System Management
APIs for system management
Perform a health check of your Cortex environment.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
OK
The condition of your Cortex environment.
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
GET /public_api/v1/healthcheck HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
{
"status": "text"
}Get your tenant license information.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal Server Error
POST /public_api/v1/system/get_tenant_info HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"reply": {
"xsiam_premium_expiration": 12478046378,
"purchased_xsiam_premium": {
"users": 100,
"gb": 100,
"agents": 500
},
"pro_per_endpoint_expiration": 12478046378,
"purchased_pro_per_endpoint": {
"agents": 200
},
"data_enabled_pro_per_endpoint": 26,
"prevent_expiration": 0,
"purchased_prevent": 0,
"installed_prevent": 27,
"pro_tb_expiration": 12478046378,
"purchased_pro_gb": {
"gb": 1
},
"installed_pro_tb": 0,
"compute_unit_expiration": 0,
"purchased_compute_unit": 16,
"host_insights_expiration": 12478046378,
"enabled_host_insights": 26,
"purchased_host_insights": 400,
"forensics_expiration": 0,
"enabled_forensics": 12
}
}Retrieve a list of the current users in your environment.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/rbac/get_users HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"reply": [
{
"user_email": "user1@acme.com",
"user_first_name": "<first name>",
"user_last_name": "<last name>",
"role_name": "Account Admin",
"last_logged_in": 1640024700241,
"user_type": "CSP",
"groups": [],
"scope": []
},
{
"user_email": "user2@acme.com",
"user_first_name": "<first name>",
"user_last_name": "<last name>",
"role_name": "Account Admin",
"last_logged_in": null,
"user_type": "CSP",
"groups": [],
"scope": []
},
{
"user_email": "user3@acme.com",
"user_first_name": "<first name>",
"user_last_name": "<last name>",
"role_name": "Investigator",
"last_logged_in": null,
"user_type": "CSP",
"groups": [],
"scope": []
}
]
}Retrieve information about one or more roles created in your environment.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/rbac/get_roles HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 49
{
"request_data": {
"role_names": [
"Role1",
"Role2"
]
}
}{
"reply": [
{
"pretty_name": "Role1",
"permissions": [
"Reports",
"Playbooks",
"Datasets Access Control",
"Dashboards",
"Scripts"
],
"insert_time": 1658315576844,
"update_time": 0,
"created_by": "user1@acme.com",
"description": "",
"groups": [
"group1",
"group2"
],
"users": []
},
{
"pretty_name": "Role2",
"permissions": [
"Dashboards",
"Datasets Access Control"
],
"insert_time": 1661435660656,
"update_time": 0,
"created_by": "user1@acme.com",
"description": "",
"groups": [],
"users": []
}
]
}Retrieve a list of the current user emails associated with one or more user groups in your environment.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/rbac/get_user_group HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 52
{
"request_data": {
"group_names": [
"Group1",
"Group2"
]
}
}{
"reply": [
{
"group_name": "Group1",
"description": null,
"pretty_name": "Investigator",
"insert_time": 1661170832341,
"update_time": 1661171650679,
"user_email": [
"user1@acme.com",
"user2@pacme.com",
"user3@acme.com",
"user4@acme.com",
"user5@acme.com"
],
"source": "Custom"
},
{
"group_name": "Group2",
"description": null,
"pretty_name": "Instance Administrator",
"insert_time": 1660830450590,
"update_time": 1661171631589,
"user_email": [
"user1@acme.com",
"user2@acme.com",
"user3@acme.com",
"user4@acme.com"
],
"source": "Custom"
}
]
}Add or remove one or more users from a role.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal Server Error
POST /public_api/v1/rbac/set_user_role HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 88
{
"request_data": {
"user_emails": [
"user1@acme.com",
"user2@acme.com"
],
"role_name": "Role1"
}
}{
"reply": {
"update_count": "2"
}
}Retrieve the risk score of a specific user or endpoint in your environment, along with the reason for the score.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/get_risk_score HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 47
{
"request_data": {
"id": "<user or endpoint ID>"
}
}{
"reply": {
"type": "user",
"id": "user2_9fa235",
"score": 100,
"norm_risk_score": 800,
"risk_level": "HIGH",
"reasons": [
{
"date created": "2023-01-31",
"description": "'Encoded VBScript executed' generated by XDR BIOC detected on host acme3 involving user user2_9fa235",
"severity": "SEV_050_CRITICAL",
"status": "STATUS_010_NEW",
"points": 95
}
],
"email": "user@company.com"
}
}Retrieve a list of users with the highest risk score in your environment along with the reason affecting each score.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/get_risky_users HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"reply": [
{
"type": "user",
"id": "acme1_9fa235",
"score": 100,
"norm_risk_score": 800,
"risk_level": "HIGH",
"reasons": [
{
"date created": "2023-01-31",
"description": "'Encoded VBScript executed' generated by XDR BIOC detected on host acme_agent-6a7b involving user acme1_9fa235",
"severity": "SEV_050_CRITICAL",
"status": "STATUS_010_NEW",
"points": 95
}
],
"email": "user@company.com"
},
{
"type": "user",
"id": "acme2_d40b59",
"score": 100,
"norm_risk_score": 800,
"risk_level": "HIGH",
"reasons": [
{
"date created": "2023-01-26",
"description": "'Kernel Privilege Escalation' along with 4 other alerts generated by XDR Analytics BIOC, XDR Analytics and XDR Agent detected on 3 hosts involving 3 users",
"severity": "SEV_040_HIGH",
"status": "STATUS_010_NEW",
"points": 95
}
]
},
{
"type": "user",
"id": "acme3_3a509d",
"score": 15,
"norm_risk_score": 100,
"risk_level": "LOW",
"reasons": [
{
"date created": "2023-02-13",
"description": "'First successful SSO connection from a country in organization' generated by XDR Analytics BIOC involving user acme3",
"severity": "SEV_020_LOW",
"status": "STATUS_010_NEW",
"points": 15
}
],
"email": "user@company.com"
},
{
"type": "user",
"id": "acme4_207a4e",
"score": 0,
"norm_risk_score": 0,
"risk_level": "LOW",
"reasons": [],
"email": "user@company.com"
}
]
}Retrieve a list of endpoints with the highest risk score in your environment along with the reason for each score.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/get_risky_hosts HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"reply": [
{
"type": "host",
"id": "host1",
"score": 100,
"norm_risk_score": 800,
"risk_level": "HIGH",
"reasons": [
{
"date created": "2023-01-26",
"description": "'Kernel Privilege Escalation' along with 4 other alerts generated by XDR Analytics BIOC, XDR Analytics and XDR Agent detected on 3 hosts involving 3 users",
"severity": "SEV_040_HIGH",
"status": "STATUS_010_NEW",
"points": 95
}
]
}
]
}Last updated
Was this helpful?