Bring Your Own Scanner

Import vulnerability findings from external scanners into Cortex vulnerability management. Use these endpoints to submit asset and CVE data from third-party scanners and to poll the status of async import jobs.

Submit assets and vulnerabilities from an external scanner

post

Imports asset and vulnerability data from a third-party scanner into Cortex vulnerability management.

Each request must include at least one asset. Each asset can carry multiple CVE findings. The platform validates all input on receipt — if validation fails, a 422 Unprocessable Entity response is returned with field-level error details.

Successful requests are processed asynchronously. The response includes a job_id that can be polled using the Get BYOS import job status endpoint, plus counts of accepted assets and vulnerabilities.

RBAC permission required: manage_vulnerabilities_action

Required licenses: Exposure Management; and either Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Within a single asset, each vulnerability_id must be unique. If duplicate vulnerability_id values are submitted for the same asset, the API returns 422 Unprocessable Entity with an error describing the duplicate.

Viewing imported findings: After successful import, findings appear in the Cortex Cloud vulnerability management console under Vulnerability Findings, filtered by finding_sources = Third Party Scanner. The number of findings shown may be lower than the vulnerabilities_count returned by the import response, because the platform deduplicates findings by asset and CVE ID.

Rate limits:

• Maximum 10 requests per hour to this endpoint.
• Maximum 10 jobs in PROCESSING state in any given hour. Additional submissions are rejected until active jobs complete.

Authorizations

Header parameters

x-xdr-auth-idany ofRequiredDefault: ""

integerOptional

or

stringOptional

AuthorizationstringRequiredDefault: ""

Body

Request body for importing vulnerable assets from an external scanner.

vendorstringRequired

Vulnerability scanner vendor. Examples: TENABLE, QUALYS, RAPID7_VM, RAPID7_CLOUD.

productstringRequired

Product name associated with the vulnerabilities.

versionstringOptional

Product version, used for (vendor, product, version) CVE mapping.

Responses

201

Assets accepted for asynchronous processing. The response includes import counts and the job_id for status polling.

application/json

Response for a successful vulnerable asset import. Returns counts and the async job identifier needed to poll for completion.

assets_countintegerRequired

Total number of assets accepted in the import request.

Example: 2

vulnerabilities_countintegerRequired

Total number of vulnerabilities accepted across all assets in the import request.

Example: 4

job_idstring · uuidRequired

Unique identifier for the async import job. Use this value with the Get BYOS Import Job Status endpoint to poll for completion.

Example: a2b1aba2-37fe-4fb4-ba6d-829e8cf5d653

job_statusstring · enumRequired

Possible status values for a BYOS import job.

Possible values:

422

Validation Error — one or more request fields failed schema validation. Check the detail array for field-level error messages.

application/json

post/public_api/vulnerability-management/v1/external-scans/assets

POST /public_api/vulnerability-management/v1/external-scans/assets HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id: 
Authorization: 
Content-Type: application/json
Accept: */*
Content-Length: 553

{
  "vendor": "text",
  "product": "text",
  "version": "text",
  "assets": [
    {
      "ipv4": [
        "0.0.0.0"
      ],
      "vulnerabilities": [
        {
          "vulnerability_id": "text",
          "last_seen": 1,
          "port": 1,
          "protocol": "TCP",
          "raw_output": "text",
          "confidence": "Potential",
          "description": "text",
          "evidence": "text",
          "scan_name": "text",
          "cve_id": [
            "text"
          ]
        }
      ],
      "origin_asset_id": "text",
      "asset_name": "text",
      "ipv6": [
        "2001:0db8:85a3:0000:0000:8a2e:0370:7334"
      ],
      "fqdn": [
        "text"
      ],
      "mac_address": "text",
      "origin_tags": [
        "env:perf-test",
        "batch:stress"
      ],
      "last_seen": 1,
      "os_name": "text",
      "product": "text",
      "vendor": "text",
      "version": "text"
    }
  ]
}

{
  "assets_count": 2,
  "vulnerabilities_count": 4,
  "job_id": "a2b1aba2-37fe-4fb4-ba6d-829e8cf5d653",
  "job_status": "INITIATED"
}

Poll the status of a BYOS import job

get

Returns the current status of an asynchronous BYOS import job.

After submitting assets via the Submit assets and vulnerabilities from an external scanner endpoint, use the returned job_id to poll this endpoint until the job reaches a terminal state (COMPLETED, FAILED, or COMPLETED_WITH_ERRORS).

Possible job_status values:

• INITIATED — job received, not yet queued
• PROCESSING — job is actively being processed
• COMPLETED — all assets imported successfully
• COMPLETED_WITH_ERRORS — import finished but some assets failed; check error_log
• FAILED — job failed entirely; check error_log for details

Response codes:

• 200 — Job status retrieved successfully. The HTTP status reflects only the poll request itself; the job's outcome is in job_status (including the terminal FAILED and COMPLETED_WITH_ERRORS states).
• 404 — job_id was not found.

422 Unprocessable Entity is only returned by the upstream Submit assets and vulnerabilities from an external scanner endpoint when the request payload fails schema validation. A 422 therefore means the job was never created; a FAILED job_status returned in a 200 response means the job ran but could not complete — see error_log for details.

RBAC permission required: manage_vulnerabilities_action

Required licenses: Exposure Management; and either Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

SLA timeout: Jobs in PROCESSING state have a 24-hour SLA. After 24 hours, any job still in PROCESSING is guaranteed to transition to COMPLETED_WITH_ERRORS, which is a terminal state.

Rate limits: Maximum 10 requests per minute.

Authorizations

Path parameters

job_idstringRequired

The unique identifier of the BYOS import job, returned by the Submit assets and vulnerabilities from an external scanner endpoint.

Header parameters

x-xdr-auth-idany ofRequiredDefault: ""

integerOptional

or

stringOptional

AuthorizationstringRequiredDefault: ""

Responses

200

Job status retrieved successfully.

application/json

Status and metadata for a BYOS import job.

job_idstringRequired

Unique job ID. Use this value with the Get BYOS Import Job Status endpoint to poll for completion.

created_timestampstring · date-timeRequired

ISO 8601 timestamp of when the job was received.

job_statusstring · enumRequired

Possible status values for a BYOS import job.

Possible values:

last_updatedstring · date-timeOptional

ISO 8601 timestamp of when the job was last updated.

error_logstring · nullableOptional

Error details if the job failed or completed with errors. May be null when there is no error.

404

Job not found — the specified job_id does not exist.

application/json

422

Validation Error — the job_id path parameter failed schema validation.

application/json

get/public_api/vulnerability-management/v1/external-scans/assets/jobs/{job_id}

GET /public_api/vulnerability-management/v1/external-scans/assets/jobs/{job_id} HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id: 
Authorization: 
Accept: */*

{
  "job_id": "text",
  "created_timestamp": "2026-01-01T00:00:00.000Z",
  "job_status": "INITIATED",
  "last_updated": "2026-01-01T00:00:00.000Z",
  "error_log": null
}