Vulnerability Findings Snapshot

Bulk export of vulnerability findings

Bulk export vulnerability findings snapshot

post

Executes an XQL query against the uvm_findings dataset and returns results as a newline-delimited JSON (NDJSON) stream for large result sets.

Response variants:

• Stream (application/x-ndjson) — large result sets; each line is a VulnerabilityFinding JSON object
• Inline (application/json) — small result sets returned directly

Rate limit: Up to 10 requests per 24-hour rolling window. Exceeding this limit returns HTTP 429.

Supported request fields and filter types:

The snapshot export accepts an optional per-field filter block in addition to timeframe and limit. All parameters are supplied inside request_data:

Request field	Data type	Description
filter	filter block	Optional. An AND/OR group of clauses, each with SEARCH_FIELD, SEARCH_TYPE, and SEARCH_VALUE. Only the fields listed below may be used.
timeframe.from + timeframe.to	timestamp (ms)	Optional absolute time window. Both bounds are required together. When omitted, the server default lookback window is used.
limit	integer	Optional maximum number of rows to return. Omit for the full dataset.

Supported filter fields and filter types:

The snapshot filter block uses the same supported filter fields and filter types as the List vulnerability findings (paginated) endpoint, except that field names for the snapshot endpoint are lowercase (for example, cve_id, cvss_severity). Any field not supported is rejected with HTTP 400.

Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.

Authorizations

Body

Top-level request envelope.

Responses

200

Newline-delimited JSON stream response. Body is a newline-delimited stream of VulnerabilityFinding JSON objects.

application/x-ndjson

string · binaryOptional

Newline-delimited JSON stream. Each line is a self-contained VulnerabilityFinding JSON object.

400

Invalid request parameters, or the feature is disabled.

application/json

408

Request timed out waiting for response.

application/json

429

Rate limit exceeded. This endpoint allows up to 10 requests per 24-hour rolling window.

application/json

post/vulnerability-management/v1/vulnerability-finding/snapshot

POST /vulnerability-management/v1/vulnerability-finding/snapshot HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 70

{
  "request_data": {
    "timeframe": {
      "from": 15989076874,
      "to": 1771482089874
    }
  }
}

{"platform_id":"abc123","asset_name":"prod-web-01","cve_id":"CVE-2024-12345","cvss_severity":"CRITICAL","epss_score":0.87,"first_observed":1700000000000,"last_observed":1710000000000}
{"platform_id":"xyz789","asset_name":"db-server-02","cve_id":"CVE-2023-99999","cvss_severity":"HIGH","epss_score":0.12,"first_observed":1705000000000,"last_observed":1710000000000}