description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs."},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings"},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: List of strings","items":{"type":"string"}}},"required":["field","operator","value"]}},"endpoint_id":{"type":"string","description":"The ID of the endpoint to unisolate.\n\nNote: this field is only required if unisolating one endpoint."},"incident_id":{"type":"string","description":"Case ID.\nWhen included in the request, the **Unisolate Endpoints** action will appear in the **Cortex Case View Timeline** tab."}},"required":["endpoint_id"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of the action to unisolate selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the endpoint was restored either:\n- In the Cortex XDR console, navigate to **Response** > **Action Center** > **Isolation** and search for the action ID. Make sure the **Action ID** field is selected in the table **Layout** settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public_api-v1-actions-get_action_status) API request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Cancel Scan Endpoints

> Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are in \*\*Pending\*\* or in \*\*Progress\*\* status.\
> \
> When filtering by multiple fields:\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Offset is the zero-based number of endpoints from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/abort_scan":{"post":{"tags":["Response Action"],"summary":"Cancel Scan Endpoints","description":"Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are in **Pending** or in **Progress** status.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Offset is the zero-based number of endpoints from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postAbortScan","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"filters":{"description":"An array of filter fields to filter which endpoints to cancel scanning.\nTo cancel scan of all endpoints, use the value \"all\".","oneOf":[{"type":"array","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list","dist_name","first_seen","last_seen","ip_list","group_name","platform","alias","isolate","hostname","username"],"description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `dist_name`: Name of the distribution list.\n- `first_seen`: When an endpoint was first seen.\n- `last_seen`: When an endpoint was last seen.\n- `ip_list`: List of IP addresses.\n- `group_name`: Name of endpoint group.\n- `platform`: Type of operating system.\n- `alias`: Endpoint alias name.\n- `isolate`: If an endpoint has been isolated.\n- `hostname`: Name of host.\n- `username`: Name of user."},"operator":{"type":"string","enum":["in","gte","lte"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`: List of strings\n- `ip_list`: List of strings, for example 192.168.5.12\n- `platform`: Permitted values are `windows`, `linux`, `macos`, `android`\n- `isolate`: Permitted values are `isolated` or `unisolated`\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`\n`gte` / `lte`\n- `first_seen` and `last_seen`:  Integer in timestamp epoch milliseconds."},"value":{"description":"Value that this filter must match. Valid keywords:\n- `first_seen`, `last_seen`: Integer in timestamp epoch milliseconds, UTC timezone\n- `endpoint_id_list`, `dist_name`, `hostname`, `alias`, `group_name`: List of strings\n- `ip_list`: List of strings, for example 192.168.5.12\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `platform`: Permitted values are `windows`, `linux`, `macos`, or `android`.","oneOf":[{"type":"array","items":{"type":"string"}},{"type":"integer"},{"type":"string"}]}},"required":["field","operator","value"]}},{"type":"string"}]},"incident_id":{"type":"string","description":"Case ID.\nWhen included in the request, the **Cancel Scan Endpoints** action will appear in the **Cortex Case View Timeline** tab."}},"required":["filters"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of action to cancel scan selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the scan succeeded either:\n- In Cortex XDR console, navigate to **Response** > **Action Center** and search for the action ID. Make sure the **Action ID** field is selected in the table Layout settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public_api-v1-actions-get_action_status) API request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Scan Endpoints

> Run a scan on selected endpoints.\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Offset is the zero-based number of cases from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/scan":{"post":{"tags":["Response Action"],"summary":"Scan Endpoints","description":"Run a scan on selected endpoints.\n- Response is concatenated using AND condition (OR is not supported).\n- Offset is the zero-based number of cases from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postScan","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Note: You can send a request to retrieve either **all** or **filtered** results.","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"filters":{"type":"string","enum":["all"],"description":"An array of filter fields. To scan all endpoints, use the value `all`."},"incident_id":{"type":"string","description":"Case ID.\nWhen included in the request, the **Scan Endpoints** action will appear in the **Cortex Case View Timeline** tab."}},"required":["filters"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of action to scan selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the scan was successful either:\n- In Cortex XDR console, navigate to **Response** > **Action Center** > **All Actions** and search for the action ID. Make sure the **Action ID** field is selected in the table **Layout** settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public_api-v1-actions-get_action_status) API request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Action Status

> Retrieve the status of the requested actions according to the action ID.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/actions/get_action_status":{"post":{"tags":["Response Action"],"summary":"Get Action Status","description":"Retrieve the status of the requested actions according to the action ID.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"postGetActionStatus","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"group_action_id":{"type":"integer","description":"Action ID of the selected request."}},"required":["group_action_id"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"data":{"type":"object","properties":{"agent_id":{"type":"string","enum":["PENDING","IN_PROGRESS","CANCELLED","PENDING_ABORT","ABORTED","EXPIRED","COMPLETED_PARTIAL","COMPLETED_SUCCESSFULLY","FAILED","TIMEOUT"]}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"object","description":"JSON object containing the query result.","additionalProperties":{}},"errorReasons":{"type":"object","description":"Returns all error messages the agent returns to allow for easier analysis."}}}}}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"object","description":"JSON object containing the query result.","additionalProperties":{}},"errorReasons":{"type":"object","description":"Returns all error messages the agent returns to allow for easier analysis."}}}}}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"object","description":"JSON object containing the query result.","additionalProperties":{}},"errorReasons":{"type":"object","description":"Returns all error messages the agent returns to allow for easier analysis."}}}}}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"object","description":"JSON object containing the query result.","additionalProperties":{}},"errorReasons":{"type":"object","description":"Returns all error messages the agent returns to allow for easier analysis."}}}}}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"object","description":"JSON object containing the query result.","additionalProperties":{}},"errorReasons":{"type":"object","description":"Returns all error messages the agent returns to allow for easier analysis."}}}}}}}}}}}}}
```

## Retrieve File

> Retrieve files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints.\
> \- Response is concatenated using AND condition (OR is not supported).\
> \- Offset is the zero-based number of cases from the start of the result set.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/file_retrieval":{"post":{"tags":["Response Action"],"summary":"Retrieve File","description":"Retrieve files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints.\n- Response is concatenated using AND condition (OR is not supported).\n- Offset is the zero-based number of cases from the start of the result set.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"post-public_api-v1-endpoints-file_retrieval","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list"],"description":"Identifies the field the filter must match:\n- `endpoint_id_list`"},"operator":{"type":"string","enum":["in"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- 'endpoint_id_list'"},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- 'endpoint_id_list': List of strings.","items":{"type":"string"}}},"required":["field","operator","value"]}},"files":{"type":"object","description":"One of the operating system types must be included.","properties":{"windows":{"type":"array","items":{"type":"string"}},"linux":{"type":"array","items":{"type":"string"}},"macos":{"type":"array","items":{"type":"string"}}}},"incident_id":{"type":"string","description":"Case ID. When included in the request, the Retrieve File action will appear in the Cortex Case View Timeline tab."}},"required":["filters","files"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of action to retrieve files from selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the file was retrieved successfully either: in the Cortex XDR console, navigate to Response > Action Center > Isolation and search for the action ID. Make sure the Action ID field is selected in the table Layout settings by selecting the three vertical dots.\nTo view the file, send a File Retrieval Details request."},"status":{"type":"string"},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request"},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters."},"402":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal server error. A unified status for API communication type errors."}}}}}}
```

## Isolate Endpoints

> Isolate one or more endpoints in a single request. Request is limited to 1000 endpoints.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/isolate":{"post":{"tags":["Response Action"],"summary":"Isolate Endpoints","description":"Isolate one or more endpoints in a single request. Request is limited to 1000 endpoints.\n\n**Required license:** Cortex Cloud Runtime Security. In Cortex Cloud Posture Security, you need the Cortex Cloud Runtime Security add-on.","operationId":"post-public_api-v1-endpoints-isolate","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"Note: You can send a request with either `endpoint_id` for isolating one endpoint or `filters` for isolating more than one endpoint. You cannot use both parameters in the same call.","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"filters":{"type":"array","description":"Array of filtered fields for isolating a number of endpoints at once.\nNote: Only required if isolating more than one endpoint.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list"],"description":"Identifies a list the filters match. Filters are\nbased on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs."},"operator":{"type":"string","enum":["in"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list` —List of strings"},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: List of strings","items":{"type":"string"}}},"required":["field","operator","value"]}},"endpoint_id":{"type":"string","description":"Identifies the endpoint to isolate.\nNote: Only required if isolating one endpoint."},"incident_id":{"type":"string","description":"The case ID.\nWhen included in the request, the **Isolate Endpoints action** will appear in the Cortex Case View Timeline tab."}},"required":["endpoint_id"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"Action ID to scan selected endpoints.\nThe response only indicates the request was successfully sent to the endpoint. To track if the isolation succeeded either:\n- In the Cortex console, navigate to **Response** > **Action Center** > **Isolation** and search for\nthe action ID. Make sure the Action ID field is\nselected in the table Layout settings by selecting\nthe vertical ellipses.\n- Send a [Get Action Status](https://app.gitbook.com/s/ZuJbX2x7VQJhNovscCwE/cortex-platform/response-action#post-public_api-v1-actions-get_action_status) request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON."},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters."},"402":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal server error. A unified status for API communication type errors."}}}}}}
```

## Get triage presets

> Get all triage preset information including triage name, platform, description, created by, and triage type.
> \\
>
> \
> \*\*Required license:\*\* In Cortex Cloud Runtime Security, requires the Forensics add-on. Not supported in Cortex Cloud Posture Management.

```json
{"openapi":"3.0.0","info":{"title":"Cortex Cloud Platform APIs","version":"Cortex Cloud 2.2"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/get_triage_presets":{"post":{"tags":["Response Action"],"summary":"Get triage presets","description":"Get all triage preset information including triage name, platform, description, created by, and triage type.\r\n\r\n**Required license:** In Cortex Cloud Runtime Security, requires the Forensics add-on. Not supported in Cortex Cloud Posture Management.","operationId":"post-public_api-v1-get_triage_presets","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object"}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"triage_presets":{"type":"array","items":{"type":"object","properties":{"uuid":{"type":"string","description":"Preset/configuration UUID"},"name":{"type":"string","description":"Triage name"},"os":{"type":"string","description":"Triage operating system/platform: `Windows` or `macOS`"},"description":{"type":"string","description":"Description"},"created_by":{"type":"string","description":"Triage was created by"},"type":{"type":"string","description":"Triage type: Online, Offline, Online/Offline"}}}}}}}}}}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-api/cortex-platform/response-action.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.