Endpoint Commands
endpoint
Returns information about an endpoint.
Arguments
id
The endpoint ID.
Optional
ip
The endpoint IP address.
Optional
hostname
The endpoint hostname.
Optional
Outputs
Endpoint.Hostname string
The hostname of the endpoint.
Endpoint.OS string
The endpoint's operation system.
Endpoint.IPAddress string
The IP address of the endpoint.
Endpoint.ID string
The endpoint's ID.
Endpoint.Status string
The endpoint's status.
Endpoint.IsIsolated string
The endpoint's isolation status.
Endpoint.MACAddress string
The endpoint's MAC address.
Endpoint.Vendor string
The integration name of the endpoint vendor.
Endpoint.Domain string
The domain of the endpoint.
getEndpoints
Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition. Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
Arguments
endpoint_id_list
A comma-separated list of endpoint IDs.
Optional
dist_name
A comma-separated list of distribution package names or installation package names.
Optional
ip_list
A comma-separated list of private IP addresses. Example: 10.1.1.1,192.168.1.1.
Optional
public_ip_list
A comma-separated list of public IP addresses that correlate to the last IPv4 address from which the Cortex XDR agent connected (know as 'Last Origin IP'). Example: 8.8.8.8,1.1.1.1.
Optional
group_name
A comma-separated list of group names to which the agent belongs.
Optional
platform
The endpoint platform. Valid values are: "windows", "linux", "macos", or "android". Possible values are: windows, linux, macos, android.
Optional
alias_name
A comma-separated list of alias names.
Optional
isolate
Specifies whether the endpoint was isolated or unisolated. Possible values are: isolated, unisolated.
Optional
hostname
A comma-separated list of endpoint hostnames.
Optional
first_seen_gte
All the agents that were first seen after the first_seen_gte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
first_seen_lte
All the agents that were first seen before the first_seen_lte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_gte
All the agents that were last seen before the last_seen_gte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_lte
All the agents that were last seen before the last_seen_lte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
page
Page number for pagination. The default is 0 (the first page). Default is 0.
Optional
limit
Maximum number of endpoints to return per page. The default is 30. Default is 30.
Optional
sort_by
Specifies the field by which to sort endpoints. Possible values are: first_seen, last_seen, endpoint_id.
Optional
sort_order
The order by which to sort results. Can be "asc" (ascending) or "desc" (descending). Default set to asc. Possible values are: asc, desc. Default is asc.
Optional
status
A comma-separated list of endpoints statuses to filter. Possible values are: connected, lost, disconnected, uninstalled.
Optional
username
A comma-separated list of usernames to query for.
Optional
endpoint_type
A comma-separated list of endpoint types. Possible values are: mobile, server, workstation, containerized, serverless.
Optional
operating_system
A comma-separated list of operating system names (e.g., Windows 10, Ubuntu 24.04). | Optional | | agent_version | A comma-separated list of agent versions. For example, 8.9.0.14028.
Optional
agent_version
A comma-separated list of agent versions. For example, 8.9.0.14028.
Optional
agent_eol
Indicates whether the endpoint is running an End-of-Life (EOL) agent version. Possible values are: true, false.
Optional
os_version
A comma-separated list of OS versions. For example, 10.0.22621.
Optional
domain
A comma-separated list of domains.
Optional
assigned_prevention_policy
A comma-separated list of assigned prevention policies. Possible values are: pcastro, Caas Default, kris, democloud, Linux Default, Android Default, Serverless Function Default, macOS Default, iOS Default, Windows Default, bcpolicy.
Optional
tags
A comma-separated list of endpoint tags.
Optional
operational_status
A comma-separated list of endpoint operational protection statuses. Possible values are: protected, partially protected, unprotected.
Optional
cloud_provider
A comma-separated list of cloud providers. Possible values are: aws, azure, gcp, alibaba, oracle, on_prem.
Optional
cloud_region
A comma-separated list of cloud regions.
Optional
all_results
Whether to return all endpoints. If true, will override the 'limit' and 'page' arguments. Possible values are: false, true. Default is false.
Optional
Outputs
Core.Endpoint.endpoint_id string
The endpoint ID.
Core.Endpoint.endpoint_name string
The endpoint name.
Core.Endpoint.host_name string
The hostname of the endpoint.
Core.Endpoint.endpoint_type string
The endpoint type.
Core.Endpoint.endpoint_status string
The status of the endpoint.
Core.Endpoint.os_type string
The endpoint OS type.
Core.Endpoint.os_version string
The version of the operating system.
Core.Endpoint.ip string
A list of IP addresses.
Core.Endpoint.ipv6 string
A list of IPv6 addresses associated with the endpoint.
Core.Endpoint.public_ip string
The public IP address of the endpoint.
Core.Endpoint.users string
A list of users.
Core.Endpoint.domain string
The endpoint domain.
Core.Endpoint.alias string
The endpoint's aliases.
Core.Endpoint.first_seen number
First seen date/time in Epoch (milliseconds).
Core.Endpoint.last_seen number
Last seen date/time in Epoch (milliseconds).
Core.Endpoint.content_version string
Content version.
Core.Endpoint.installation_package string
Installation package.
Core.Endpoint.active_directory string
Active directory.
Core.Endpoint.install_date number
Install date in Epoch (milliseconds).
Core.Endpoint.endpoint_version string
Endpoint version.
Core.Endpoint.is_isolated string
Whether the endpoint is isolated.
Core.Endpoint.isolated_date number
The timestamp when the endpoint was isolated.
Core.Endpoint.group_name string
The name of the group to which the endpoint belongs.
Core.Endpoint.operational_status string
The operational status of the endpoint agent.
Core.Endpoint.operational_status_description string
A description of the operational status.
Core.Endpoint.operational_status_details unknown
Detailed information about the operational status.
Core.Endpoint.scan_status string
The status of the last scan.
Core.Endpoint.content_release_timestamp number
The timestamp of the content release.
Core.Endpoint.last_content_update_time number
The timestamp of the last content update.
Core.Endpoint.operating_system string
The full operating system name.
Core.Endpoint.mac_address string
A list of MAC addresses for the endpoint.
Core.Endpoint.assigned_prevention_policy string
The prevention policy assigned to the endpoint.
Core.Endpoint.assigned_extensions_policy string
The extensions policy assigned to the endpoint.
Core.Endpoint.token_hash string
The token hash for the endpoint.
Core.Endpoint.tags.server_tags string
Tags associated with the endpoint.
Core.Endpoint.tags.endpoint_tags string
Tags associated with the endpoint.
Core.Endpoint.cloud_provider string
The cloud provider (if applicable).
Core.Endpoint.cloud_region string
The cloud region (if applicable).
Core.Endpoint.cloud_provider_account_id string
The cloud provider account ID (if applicable).
Core.Endpoint.cloud_instance_id string
The cloud instance ID (if applicable).
Core.Endpoint.cloud_id string
The cloud ID (if applicable).
Core.Endpoint.content_status string
The status of the content on the endpoint.
Endpoint.Hostname string
The hostname of the endpoint.
Endpoint.OS string
The endpoint's operation system.
Endpoint.IPAddress string
The IP address of the endpoint.
Endpoint.ID string
The endpoint's ID.
Endpoint.Status string
The endpoint's status.
Endpoint.IsIsolated string
The endpoint's isolation status.
Endpoint.MACAddress string
The endpoint's MAC address.
Endpoint.Vendor string
The integration name of the endpoint vendor.
Endpoint.Domain string
The domain of the endpoint.
Account.Username string
The username in the relevant system.
Account.Domain string
The domain of the account.
deleteEndpoints
Deletes selected endpoints in the Cortex app. You can delete up to 1000 endpoints. This removes the endpoint record only. It does not uninstall the agent from the device.
Arguments
endpoint_ids
Comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the core-get-endpoints command.
Required
Outputs
There are no outputs for this command.
isolateEndpoint
Isolates the specified endpoint, blocking all network traffic except its connection to the management console. Use unisolateEndpoint to reverse this action once the threat has been contained.
Arguments
endpoint_id
The endpoint ID to isolate. Retrieve it from the getEndpoints command.
Required
case_id
Links the response action to the case that triggered it.
Optional
suppress_disconnected_endpoint_error
Suppress an error when trying to isolate a disconnected endpoint. When set to false, an error is returned. Possible values are: true, false. Default is false.
Optional
interval_in_seconds
Interval in seconds between each poll.
Optional
timeout_in_seconds
Polling timeout in seconds.
Optional
unisolateEndpoint
Reverses the isolation of an endpoint, restoring its normal network connectivity.
Note: This is a polling command.
Arguments
endpoint_id
The endpoint ID to reverse the isolation. Retrieve it from the getEndpoints command.
Required
case_id
Links the response action to the case that triggered it.
Optional
suppress_disconnected_endpoint_error
Suppress an error when trying to unisolate a disconnected endpoint. When set to false, an error is returned. Possible values are: true, false. Default is false.
Optional
interval_in_seconds
Interval in seconds between each poll.
Optional
timeout_in_seconds
Polling timeout in seconds.
Optional
endpointScan
Runs a scan on selected endpoints. To scan all endpoints, use the argument all=true. Scanning all endpoints may affect performance and cause latency.
Note: This is a polling command.
Arguments
case_id
Links the response action to the case that triggered it.
Optional
endpoint_ids
A comma-separated list of endpoint IDs.
Optional
dist_name
A comma-separated list of distribution names.
Optional
gte_first_seen
Epoch timestamp in milliseconds.
Optional
gte_last_seen
Epoch timestamp in milliseconds.
Optional
lte_first_seen
Epoch timestamp in milliseconds.
Optional
lte_last_seen
Epoch timestamp in milliseconds.
Optional
ip_list
A comma-separated list of IP addresses.
Optional
group_name
A comma-separated list of endpoint group names.
Optional
platform
Type of operating system. Possible values are: windows, linux, macos, android.
Optional
alias
A comma-separated list of endpoint alias names.
Optional
isolate
Filters endpoints by their isolation status. Possible values are: isolated, unisolated.
Optional
hostname
A comma-separated list of hosts.
Optional
filter_object
A JSON string of a list of filter objects. Overrides individual filter arguments when provided. Each object must have field, operator, and value keys. Example: [{"field":"endpoint_id_list","operator":"in","value":["ep1","ep2"]}]
Optional
all
Whether to scan all of the endpoints or not. Default is false. Note that scanning all of the endpoints may cause performance issues and latency. Possible values are: true, false. Default is false.
Optional
interval_in_seconds
Interval in seconds between each poll.
Optional
timeout_in_seconds
Polling timeout in seconds.
Optional
Outputs
Core.endpointScan.actionId number
The action ID of the abort scan request.
Core.endpointScan.aborted boolean
Was the scan canceled.
abortEndpointScan
Cancels the scan on the selected endpoints. A scan can only be canceled if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Scanning all endpoints may impact performance and cause latency.
Arguments
incident_id
Links the response action to the incident that triggered it.
Optional
endpoint_id_list
A comma-separated list of endpoint IDs.
Optional
dist_name
A comma-separated list of distribution names.
Optional
gte_first_seen
Epoch timestamp in milliseconds.
Optional
gte_last_seen
Epoch timestamp in milliseconds.
Optional
lte_first_seen
Epoch timestamp in milliseconds.
Optional
lte_last_seen
Epoch timestamp in milliseconds.
Optional
ip_list
A comma-separated list of IP addresses.
Optional
group_name
A comma-separated list of endpoint group names.
Optional
platform
Type of operating system. Possible values are: windows, linux, macos, android.
Optional
alias
A comma-separated list of endpoint alias names.
Optional
isolate
Choose whether an endpoint has been isolated. Select "isolated" or "unisolated". Possible values are: isolated, unisolated.
Optional
hostname
A comma-separated list of hosts.
Optional
all
Whether to scan all of the endpoints or not. Default is false. Note that scanning all of the endpoints may cause performance issues and latency. Possible values are: true, false. Default is false.
Optional
Outputs
Core.endpointScan.actionId number
The action ID of the abort scan request.
Core.endpointScan.aborted boolean
Was the scan canceled.
getEndpointPolicy
Retrieves the name of the security policy currently assigned to a specific endpoint.
getEndpointPolicyConfig
Returns the full policy configuration applied to a specific endpoint, including calculated and applied profile details.
Arguments
endpoint_id
The ID of the endpoint for which to retrieve the policy configuration.
Required
Outputs
Core.EndpointPolicy.endpoint_id string
The ID of the endpoint.
Core.EndpointPolicy.calculated unknown
The calculated (effective) policy profiles for the endpoint.
Core.EndpointPolicy.applied unknown
The applied policy modules for the endpoint.
getEndpointUpdateVersion
Returns the agent update version distribution for the provided endpoint IDs.
Arguments
endpoint_ids
A comma-separated list of endpoint IDs.
Required
Outputs
Core.EndpointUpdateVersion.TotalCount number
The total number of endpoints.
Core.EndpointUpdateVersion.PlatformCount unknown
The per-platform endpoint counts.
Core.EndpointUpdateVersion.Distributions.Platform string
The platform of the endpoints.
Core.EndpointUpdateVersion.Distributions.Version string
The agent version.
Core.EndpointUpdateVersion.Distributions.EndpointsWithHigherVersionCount number
The number of endpoints running a higher version.
Core.EndpointUpdateVersion.Distributions.EndpointsWithSameVersionCount number
The number of endpoints running the same version.
Core.EndpointUpdateVersion.Distributions.EndpointsWithLowerVersionCount number
The number of endpoints running a lower version.
getEndpointDeviceControlViolations
Gets a list of device control violations filtered by selected fields. Returns up to 100 violations. When no endpoint ID, hostname, type, or other filter is given, the command returns the most recent device control violations for the tenant.
Arguments
endpoint_ids
A comma-separated list of endpoint IDs.
Optional
types
A comma-separated list of device types that triggered the violation. Possible values are: bluetooth, cd-rom, disk drive, floppy disk, windows portable devices, print job, sd card.
Optional
timestamp_gte
Returns violations whose timestamp is greater than or equal to this value (epoch milliseconds). Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00").
Optional
timestamp_lte
Returns violations whose timestamp is less than or equal to this value (epoch milliseconds). Supports milliseconds (e.g. 1579039377301), relative time (e.g. "3 days"), or ISO date (e.g. "2019-10-21T23:45:00").
Optional
ip_list
A comma-separated list of IP addresses.
Optional
vendors
A comma-separated list of vendor names.
Optional
vendor_ids
A comma-separated list of vendor IDs.
Optional
products
A comma-separated list of product names.
Optional
product_ids
A comma-separated list of product IDs.
Optional
serials
A comma-separated list of serial numbers.
Optional
hostnames
A comma-separated list of hostnames.
Optional
violation_id_list
A comma-separated list of violation IDs.
Optional
usernames
A comma-separated list of usernames.
Optional
Outputs
Core.EndpointViolations.violation_id number
The unique ID of the device control violation.
Core.EndpointViolations.endpoint_id string
The endpoint where the violation occurred.
Core.EndpointViolations.hostname string
The hostname of the endpoint.
Core.EndpointViolations.type string
The type of device that triggered the violation.
Core.EndpointViolations.vendor string
The vendor of the device.
Core.EndpointViolations.vendor_id string
The USB vendor ID.
Core.EndpointViolations.product string
The product name of the device.
Core.EndpointViolations.product_id string
The USB product ID.
Core.EndpointViolations.serial string
The serial number of the device.
Core.EndpointViolations.ip string
The IP address of the endpoint at the time of the violation.
Core.EndpointViolations.os_type string
The operating system family of the endpoint.
Core.EndpointViolations.username string
The user logged in when the violation occurred.
Core.EndpointViolations.timestamp number
Time of the violation in epoch milliseconds.
Core.EndpointViolations.date string
Human-readable date derived from Timestamp.
addEndpointTag
Add a tag to one or more endpoints. If no filters are provided, the tag will be added to all endpoints.
Arguments
tag
The tag name to assign to the endpoint(s).
Required
endpoint_id_list
A comma-separated list of endpoint IDs by which to filter the results.
Optional
dist_name
A comma-separated list of distribution package names or installation package names. Example: dist_name1,dist_name2.
Optional
ip_list
A comma-separated list of IP addresses. Example: 8.8.8.8,1.1.1.1.
Optional
group_name
A comma-separated list of group name to which the agent belongs.
Optional
platform
The endpoint platform. Possible values are: windows, linux, macos, android.
Optional
alias_name
A comma-separated list of alias names.
Optional
isolate
Specifies whether the endpoint was isolated or unisolated. Possible values are: isolated, unisolated.
Optional
hostname
A comma-separated list of hostnames.
Optional
first_seen_gte
All the agents that were first seen after the first_seen_gte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
first_seen_lte
All the agents that were first seen before the first_seen_lte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_gte
All the agents that were last seen before the last_seen_gte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_lte
All the agents that were last seen before the last_seen_lte. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
status
A comma-separated list of endpoint statuses to filter. Possible values are: connected, lost, disconnected, uninstalled.
Optional
Outputs
There are no outputs for this command.
setEndpointAlias
Gets a list of endpoints according to the passed filters, and changes their alias name. If no filters are provided, the alias will be changed for all endpoints. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported).
Arguments
status
A comma-separated list of endpoint statuses to use as a filter. Possible values are: connected, lost, disconnected, uninstalled.
Optional
endpoint_id_list
A comma-separated list of endpoint IDs to use as a filter.
Optional
dist_name
A comma-separated list of distribution package names or installation package names to use as a filter. Example: dist_name1,dist_name2.
Optional
ip_list
A comma-separated list of IP addresses to use as a filter. Example: 8.8.8.8,1.1.1.1.
Optional
group_name
A comma-separated list of group names to which the agent belongs to use as a filter.
Optional
platform
The endpoint platform to use as a filter. Possible values are: windows, linux, macos, android.
Optional
alias_name
A comma-separated list of alias names to use as a filter. Examples: alias_name1,alias_name2.
Optional
isolate
Specifies whether the endpoint was isolated or unisolated to use as a filter. Possible values are: isolated, unisolated.
Optional
hostname
A comma-separated list of hostnames to use as a filter.
Optional
first_seen_gte
All the agents that were first seen after {first_seen_gte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
first_seen_lte
All the agents that were first seen before {first_seen_lte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_gte
All the agents that were last seen after {last_seen_gte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_lte
All the agents that were last seen before {last_seen_lte} to use as a filter. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
username
A comma-separated list of usernames to use as a filter.
Optional
new_alias_name
The alias name to change to. Note: If you send an empty field, (e.g., new_alias_name="") the current alias name is deleted.
Required
scan_status
A comma-separated list of scan statuses of the endpoint to use as a filter. Possible values are: none, pending, in_progress, canceled, aborted, timeout, pending_cancellation, success, error.
Optional
Outputs
There are no outputs for this command.
setEndpointVersion
Updates the agent version on the specified endpoints, optionally within a scheduled day and time window.
Arguments
endpoint_ids
A comma-separated list of endpoint IDs.
Required
platform
The platform of the endpoints. Possible values are: windows, linux, macos.
Required
version
The target version for updating the endpoints.
Required
start_time
The start time for the update, in 24-hour format (HH:MM). Must be provided together with end_time. Ensure that there are at least two hours between the start time and the end time.
Optional
end_time
The end time for the update, in 24-hour format (HH:MM). Must be provided together with start_time.
Optional
days
A comma-separated list of days of the week the update may run. Possible values are: Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday.
Optional
Outputs
Core.EndpointUpdate.EndpointIDs string
The endpoint IDs targeted by the update.
Core.EndpointUpdate.ActionID string
The resulting group action ID ('0' indicates failure).
blockIPs
Blocks one or more malicious or suspicious IPv4 or IPv6 addresses on the specified endpoints.
Note: This is a polling command.
Arguments
endpoint_ids
A comma-separated list of endpoint IDs that support the block-IP operation. Endpoint IDs can be obtained using the getEndpoints command.
Required
ip_addresses
A comma-separated list of IPv4 or IPv6 addresses to block.
Required
duration
Number of minutes to block the addresses (1 – 518,399). Defaults to 300.
Optional
interval_in_seconds
Seconds to wait between polling cycles. Default is 10.
Optional
timeout_in_seconds
Maximum polling duration in seconds. Default is 60.
Optional
Outputs
Core.ip_block_results.ip_address string
The IPv4 or IPv6 address that was processed.
Core.ip_block_results.endpoint_id string
The endpoint on which the block-IP action was attempted.
Core.ip_block_results.reason string
'Success' on success, or ': ' describing the failure.
removeEndpointTag
Remove a tag from one or more endpoints. If no filters are provided, the tag will be removed from all endpoints.
Arguments
tag
The tag name to remove from the endpoint(s).
Required
endpoint_id_list
A comma-separated list of endpoint IDs to filter by them.
Optional
dist_name
A comma-separated list of distribution package names or installation package names. Example: dist_name1,dist_name2.
Optional
ip_list
A comma-separated list of IP addresses. Example: 8.8.8.8,1.1.1.1.
Optional
group_name
A comma-separated list of group names to which the agent belongs. Example: group_name1,group_name2.
Optional
platform
The endpoint platform. Possible values are: windows, linux, macos, android.
Optional
alias_name
A comma-separated list of alias names. Examples: alias_name1,alias_name2.
Optional
isolate
Specifies whether the endpoint was isolated or unisolated. Possible values are: isolated, unisolated.
Optional
hostname
A comma-separated list of hostnames. Example: hostname1,hostname2.
Optional
first_seen_gte
All the agents that were first seen after {first_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
first_seen_lte
All the agents that were first seen before {first_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_gte
All the agents that were last seen before {last_seen_gte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
last_seen_lte
All the agents that were last seen before {last_seen_lte}. Supported values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00" (date).
Optional
status
A comma-separated list of endpoint statuses to filter. Possible values are: connected, lost, disconnected, uninstalled.
Optional
Outputs
There are no outputs for this command.
retrieveFiles
Retrieves files from the selected endpoints and uploads them for forensic analysis. Up to 20 files from no more than 10 endpoints can be retrieved per call.
Note: This is a polling command.
Arguments
endpoint_ids
A comma-separated list of endpoint IDs to retrieve files from. Endpoint IDs can be obtained using the getEndpoints command.
Required
windows_file_paths
A comma-separated list of file paths on Windows endpoints.
Optional
linux_file_paths
A comma-separated list of file paths on Linux endpoints.
Optional
mac_file_paths
A comma-separated list of file paths on macOS endpoints.
Optional
generic_file_path
A comma-separated list of file paths used in parallel with endpoint_ids (the n-th file path is retrieved from the n-th endpoint). Use instead of the per-OS path arguments.
Optional
alert_id
Links the response action to the case that triggered it.
Optional
interval_in_seconds
Seconds to wait between polling cycles. Default is 10.
Optional
timeout_in_seconds
Maximum polling duration in seconds. Default is 600.
Optional
Outputs
File.Size number
The size of the file.
File.SHA1 string
The SHA1 hash of the file.
File.SHA256 string
The SHA256 hash of the file.
File.Name string
The name of the file.
File.SSDeep string
The SSDeep hash of the file.
File.EntryID string
The entry ID of the file.
File.Info string
File information.
File.Type string
The file type.
File.MD5 string
The MD5 hash of the file.
File.Extension string
The file extension.
terminateCausality
Terminates a process tree on an agent by its causality ID.
Arguments
agent_id
The agent (endpoint) ID on which to terminate the causality. Agent IDs can be obtained using the getEndpoints command.
Required
causality_id
A comma-separated list of causality IDs to terminate.
Required
process_name
The name of the process being terminated. Used in the human-readable output.
Optional
alert_id
Links the response action to the case that triggered it.
Optional
interval_in_seconds
Seconds to wait between polling cycles. Default is 10.
Optional
timeout_in_seconds
Maximum polling duration in seconds. Default is 600.
Optional
Outputs
Core.TerminateCausality(val.action_id && val.action_id == obj.action_id).action_id number
The group action ID returned for the terminate request.
Core.GetActionStatus.action_id number
The specified action ID.
Core.GetActionStatus.endpoint_id string
Endpoint ID.
Core.GetActionStatus.status string
The status of the specific endpoint ID.
Core.GetActionStatus.error_description string
Description of the error if the action failed.
Core.GetActionStatus.ErrorReasons.bucket string
The bucket in which the error occurred.
Core.GetActionStatus.ErrorReasons.file_name string
The name of the file that caused the error.
Core.GetActionStatus.ErrorReasons.file_path string
The path of the file that caused the error.
Core.GetActionStatus.ErrorReasons.file_size number
The size of the file that caused the error.
Core.GetActionStatus.ErrorReasons.missing_files unknown
The missing files that caused the error.
Core.GetActionStatus.ErrorReasons.errorData string
The error reason data.
Core.GetActionStatus.ErrorReasons.terminated_by string
The instance ID which terminated the action and caused the error.
Core.GetActionStatus.ErrorReasons.errorDescription string
The error reason description.
Core.GetActionStatus.ErrorReasons.terminate_result.path string
The path of the file the terminate action targeted.
Core.GetActionStatus.ErrorReasons.terminate_result.status number
The terminate result status code for the file.
terminateProcess
Terminates a process on an agent by its instance ID.
Note: This is a polling command.
Arguments
agent_id
The agent (endpoint) ID on which to terminate the process. Agent IDs can be obtained using the getEndpoints command.
Required
instance_id
A comma-separated list of process instance IDs to terminate.
Required
process_name
The name of the process being terminated. Used in the human-readable output.
Optional
alert_id
Links the response action to the case that triggered it.
Optional
interval_in_seconds
Seconds to wait between polling cycles. Default is 10.
Optional
timeout_in_seconds
Maximum polling duration in seconds. Default is 600.
Optional
Outputs
Core.TerminateProcess(val.action_id && val.action_id == obj.action_id).action_id number
The group action ID returned for the terminate request.
Core.GetActionStatus.action_id number
The specified action ID.
Core.GetActionStatus.endpoint_id string
Endpoint ID.
Core.GetActionStatus.status string
The status of the specific endpoint ID.
Core.GetActionStatus.error_description string
Description of the error if the action failed.
Core.GetActionStatus.ErrorReasons.bucket string
The bucket in which the error occurred.
Core.GetActionStatus.ErrorReasons.file_name string
The name of the file that caused the error.
Core.GetActionStatus.ErrorReasons.file_path string
The path of the file that caused the error.
Core.GetActionStatus.ErrorReasons.file_size number
The size of the file that caused the error.
Core.GetActionStatus.ErrorReasons.missing_files unknown
The missing files that caused the error.
Core.GetActionStatus.ErrorReasons.errorData string
The error reason data.
Core.GetActionStatus.ErrorReasons.terminated_by string
The instance ID which terminated the action and caused the error.
Core.GetActionStatus.ErrorReasons.errorDescription string
The error reason description.
Core.GetActionStatus.ErrorReasons.terminate_result.path string
The path of the file the terminate action targeted.
Core.GetActionStatus.ErrorReasons.terminate_result.status number
The terminate result status code for the file.
getYaraRules
Returns a list of YARA rules based on the provided filter criteria.
NOTE: This command has a Quick Action: List YARA Rules.
Arguments
filter_field
The field to filter rules by. Each field supports only a subset of the operators: id (EQUALS, NOT_EQUALS); name, origin, author, created_by (EQUALS, NOT_EQUALS, CONTAINS, NOT_CONTAINS); description (CONTAINS, NOT_CONTAINS); first_seen (GTE, LTE). Possible values are: id, name, origin, description, author, created_by, first_seen.
Optional
filter_operator
The operator used to compare the filter field against the filter value. The supported operators depend on the selected filter_field. Possible values are: EQUALS, NOT_EQUALS, CONTAINS, NOT_CONTAINS, GTE, LTE.
Optional
filter_value
The value to match against the filter field. For the first_seen date field, accepts relative (for example, "7 days ago") or absolute ISO (for example, "2023-01-01T00:00:00Z") forms.
Optional
filters_json
A JSON-encoded string representing a full filter array for multi-condition queries. Cannot be combined with filter_field, filter_operator, or filter_value.
Optional
sort_field
The field to sort the results by. Possible values are: author, created_by, first_seen, name, origin.
Optional
sort_order
The order in which to sort the results. Possible values are: asc, desc.
Optional
limit
The maximum number of results to return. Default is 50.
Optional
page_size
The number of results per page.
Optional
page
The page number to retrieve.
Optional
Outputs
Core.YaraRule.TotalCount number
Total rules in the tenant.
Core.YaraRule.FilterCount number
Rules matching the current filter.
Core.YaraRule.Rules.ID string
Platform UUID of the rule.
Core.YaraRule.Rules.Name string
Rule name.
Core.YaraRule.Rules.Origin string
Ingestion channel.
Core.YaraRule.Rules.FirstSeen number
Upload timestamp (epoch ms).
Core.YaraRule.Rules.Description string
Rule description.
Core.YaraRule.Rules.Author string
Rule author (from metadata).
Core.YaraRule.Rules.CreatedBy string
Uploader identity.
Core.YaraRule.Rules.RuleContent string
Raw text of the YARA rule.
deleteYaraRules
Deletes the specified YARA rules by their platform-generated identifiers.
NOTE: This command has a Quick Action: Delete YARA Rule(s).
Arguments
rule_ids
A comma-separated list of the platform-generated UUIDs of the YARA rules to delete.
Required
Outputs
Core.YaraRuleDelete.Status string
The status of the bulk delete.
Core.YaraRuleDelete.DeletedCount number
Count of rules successfully deleted.
Core.YaraRuleDelete.FailedDeletions string
IDs that could not be deleted.
addYaraRules
Adds one or more YARA rules. Rules that fail server-side validation are reported as dropped. NOTE: This command has a Quick Action: Add YARA Rule(s).
Arguments
rule_content
The raw text of the YARA rule(s) to add.
Optional
rules_json
A JSON-encoded array of objects, each with a rule_content field, for adding multiple rules.
Optional
Outputs
Core.YaraRuleAdd.AddedRules string
Names of rules validated and added.
Core.YaraRuleAdd.DroppedRules string
Names of rules dropped during validation.
startYaraScan
Starts a YARA scan on the selected endpoints and returns an action ID. Ineligible endpoints (non-Windows, agent version below 9.4, disconnected, or with an in-flight scan) are discarded by the platform. NOTE: This command has a Quick Action: Run YARA scan.
Arguments
rule_ids
A comma-separated list of the UUIDs of the YARA rules to run. A maximum of 500 rules per scan is allowed.
Required
endpoint_ids
A comma-separated list of the endpoint IDs to scan.
Required
scan_name
A name for the scan. A maximum of 100 characters is allowed.
Required
scope_type
Whether the scope_content paths are included in or excluded from the scan. Possible values are: include, exclude.
Optional
scope_content
A comma-separated list of file or folder paths (wildcards allowed) that define the scan scope. Requires scope_type.
Optional
abortYaraScan
Aborts a running YARA scan identified by its action ID.
NOTE: This command has a Quick Action: Abort YARA Scan.
Last updated
Was this helpful?