Cortex Commands Overview

Use Cortex commands to investigate, respond, and manage Cortex platform data.

You can use commands in playbooks and in the War Room to retrieve data, automate decisions, and take response actions.

This guide covers commands for Cortex XSIAM, Cortex XDR 5.x, Cortex Cloud Runtime, Cortex Cloud Posture, and Cortex AgentiX.

Each command reference describes its arguments and outputs.

NOTE

Not all commands are available in every Cortex product. Command availability depends on your product license.

What you can do with commands

Cortex commands help you investigate, respond, and manage workflows.

For example, you can:

• Retrieve and update cases.
• Create, review, and organize timeline records and evidence.
• Retrieve files from endpoints and check action status.
• Manage file allowlist and blocklist entries by hash.
• Query assets and trigger vulnerability scans.
• Create AppSec policies for repositories and deployed assets.
• Search, create, and update indicators.
• Manage users, groups, and API keys.