Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Issues

Issues APIs to retrieve, search, create, and update issues, including their schema, severity, status, exceptions, and resolution metadata.

Create a new issue

post

This endpoint allows users to create a new issue by providing the necessary details. Users can only create one issue at a time.

  • The request must include the following required fields:

    • name

    • description

    • observation_time

    • issue_domain

    • category

    • severity

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
202

Issue created successfully

application/json
external_idstringOptional
detection_methodstringOptional
post/public_api/v1/issue
POST /public_api/v1/issue HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 257

{
  "request_data": {
    "issue": {
      "name": "Unauthorized Access Detected",
      "description": "An unauthorized login attempt was detected from an unknown IP address.",
      "observation_time": 1700000000000,
      "issue_domain": "Security",
      "category": "CONFIGURATION",
      "severity": "HIGH"
    }
  }
}
{
  "external_id": "7c96737d50f74c7b9487450426e9eafb",
  "detection_method": "CREATE_ALERT_PUBLIC_API"
}

Retrieve issues based on filters

post

This endpoint retrieves a list of issues that match the specified filter criteria. It supports filtering, sorting, and pagination.

See the Supported Filter Fields & Values

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

Successful response with issues

application/json
post/public_api/v1/issue/search
POST /public_api/v1/issue/search HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 179

{
  "request_data": {
    "filters": [
      {
        "field": "severity",
        "operator": "in",
        "value": [
          "HIGH",
          "CRITICAL"
        ]
      }
    ],
    "search_from": 0,
    "search_to": 50,
    "sort": {
      "field": "observation_time",
      "keyword": "desc"
    }
  }
}
{
  "reply": {
    "TOTAL_COUNT": 1500,
    "FILTER_COUNT": 2,
    "DATA": [
      {
        "_insert_time": 1705312200000,
        "external_id": "abc-12345-def",
        "name": "Publicly Exposed Storage Bucket",
        "description": "S3 bucket my-data-bucket is publicly accessible",
        "observation_time": 1705312200000,
        "domain": "Posture",
        "detection.method": "CSPM_SCANNER",
        "detection.rule_id": "RULE-S3-PUBLIC",
        "category": "CONFIGURATION",
        "findings": [
          "f1a2b3c4d5"
        ],
        "asset_ids": [
          "a8d24e796ef264a33e6e84c707ff2f67"
        ],
        "asset_names": [
          "my-data-bucket"
        ],
        "asset_group_ids": [
          5,
          42
        ],
        "asset_classes": [
          "Data"
        ],
        "asset_categories": [
          "Storage Bucket"
        ],
        "asset_regions": [
          "us-east-1"
        ],
        "asset_providers": [
          "AWS"
        ],
        "asset_accounts": [
          "883588134481"
        ],
        "asset_types": [
          "S3 Bucket"
        ],
        "mitre_tactics": [
          "TA0001 - Initial Access"
        ],
        "mitre_techniques": [
          "T1190 - Exploit Public-Facing Application"
        ],
        "type": "Posture",
        "remediation": "Restrict public access on the S3 bucket",
        "extended_description": "The bucket allows unauthenticated read access to all objects.",
        "impact": "Potential data exposure of sensitive customer records",
        "id": 12345,
        "last_update_timestamp": 1705315800000,
        "tags": [
          "critical",
          "data-exposure"
        ],
        "is_excluded": false,
        "is_starred": true,
        "assigned_to": "alice.smith@example.com",
        "assigned_to_pretty": "Alice Smith",
        "status.progress": "New",
        "severity": "HIGH",
        "case_ids": [
          834
        ],
        "is_excepted": false,
        "exception_ids": null,
        "exception_expiration": null,
        "initial_evidence": "Security group sg-12345 allows inbound TCP/5432 from 0.0.0.0/0",
        "asset_external_provider_ids": [],
        "asset_cloud_account_names": [],
        "action_status": "SCANNED",
        "agentic_response_status": null,
        "agentic_assistant_id": null,
        "agentic_response_conversation_id": null
      }
    ]
  }
}

Update existing issue

post

Update an existing issue in the system. Users can only update one issue at a time. At least one of the following fields must be provided:

  • severity

  • status

When setting status to Resolved, the status_resolution_reason field is required.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management

Path parameters
issue-idintegerRequired

Numeric ID of the issue to update

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
204

Issues updated successfully

No content
post/public_api/v1/issue/{issue-id}
POST /public_api/v1/issue/{issue-id} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 56

{
  "request_data": {
    "update_data": {
      "severity": "CRITICAL"
    }
  }
}
No content

Retrieve issue schema

post

This endpoint retrieves the schema definition for issues, including core fields, normalized fields, and custom fields. Each field includes its name, pretty name, and data type.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management

Responses
200

Successful response with issue schema

application/json
post/public_api/v1/issue/schema/
POST /public_api/v1/issue/schema/ HTTP/1.1
Host: api-yourfqdn
Accept: */*

{
  "reply": {
    "DATA": [
      {
        "field_name": "_insert_time",
        "field_pretty_name": "Insert Time",
        "data_type": "TIMESTAMP"
      },
      {
        "field_name": "xdm.issue.id",
        "field_pretty_name": "Issue Id",
        "data_type": "INT"
      },
      {
        "field_name": "xdm.issue.name",
        "field_pretty_name": "Name",
        "data_type": "TEXT"
      },
      {
        "field_name": "xdm.issue.is_starred",
        "field_pretty_name": "Is Starred",
        "data_type": "BOOLEAN"
      },
      {
        "field_name": "xdm.vulnerability.cvss_score",
        "field_pretty_name": "CVSS Score",
        "data_type": "FLOAT"
      },
      {
        "field_name": "xdm.source.host.os_family",
        "field_pretty_name": "Source Host OS Family",
        "data_type": "ENUM"
      },
      {
        "field_name": "my_custom_field",
        "field_pretty_name": "My Custom Field",
        "data_type": "TEXT"
      }
    ]
  }
}

Create a new issue exception

post

This endpoint allows users to create a new issue exception by providing the necessary details. Users can only create one exception at a time.

  • The request must include the following required fields:

    • name

    • rule

    • justification_text

    • justification_category

    • expiration_ts

    • approver_email

  • Optional fields:

    • external_exception_id

If the tenant has approval required enabled, the approver_email field is mandatory and the exception will be created with Pending Status status. Otherwise, the exception is Self Approved automatically.

The requestor_name and requestor_email fields are automatically populated from the API key context.

Required permission: Exception Management Admin View/Edit, Exception Approver Admin View/Edit

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management

For the complete list of fields you can use as SEARCH_FIELD in the rule parameter, see Issue exception supported fields.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

Exception created successfully

application/json
post/public_api/v1/issue_exceptions/
POST /public_api/v1/issue_exceptions/ HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 374

{
  "request_data": {
    "name": "CVE-2024-1234 Exception for legacy hosts",
    "rule": "{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"cve_id\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"CVE-2024-1234\"}]}}",
    "justification_text": "Legacy hosts scheduled for decommission in Q2",
    "justification_category": "RISK_ACCEPTED",
    "approver_email": "security-lead@example.com",
    "expiration_ts": "2025-06-30"
  }
}
{
  "reply": {
    "exception_id": 42
  }
}

Disable an issue exception

post

This endpoint allows users to disable an existing issue exception. This will trigger a reversion scan to restore matching issues that were previously suppressed by this exception. A disabled exception cannot be reactivated.

Required permission: Exception Management Admin View/Edit, Exception Approver Admin View/Edit

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

Exception disabled successfully

application/json
post/public_api/v1/issue_exceptions/disable/
POST /public_api/v1/issue_exceptions/disable/ HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 36

{
  "request_data": {
    "exception_id": 26
  }
}
{
  "reply": {
    "rows_affected": 1,
    "status": "DISABLED"
  }
}

Retrieve issue exceptions based on filters

post

This endpoint retrieves a list of issue exceptions that match the specified filter criteria. It supports filtering along with sorting and pagination.

Required permission: Exception Management Admin View, Exception Approver Admin View

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

Exceptions retrieved successfully

application/json
post/public_api/v1/issue_exceptions/search/
POST /public_api/v1/issue_exceptions/search/ HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "request_data": {}
}
{
  "reply": {
    "exceptions": [
      {
        "exception_id": 1,
        "external_exception_id": null,
        "name": "CVE-2024-1234 Exception",
        "status": "APPROVED",
        "rule": "{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"cve_id\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"CVE-2024-1234\"}]}}",
        "pretty_rule": "[\"cve_id = CVE-2024-1234\"]",
        "justification_text": "Risk accepted for legacy hosts",
        "justification_category": "RISK_ACCEPTED",
        "approval_justification": null,
        "requestor_name": "John Doe",
        "requestor_email": "john.doe@example.com",
        "approver_email": "security-lead@example.com",
        "approver_name": "Jane Smith",
        "created_ts": "2025-01-15T10:30:00Z",
        "modified_ts": "2025-01-15T10:30:00Z",
        "approval_ts": "2025-01-15T11:00:00Z",
        "expiration_ts": "2025-06-30T23:59:59Z",
        "impacted_issues_count": 150,
        "backward_scan_status": "COMPLETED",
        "backward_scan_ts": "2025-01-15T11:05:00Z",
        "reversion_scan_status": null,
        "reversion_scan_ts": null
      }
    ],
    "filter_count": 1,
    "total_count": 10
  }
}
PreviousIssues APIs overview
NextModels

Last updated

Was this helpful?