Vulnerability Management
Public APIs for vulnerability policy management
Retrieve a paginated list of vulnerability management policies with optional filtering and sorting capabilities. This endpoint allows you to search through policies based on various criteria such as name, status, priority, and other attributes.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
""""Successful Response
Validation Error
POST /public_api/uvm_public/v1/list_policies HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id:
Authorization:
Content-Type: application/json
Accept: */*
Content-Length: 256
{
"filter_data": {
"filter": {
"AND": [
{
"SEARCH_FIELD": "text",
"SEARCH_TYPE": "text",
"SEARCH_VALUE": "text"
}
]
},
"sort": [
{
"FIELD": "text",
"ORDER": "ASC"
}
],
"paging": {
"from": 1,
"to": 1
},
"locked": {
"AND": [
{
"SEARCH_FIELD": "text",
"SEARCH_TYPE": "text",
"SEARCH_VALUE": "text"
}
]
}
}
}{
"DATA": [],
"FILTER_COUNT": 1,
"TOTAL_COUNT": 1
}Create a new vulnerability management policy for issue creation, kubernetes runtime protection, or prevention actions.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
""""Successful Response
Validation Error
POST /public_api/uvm_public/v1/create_policy HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id:
Authorization:
Content-Type: application/json
Accept: */*
Content-Length: 390
{
"name": "text",
"description": "text",
"priority": 1,
"status": "DISABLED",
"match_criteria": {
"AND": [
{
"SEARCH_FIELD": "text",
"SEARCH_TYPE": "text",
"SEARCH_VALUE": "text"
}
]
},
"exclusion_criteria": {},
"action": [
{
"action_type": "BLOCK_BUILD",
"take_action": true,
"category": "BLOCK"
}
],
"action_category": "BLOCK",
"issue_type": "text",
"severity": "CRITICAL",
"asset_group_scope": [
1
],
"policy_type": "STANDARD_POLICY"
}{
"id": "123e4567-e89b-12d3-a456-426614174000"
}Update an existing vulnerability management policy by providing its unique identifier.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
""""Successful Response
Validation Error
PUT /public_api/uvm_public/v1/update_policy/{id} HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id:
Authorization:
Content-Type: application/json
Accept: */*
Content-Length: 390
{
"name": "text",
"description": "text",
"priority": 1,
"status": "DISABLED",
"match_criteria": {
"AND": [
{
"SEARCH_FIELD": "text",
"SEARCH_TYPE": "text",
"SEARCH_VALUE": "text"
}
]
},
"exclusion_criteria": {},
"action": [
{
"action_type": "BLOCK_BUILD",
"take_action": true,
"category": "BLOCK"
}
],
"action_category": "BLOCK",
"issue_type": "text",
"severity": "CRITICAL",
"asset_group_scope": [
1
],
"policy_type": "STANDARD_POLICY"
}{
"id": "123e4567-e89b-12d3-a456-426614174000"
}Retrieve a specific vulnerability management policy by its unique identifier.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
""""Successful Response
Validation Error
GET /public_api/uvm_public/v1/get_policy/{id} HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id:
Authorization:
Accept: */*
{
"PRIORITY": 1,
"ID": "123e4567-e89b-12d3-a456-426614174000",
"NAME": "text",
"STATUS": "text",
"MATCH_CRITERIA": {},
"EXCLUSIONS": {},
"SEVERITY": "CRITICAL",
"OPEN_ISSUES": 1,
"ESTIMATED_MATCH_COUNT": 1,
"DESCRIPTION": "text",
"MODIFIED_BY": "text",
"MODIFIED_TIMESTAMP": "2026-01-01T00:00:00.000Z",
"ACTION": [
{
"action_type": "BLOCK_BUILD",
"take_action": true,
"category": "BLOCK"
}
],
"ACTION_CATEGORY": "BLOCK",
"ASSET_GROUP_SCOPE": [
1
],
"POLICY_TYPE": "STANDARD_POLICY"
}Delete an existing vulnerability management policy using a policy ID.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
""""Successful Response
Validation Error
DELETE /public_api/uvm_public/v1/delete_policy/{id} HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id:
Authorization:
Accept: */*
trueTrigger On demand Scan based on AssetId on one of CORTEX_NETWORK_SCANNER, CORTEX_XDR_AGENT, CORTEX_XDR_AGENTLESS scanners.
Required license: Cortex Cloud Runtime Security or Cortex Cloud Posture Management.
""Request model for triggering a vulnerability scan
The unique identifier of the asset to scan
Type of vulnerability scanner
CVE identifier (e.g., 'CVE-2024-1234'). Required when scanner_type is CORTEX_NETWORK_SCANNER, optional for other scanner types.
Scan Target (e.g., 'CONTAINER' or 'HOST' or 'IMAGE'). Required when scanner_type is CORTEX_XDR_AGENT and its Linux endpoint, optional for other scanner types.
Successful Response
Response model for scan trigger operation
Validation Error
POST /public_api/vulnerability-management/v1/scan HTTP/1.1
Host: api-yourfqdn
x-xdr-auth-id: 1
Authorization:
Content-Type: application/json
Accept: */*
Content-Length: 101
{
"asset_id": "text",
"scanner_type": "CORTEX_NETWORK_SCANNER",
"cve_id": "text",
"scan_target": "CONTAINER"
}{
"message": "text",
"scan_id": 1
}Last updated
Was this helpful?