Asset Commands

getAssets

Retrieves assets from the Cortex platform using optional filter criteria. If no filter arguments are supplied, the command returns a list of assets.

Arguments

Argument Name

Description

Required

page_size

The number of assets to return per page. Maximum is 5000; a value of 0 returns the maximum. Default is 100.

Optional

page_number

The page number for the assets to return for pagination. Default is 0.

Optional

asset_names

A comma-separated list of asset names to search for.

Optional

asset_types

A comma-separated list of asset types to search for.

Optional

asset_tags

A JSON encoded string representing a list of tag:value pairs to search for.

Optional

asset_ids

A comma-separated list of asset IDs to search for.

Optional

asset_providers

A comma-separated list of asset providers to search for.

Optional

asset_realms

A comma-separated list of asset realms to search for.

Optional

asset_groups

A comma-separated list of asset group names to search for.

Optional

asset_categories

A comma-separated list of asset categories to search for.

Optional

asset_classes

A comma-separated list of asset classes to search for. Possible values are: AI, API, Application, Code, Compute, Data, Device, External Surface, Identity, Management, Network, Organization, Other, Security Services.

Optional

software_package_versions

A comma-separated list of software package versions to search for.

Optional

kubernetes_cluster_versions

A comma-separated list of Kubernetes cluster versions to search for.

Optional

filter_object

A JSON string representing a raw filter object. If provided, this overrides all other filter arguments (asset_names, asset_types, asset_tags, asset_ids, asset_providers, asset_realms, asset_categories, asset_classes, software_package_versions, kubernetes_cluster_versions).

Optional

get_enriched_asset_data

Whether to include enriched asset data in the response (the normalized, raw, and extended fields of each asset). Because one additional API call is made per returned asset, this is supported for up to 10 assets. Set page_size to 10 or lower and provide no more than 10 asset_ids, otherwise the command returns an error. Note that the default page_size of 100 exceeds this limit. Possible values are: true, false. Default is false.

Optional

Outputs

Core.Asset.name string

The name of the asset.

Core.Asset.provider string

The asset provider.

Core.Asset.id string

The ID of the asset.

Core.Asset.external_provider_id string

The external provider ID of the asset.

Core.Asset.first_observed number

The first time the asset was observed.

Core.Asset.realm string

The realm of the asset.

Core.Asset.last_observed number

The last time the asset was observed.

Core.Asset.strong_id string

The strong ID of the asset.

Core.Asset.type__id string

The type ID.

Core.Asset.type__name string

The type name.

Core.Asset.type__category string

The type category.

Core.Asset.type__class string

The type class.

Core.Asset.type__is_resource boolean

Whether the type is a resource.

Core.Asset.cloud__region string

The cloud region.

Core.Asset.group_ids number

Asset group IDs.

Core.Asset.tags unknown

Asset tags.

Core.Asset.issues_critical number

Critical issues count.

Core.Asset.cases_critical number

Critical cases count.

Core.Asset.issues_breakdown unknown

Issues breakdown.

Core.Asset.cases_breakdown unknown

Cases breakdown.

Core.Asset.related_issues.critical_issues number

Related critical issues count.

Core.Asset.related_issues.issues_breakdown unknown

Related issues breakdown.

Core.Asset.related_cases.critical_cases number

Related critical cases count.

Core.Asset.related_cases.cases_breakdown unknown

Related cases breakdown.

getAssetGroup

Searches for asset groups from the Cortex platform using one or more filter criteria.

Arguments

Argument Name

Description

Required

names

A comma-separated list of asset group names to filter by.

Optional

type

Filter by asset group type.

Optional

descriptions

A comma-separated list of descriptions to filter by.

Optional

ids

A comma-separated list of asset group IDs to filter by.

Optional

sort_order

The sort order for results. Possible values: ASC, DESC. Possible values are: ASC, DESC. Default is DESC.

Optional

created_by

A comma-separated list of creator names to filter by.

Optional

modified_by

A comma-separated list of modifier names to filter by.

Optional

limit

Maximum number of results to return. Default is 50.

Optional

filter_object

A JSON string representing a raw filter object. If provided, this overrides all other filter arguments (names, type, descriptions, ids, created_by, modified_by). Cannot be used together with other filter arguments.

Optional

Outputs

Core.AssetGroups.id number

The unique identifier of the asset group.

Core.AssetGroups.name string

The name of the asset group.

Core.AssetGroups.type string

The type of the asset group.

Core.AssetGroups.created_by string

The user who created the asset group.

Core.AssetGroups.creation_time number

The creation timestamp of the asset group.

Core.AssetGroups.created_by_email string

The email of the user who created the asset group.

Core.AssetGroups.last_update_time number

The last update timestamp of the asset group.

Core.AssetGroups.modified_by string

The user who last modified the asset group.

Core.AssetGroups.modified_by_email string

The email of the user who last modified the asset group.

Core.AssetGroups.description string

The description of the asset group.

Core.AssetGroups.filter unknown

The filter conditions of the asset group.

Core.AssetGroups.membership_predicate unknown

The membership predicate defining asset group membership criteria.

Core.AssetGroups.is_used_by_sbac boolean

Whether the asset group is used by SBAC.

createAssetGroup

Creates an asset group, either from a fixed list of specific assets or from assets that automatically match a filter you define.

Arguments

Argument Name

Description

Required

group_name

The name of the asset group.

Required

group_type

The type of the asset group. Possible values are: Static, Dynamic.

Required

group_description

The description of the asset group.

Optional

membership_json

Define the filter conditions for selecting which assets to be included in the Asset Group. Required for Dynamic groups. For Static groups, either this or asset_ids must be provided. The JSON schema must match the format required in the API documentation: https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/asset-groups#post-public_api-v1-asset-groups-update-group_id.

Optional

asset_ids

A comma-separated list of asset IDs to add to the static group. Only valid for Static groups. If provided alongside membership_json, asset_ids takes precedence.

Optional

Outputs

There are no outputs for this command.

deleteAssetGroup

Deletes an asset group. This does not delete the assets themselves, only the group that references them.

Arguments

Argument Name

Description

Required

group_id

The ID of the asset group to delete.

Required

Outputs

There are no outputs for this command.

setAssetGroup

Updates an existing asset group's name, description, or membership filter.

Arguments

Argument Name

Description

Required

group_id

The ID of the asset group to update.

Required

group_name

The name of the asset group.

Required

group_type

The type of the asset group. Possible values are: Static, Dynamic.

Required

group_description

The description of the asset group.

Optional

membership_json

Define the filter conditions for selecting which assets to be included in a dynamic Asset Group. The JSON schema must match the format required in the API documentation: https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/asset-groups#post-public_api-v1-asset-groups-update-group_id.

Required

Outputs

There are no outputs for this command.

getAssetSchema

Gets the schema of the asset inventory.

Arguments

There are no input arguments for this command.

Outputs

Core.AssetSchema.field_pretty_name string

The human-readable name of the asset schema field.

Core.AssetSchema.field_name string

The internal name of the asset schema field.

Core.AssetSchema.data_type string

The data type of the asset schema field.

getAssetSchemaFieldOptions

Gets the possible values of a specified field in the asset schema for fields of type 'ENUM'

Arguments

Argument Name

Description

Required

field_name

The name of the field to get options for. You can use getAssetSchema to retrieve the schema. The field must be of type ENUM.

Required

Outputs

Core.AssetSchemaOptions.pretty_name string

The human-readable label for the enum option.

Core.AssetSchemaOptions.name string

The internal name of the enum option.

Core.AssetSchemaOptions.field string

The schema field this option belongs to.

PreviousAppSec Commands

NextAudit Commands

Last updated 1 month ago

Was this helpful?