> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/vulnerability-commands.md).
# Vulnerability Commands
* [getVulnerabilities](#getvulnerabilities)
* [getVulnerabilityDetails](#getvulnerabilitydetails)
* [getAffectedSoftware](#getaffectedsoftware)
* [triggerAssetScan](#triggerassetscan)
* [uploadVulnerabilityScan](#uploadvulnerabilityscan)
#### getVulnerabilities
***
Returns a list of vulnerabilities based on the provided filter criteria.
Arguments
| Argument Name | Description | Required |
| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| limit | The maximum number of vulnerabilities to return. Default is 50. | Optional |
| page\_size | The number of vulnerabilities to return per page. When provided, manual pagination is used and 'limit' is ignored. | Optional |
| page | The page number to return (0-based). When provided, manual pagination is used and 'limit' is ignored. | Optional |
| sort\_field | The field by which to sort the results. Possible values are: PLATFORM\_SEVERITY, CVSS\_SCORE, EPSS\_SCORE, CORTEX\_VULNERABILITY\_RISK\_SCORE, LAST\_OBSERVED. Default is LAST\_OBSERVED. | Optional |
| sort\_order | The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC. | Optional |
| cve\_ids | A comma-separated list of CVE IDs to filter by. | Optional |
| issue\_ids | A comma-separated list of issue IDs to filter by. | Optional |
| cvss\_score\_gte | The minimum CVSS score to filter by. | Optional |
| epss\_score\_gte | The minimum EPSS score to filter by. | Optional |
| internet\_exposed | Whether to filter by internet-exposed assets. Possible values are: true, false. | Optional |
| exploitable | Whether to filter by exploitable vulnerabilities. Possible values are: true, false. | Optional |
| has\_kev | Whether to filter by vulnerabilities that have a Known Exploited Vulnerability (KEV). Possible values are: true, false. | Optional |
| affected\_softwares | A comma-separated list of affected software to filter by. | Optional |
| on\_demand\_fields | A comma-separated list of additional fields to retrieve. | Optional |
| start\_time | The start time for filtering according to the issue last-observed time. Supports free-text relative and absolute times. For example: '7 days ago', '2023-06-15T10:30:00Z'. | Optional |
| end\_time | The end time for filtering according to the issue last-observed time. Supports free-text relative and absolute times. For example: '7 days ago', '2023-06-15T10:30:00Z'. | Optional |
| severities | A comma-separated list of vulnerability issue severities to filter by. Possible values are: info, low, medium, high, critical. | Optional |
| assignees | A comma-separated list of emails of the users assigned to the vulnerability. Use 'unassigned' for unassigned vulnerabilities or 'assigned' for all assigned vulnerabilities. | Optional |
| finding\_sources | A comma-separated list of finding sources of the vulnerability to filter by. Possible values are: CORTEX\_AGENT, CORTEX\_AGENTLESS\_SCANNER, CORTEX\_ATTACK\_SURFACE\_MANAGEMENT, CORTEX\_ATTACK\_SURFACE\_TESTING, CORTEX\_CLI\_SCANNER, CORTEX\_CONTAINER\_REGISTRY\_SCANNER, CORTEX\_NETWORK\_SCANNER, CORTEX\_SERVERLESS\_FUNCTION\_SCANNER, QUALYS, TENABLE. | Optional |
| cvrs\_gte | The minimum risk score assigned to the vulnerability (range 0-100). | Optional |
| compensating\_controls\_effective\_coverage | A comma-separated list of assessed effectiveness and coverage values of detected compensating controls to filter by. Possible values are: EFFECTIVE, EFFECTIVE\_REQUIRES\_CONFIGURATION\_UPDATE, EFFECTIVE\_REQUIRES\_CONTENT\_UPDATE, EXPLOIT\_CONFIRMED, EXPLOIT\_UNREACHABLE, NOT\_INSTALLED, NO\_CONTROLS\_FOUND, UNKNOWN\_COVERAGE. | Optional |
Outputs
**Core.VulnerabilityIssue.IssueID** *string*
The unique identifier of the vulnerability issue.
**Core.VulnerabilityIssue.CVEID** *string*
The CVE ID of the vulnerability.
**Core.VulnerabilityIssue.CVEDescription** *string*
The description of the CVE.
**Core.VulnerabilityIssue.AssetName** *string*
The name of the affected asset.
**Core.VulnerabilityIssue.PlatformSeverity** *string*
The platform severity of the vulnerability.
**Core.VulnerabilityIssue.EPSSScore** *number*
The EPSS score of the vulnerability.
**Core.VulnerabilityIssue.CVSSScore** *number*
The CVSS score of the vulnerability.
**Core.VulnerabilityIssue.AssignedTo** *string*
The user assigned to the vulnerability.
**Core.VulnerabilityIssue.AssignedToPretty** *string*
The display name of the user assigned to the vulnerability.
**Core.VulnerabilityIssue.AffectedSoftware** *unknown*
The software affected by the vulnerability.
**Core.VulnerabilityIssue.FixAvailable** *boolean*
Whether a fix is available for the vulnerability.
**Core.VulnerabilityIssue.InternetExposed** *boolean*
Whether the affected asset is internet-exposed.
**Core.VulnerabilityIssue.HasKEV** *boolean*
Whether the vulnerability has a Known Exploited Vulnerability (KEV).
**Core.VulnerabilityIssue.Exploitable** *boolean*
Whether the vulnerability is exploitable.
**Core.VulnerabilityIssue.AssetIDs** *string*
The IDs of the affected assets.
**Core.VulnerabilityIssue.FindingSources** *string*
The finding sources of the vulnerability.
**Core.VulnerabilityIssue.CompensatingControlsDetectedCoverage** *string*
The detected coverage of compensating controls.
**Core.VulnerabilityIssue.CortexVulnerabilityRiskScore** *number*
The Cortex vulnerability risk score.
**Core.VulnerabilityIssue.FixVersions** *string*
The versions that fix the vulnerability.
**Core.VulnerabilityIssue.AssetTypes** *string*
The types of the affected assets.
**Core.VulnerabilityIssue.CompensatingControlsDetectedControls** *unknown*
The detected compensating controls.
**Core.VulnerabilityIssue.ExploitLevel** *string*
The exploit level of the vulnerability.
**Core.VulnerabilityIssue.IssueName** *string*
The name of the vulnerability issue.
**Core.VulnerabilityIssue.PackageInUse** *boolean*
Whether the affected package is in use.
**Core.VulnerabilityIssue.Providers** *string*
The providers of the affected asset.
**Core.VulnerabilityIssue.OSFamily** *string*
The operating system family of the affected asset.
**Core.VulnerabilityIssue.Image** *string*
The image of the affected asset.
#### getVulnerabilityDetails
***
Gets vulnerability details by CVE ID.
Arguments
| Argument Name | Description | Required |
| ----------------- | --------------------------------------------- | -------- |
| vulnerability\_id | The vulnerability ID to retrieve details for. | Required |
Outputs
**Core.Vulnerability.vulnerabilityID** *string*
The unique identifier of the vulnerability (CVE ID).
**Core.Vulnerability.description** *string*
Detailed description of the vulnerability.
**Core.Vulnerability.cvss.baseScoreMetrics.attackComplexity** *string*
The attack complexity required to exploit the vulnerability.
**Core.Vulnerability.cvss.baseScoreMetrics.attackVector** *string*
The attack vector of the vulnerability (e.g., Network, Local).
**Core.Vulnerability.cvss.baseScoreMetrics.availabilityImpact** *string*
The impact on availability if the vulnerability is exploited.
**Core.Vulnerability.cvss.baseScoreMetrics.confidentialityImpact** *string*
The impact on confidentiality if the vulnerability is exploited.
**Core.Vulnerability.cvss.baseScoreMetrics.integrityImpact** *string*
The impact on integrity if the vulnerability is exploited.
**Core.Vulnerability.cvss.baseScoreMetrics.privilegesRequired** *string*
The level of privileges required to exploit the vulnerability.
**Core.Vulnerability.cvss.baseScoreMetrics.scope** *string*
Whether the vulnerability can affect resources beyond its security scope.
**Core.Vulnerability.cvss.baseScoreMetrics.userInteraction** *string*
Whether user interaction is required to exploit the vulnerability.
**Core.Vulnerability.cvss.score** *number*
The CVSS base score.
**Core.Vulnerability.cvss.scoreSource** *string*
The source of the CVSS score.
**Core.Vulnerability.cvss.severity** *string*
The CVSS severity rating (e.g., Critical, High, Medium, Low).
**Core.Vulnerability.cvss.severitySource** *string*
The source of the CVSS severity rating.
**Core.Vulnerability.cvss.vectorString** *string*
The CVSS vector string representation.
**Core.Vulnerability.cvss.version** *string*
The version of the CVSS scoring system used.
**Core.Vulnerability.epss\_score** *number*
The probability of exploitability (0-1).
**Core.Vulnerability.exploitDetails.commercialExploitFound** *boolean*
Whether a commercial exploit exists for the vulnerability.
**Core.Vulnerability.exploitDetails.exploitMaturity** *string*
Current state of exploit availability (e.g., weaponized).
**Core.Vulnerability.exploitDetails.firstReportedThreatActor** *number*
The timestamp of the first recorded threat actor activity.
**Core.Vulnerability.exploitDetails.mostRecentReportedThreatActor** *number*
The timestamp of the last recorded threat actor activity.
**Core.Vulnerability.exploitDetails.publicExploitFound** *boolean*
Whether a public exploit exists for the vulnerability.
**Core.Vulnerability.exploitDetails.reportedExploited** *boolean*
Whether the vulnerability has been actively exploited.
**Core.Vulnerability.exploitDetails.reportedExploitedByBotnets** *boolean*
Whether the vulnerability is being leveraged by botnet clusters.
**Core.Vulnerability.exploitDetails.reportedExploitedByRansomware** *boolean*
Whether the vulnerability is used in ransomware campaigns.
**Core.Vulnerability.exploitDetails.reportedExploitedByThreatActors** *boolean*
Whether known threat actors are exploiting this vulnerability.
**Core.Vulnerability.exploitDetails.weaponizedExploitFound** *boolean*
Whether a functional exploit exists in the wild.
**Core.Vulnerability.fixVersions** *string*
The versions that fix the vulnerability.
**Core.Vulnerability.isKev** *boolean*
Whether the vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog.
**Core.Vulnerability.temporalCvss.confidence** *string*
The confidence level of the temporal CVSS score.
**Core.Vulnerability.temporalCvss.score** *number*
The temporal CVSS score.
**Core.Vulnerability.temporalCvss.vectorString** *string*
The temporal CVSS vector string representation.
**Core.Vulnerability.temporalCvss.version** *string*
The version of the CVSS scoring system used for the temporal score.
#### getAffectedSoftware
***
Gets a filtered list of the software affected by one or more vulnerabilities. If no filters are provided, all results are returned.
Arguments
| Argument Name | Description | Required |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| vulnerability\_id | Filter by vulnerability ID. Example: CVE-2024-1234. | Optional |
| package\_name | Filter by package name. Example: openssl, curl. | Optional |
| cvss\_severity | Filter by CVSS severity level. Possible values: LOW, MEDIUM, HIGH, CRITICAL. Possible values are: LOW, MEDIUM, HIGH, CRITICAL. | Optional |
| cvss\_score | Filter by CVSS score. Example: 7.5. | Optional |
| dist\_name | Filter by distribution name. Example: ubuntu, debian, rhel. | Optional |
| release\_version | Filter by release version. Example: 22.04, 11, 9. | Optional |
| affected\_cpu\_archs | A comma-separated list of CPU architectures to filter by. Example: x86\_64,aarch64. | Optional |
| affected\_versions | A comma-separated list of affected software versions to filter by. Example: 1.1.1,1.0.2. | Optional |
| sort\_field | Field to sort results by. Default is cvss\_score. Possible values: vulnerability\_id, cvss\_score, cvss\_severity, package\_name, distro, release, last\_modified. Possible values are: vulnerability\_id, cvss\_score, cvss\_severity, package\_name, distro, release, last\_modified. Default is cvss\_score. | Optional |
| sort\_order | Sort order for results. Default is desc. Possible values: asc, desc. Possible values are: asc, desc. Default is desc. | Optional |
| search\_from | Start offset index of results. Default is 0. Default is 0. | Optional |
| search\_to | End offset index of results. Default is 500. Default is 500. | Optional |
Outputs
**Core.AffectedSoftware.vulnerability\_id** *string*
The vulnerability identifier (e.g., CVE ID).
**Core.AffectedSoftware.cvss\_score** *number*
The CVSS score of the vulnerability.
**Core.AffectedSoftware.cvss\_severity** *string*
The CVSS severity level of the vulnerability.
**Core.AffectedSoftware.package\_name** *string*
The name of the affected package.
**Core.AffectedSoftware.distro** *string*
The distribution name.
**Core.AffectedSoftware.release** *string*
The release version.
**Core.AffectedSoftware.affected\_cpu\_archs** *string*
The affected CPU architectures.
**Core.AffectedSoftware.affected\_versions** *string*
The affected software versions.
#### triggerAssetScan
***
Triggers a vulnerability scan for a specific asset. The asset ID is obtained from the assets view. The scanner type should match the asset's finding source (e.g., CORTEX\_XDR\_AGENT for agent-based findings, CORTEX\_XDR\_AGENTLESS for agentless findings, CORTEX\_NETWORK\_SCANNER for network scanner findings).
Arguments
| Argument Name | Description | Required |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| asset\_id | The asset ID from the vulnerability management asset view. | Required |
| scanner\_type | The scanner type matching the asset's finding source. Possible values: CORTEX\_NETWORK\_SCANNER, CORTEX\_XDR\_AGENT, CORTEX\_XDR\_AGENTLESS. Possible values are: CORTEX\_NETWORK\_SCANNER, CORTEX\_XDR\_AGENT, CORTEX\_XDR\_AGENTLESS. | Required |
| cve\_id | The CVE identifier (e.g., CVE-2024-1234). Required when scanner\_type is CORTEX\_NETWORK\_SCANNER. | Optional |
| scan\_target | The scan target for CORTEX\_XDR\_AGENT on Linux endpoints. Possible values: CONTAINER, HOST, IMAGE. Possible values are: CONTAINER, HOST, IMAGE. | Optional |
Outputs
**Core.AssetScan.AssetID** *string*
The asset ID for which the scan was triggered.
**Core.AssetScan.Message** *string*
The response message from the scan trigger.
**Core.AssetScan.ScanID** *number*
The scan ID if available.
#### uploadVulnerabilityScan
***
Upload vulnerability scan results from third-party scanners to Exposure Management and poll for the upload job to complete.
Note: This is a polling command.
Arguments
| Argument Name | Description | Required |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| vendor | Vendor name of the scanning tool (e.g., TENABLE, QUALYS) | Required |
| product | Product name of the scanning tool (e.g., Nessus, Qualys VMDR) | Required |
| version | Version of the scanning tool | Optional |
| assets\_json | JSON array of assets with vulnerabilities. The JSON schema must match the format required in the API documentation: . | Required |
| interval\_in\_seconds | The polling interval in seconds between each job-status check. Default is 30. | Optional |
| timeout\_in\_seconds | The total polling timeout in seconds. Default is 600. | Optional |
**Outputs**
There are no outputs for this command.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/vulnerability-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.