Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Endpoint Management

APIs for managing endpoints

Get all Endpoints

post

Gets a list of all of your endpoints. The response is concatenated using AND condition (OR is not supported).

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
objectOptional
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/get_endpoints
POST /public_api/v1/endpoints/get_endpoints HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{
  "reply": [
    {
      "agent_id": "<agent_id>",
      "agent_status": "DISCONNECTED",
      "operational_status": "PROTECTED",
      "host_name": "<hostname>",
      "agent_type": "Workstation",
      "ip": [
        "<ip_address>"
      ],
      "last_seen": 1678012587521,
      "tags": {
        "server_tags": [],
        "endpoint_tags": []
      },
      "users": [
        "user"
      ]
    }
  ]
}

Get Endpoint

post

Gets a list of filtered endpoints.

  • The response is concatenated using AND condition (OR is not supported).

  • The maximum result set size is 100.

  • Offset is the zero-based number of endpoints from the start of the result set.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

OK

application/json
post/public_api/v1/endpoints/get_endpoint
POST /public_api/v1/endpoints/get_endpoint HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 377

{
  "request_data": {
    "search_from": 0,
    "search_to": 1,
    "sort": {
      "field": "endpoint_id",
      "keyword": "asc"
    },
    "filters": [
      {
        "field": "endpoint_status",
        "operator": "eq",
        "value": "disconnected"
      },
      {
        "field": "dist_name",
        "operator": "in",
        "value": [
          "papi-test"
        ]
      },
      {
        "field": "scan_status",
        "operator": "in",
        "value": [
          "none",
          "pending",
          "in_progress",
          "pending_cancellation",
          "aborted",
          "success",
          "canceled",
          "error"
        ]
      }
    ]
  }
}
{
  "reply": {
    "total_count": 0,
    "result_count": 0,
    "endpoints": [
      {
        "endpoint_id": "string",
        "endpoint_name": "string",
        "endpointTags": "string",
        "endpoint_type": "string",
        "endpoint_status": "string",
        "os_type": "string",
        "os_version": "string",
        "ip": [
          "string"
        ],
        "ipv6": [
          {}
        ],
        "public_ip": "string",
        "users": [
          "string"
        ],
        "domain": "string",
        "alias": "string",
        "first_seen": 0,
        "last_seen": 0,
        "content_version": "string",
        "installation_package": "string",
        "active_directory": null,
        "install_date": 0,
        "endpoint_version": "string",
        "is_isolated": "string",
        "isolated_date": null,
        "group_name": [
          {}
        ],
        "operational_status": "string",
        "operational_status_description": "string",
        "scan_status": "string",
        "content_release_timestamp": 0,
        "last_content_update_time": 0,
        "content_status": "string",
        "operating_system": "string",
        "mac_address": [
          "string"
        ],
        "assigned_prevention_policy": "string",
        "assigned_extensions_policy": "string"
      }
    ]
  }
}

Set an Endpoint Alias

post

Set or modify an Alias field for your endpoints.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
booleanOptional

true=The alias name was set or modified successfully.

post/public_api/v1/endpoints/update_agent_name
POST /public_api/v1/endpoints/update_agent_name HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 128

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<distribution_id>"
        ]
      }
    ],
    "alias": "<alias_name>"
  }
}
true

Get Policy

post

Get the policy name for a specific endpoint.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/get_policy
POST /public_api/v1/endpoints/get_policy HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 48

{
  "request_data": {
    "endpoint_id": "<endpoint ID>"
  }
}
{
  "reply": {
    "policy_name": "Windows Default"
  }
}

Delete Endpoints

post

Delete selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.

Note: Endpoints are deleted from the Cortex XDR app web interface, however they still exist in the database.

When filtering by multiple fields:

  • Response is concatenated using AND condition (OR is not supported).

  • Maximum result set size is 1000.

  • Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/delete
POST /public_api/v1/endpoints/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 101

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      }
    ]
  }
}

Get endpoint security profiles

post

Returns a list of endpoint security profiles of the requested type. Optionally filters by a list of profile IDs.

Required permission: profiles_view

Notes:

  • File-Integrity-Monitoring (FIM) extension profiles are omitted when FIM is disabled for the profile's OS type.

  • is_in_user_scope and at_risk are removed from every profile object before the response is returned.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

OK. Profiles retrieved successfully

application/json

Successful response envelope

post/public_api/v1/endpoints/get_profiles
POST /public_api/v1/endpoints/get_profiles HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 38

{
  "request_data": {
    "type": "prevention"
  }
}
{
  "reply": [
    {
      "id": 1,
      "uuid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "name": "Default Malware Profile",
      "type": "MALWARE",
      "platform": "AGENT_OS_WINDOWS",
      "is_default": true,
      "is_global": false,
      "is_disabled": false,
      "associated_targets": [
        "All endpoints"
      ],
      "usage_count": 5,
      "description": "Default anti-malware profile for Windows",
      "created_by": "system",
      "created_by_pretty": "Palo Alto Networks",
      "creation_time": 1700000000000,
      "modified_by": "admin@example.com",
      "modified_by_pretty": "Admin User",
      "modification_time": 1710000000000,
      "modules": {
        "malware": {
          "mode": "prevent"
        }
      }
    },
    {
      "id": 2,
      "uuid": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
      "name": "Custom Exploit Profile",
      "type": "EXPLOIT",
      "platform": "AGENT_OS_MAC",
      "is_default": false,
      "is_global": false,
      "is_disabled": false,
      "associated_targets": [
        "macOS Servers"
      ],
      "usage_count": 2,
      "description": null,
      "created_by": "admin@example.com",
      "created_by_pretty": "Admin User",
      "creation_time": 1705000000000,
      "modified_by": "admin@example.com",
      "modified_by_pretty": "Admin User",
      "modification_time": 1705000000000,
      "modules": {}
    }
  ]
}

Get Legacy Exceptions Modules

post

Get a list of supported legacy exception modules available in the tenant. Each module entry includes its module_id, supported platforms, and the conditions_definition schema that must be used when creating or editing a legacy exception rule for that module.

Note: No request body required. Send an empty body.

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
post/public_api/v1/legacy_exceptions/get_modules
POST /public_api/v1/legacy_exceptions/get_modules HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Accept: */*
200

OK

{
  "reply": [
    {
      "module_id": 1,
      "pretty_name": "Malware > Respond to Malicious Causality Chains",
      "title": "Respond to Malicious Causality Chains",
      "label": "Allow List of Remote Ipv4/ipv6 Ip Address, Range or Cidr",
      "profile_type": "Malware",
      "platforms": [
        "Windows",
        "macOS"
      ],
      "conditions_definition": {
        "remoteIpsWhitelist": {
          "schema": {
            "type": "array",
            "items": {
              "type": "string"
            },
            "minItems": 1
          },
          "description": "List of valid Ipv4/ipv6 Ip Address, Ranges or Cidrs"
        }
      }
    }
  ]
}

Fetch Legacy Exception Rules

post

Retrieves a paginated list of Legacy Exception rules for agents based on optional filters and sorting criteria.

This endpoint allows you to:

  • Retrieve all rules or filter by specific criteria

  • Sort results by any field in ascending or descending order

  • Paginate through large result sets

  • Get total count and filtered count of rules

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body

Request body containing pagination, sorting, and filtering parameters for fetching legacy exception rules.

Responses
200

OK

application/json

A legacy exception record as returned by the fetch API.

post/public_api/v1/legacy_exceptions/fetch
POST /public_api/v1/legacy_exceptions/fetch HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 254

{
  "request_data": {
    "search_from": 0,
    "search_to": 10,
    "sort": {
      "field": "id",
      "keyword": "desc"
    },
    "filters": [
      {
        "field": "status",
        "operator": "eq",
        "value": "ENABLED"
      },
      {
        "field": "module",
        "operator": "in",
        "value": 43
      },
      {
        "field": "platform",
        "operator": "eq",
        "value": "Windows"
      }
    ]
  }
}
{
  "reply": {
    "DATA": [
      {
        "id": "d9c06bfa3f9b45a7a0196244e68d181d",
        "rule_name": "Legacy Exception Rule 1",
        "platform": "Linux",
        "conditions": "Process Name = Another test process AND Modules = Disable Injection OR Process Name = Test process AND Modules = Child Process Protection",
        "module": 43,
        "module_name": "Exceptions > Process Exceptions",
        "description": "rule 1",
        "generating_alert_id": null,
        "created_by": "John Doe",
        "modification_time": 1772111647000,
        "user_email": "john.doe@example.com",
        "status": "ENABLED",
        "profile_ids": [
          27
        ],
        "associated_targets": [
          "Any"
        ],
        "is_in_user_scope": true
      },
      {
        "id": "0a2661779a2d4a87b051158ea47f0022",
        "rule_name": "Legacy Exception Rule 2",
        "platform": "Windows",
        "conditions": "Remote IP Address : 192.168.1.45",
        "module": 1,
        "module_name": "Malware > Respond to Malicious Causality Chains",
        "description": "test",
        "generating_alert_id": null,
        "created_by": "Jane Doe",
        "modification_time": 1772089294000,
        "user_email": "jane.doe@example.com",
        "status": "ENABLED",
        "profile_ids": [
          29
        ],
        "associated_targets": [],
        "is_in_user_scope": true
      }
    ],
    "FILTER_COUNT": 2,
    "TOTAL_COUNT": 2
  }
}

Add Legacy Exception Rule

post

Create a new legacy exception rule.

Prerequisites:

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replystringOptional

The ID of the newly created legacy exception rule.

Example: f87c6f24205249d896677ab63626d4f4
post/public_api/v1/legacy_exceptions/add
POST /public_api/v1/legacy_exceptions/add HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 233

{
  "request_data": {
    "name": "Test Legacy Exception rule 1",
    "platform": "Windows",
    "module": 1,
    "profile_ids": [
      29
    ],
    "status": "ENABLED",
    "scope": "PROFILE",
    "description": "my legacy rule desc",
    "conditions": {
      "remoteIpsWhitelist": [
        "192.168.1.45"
      ]
    }
  }
}
200

OK

{
  "reply": "f87c6f24205249d896677ab63626d4f4"
}

Edit Legacy Exception Rule

post

Update an existing legacy exception rule.

Prerequisites:

To get the required fields:

  • Use Get Legacy Exceptions Modules API to retrieve existing exception details.

  • The id field in the fetch API response corresponds to exception_id in this request.

  • The rule_name field in the fetch API response corresponds to name in this request.

  • The scope field is not returned by the fetch API. Use "PROFILE" if profile_ids is non-empty in the fetch response; use "GLOBAL" if profile_ids is [].

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replystringOptional

The ID of the edited legacy exception rule.

Example: f87c6f24205249d896677ab63626d4f4
post/public_api/v1/legacy_exceptions/edit
POST /public_api/v1/legacy_exceptions/edit HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 315

{
  "request_data": {
    "exception_id": "f87c6f24205249d896677ab63626d4f4",
    "update_data": {
      "name": "Edit legacy exception rule",
      "platform": "Windows",
      "module": 1,
      "profile_ids": [
        29
      ],
      "status": "DISABLED",
      "scope": "PROFILE",
      "description": "my legacy desc",
      "conditions": {
        "remoteIpsWhitelist": [
          "192.168.1.45",
          "10.0.0.10-10.0.0.20"
        ]
      }
    }
  }
}
200

OK

{
  "reply": "f87c6f24205249d896677ab63626d4f4"
}

Delete Legacy Exception Rules

post

Deletes one or more legacy exception rules by their IDs.

Use fetch endpoint to retrieve the id values of the exceptions you want to delete.

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replyintegerOptional

The number of successfully deleted legacy exception rules.

Example: 1
post/public_api/v1/legacy_exceptions/delete
POST /public_api/v1/legacy_exceptions/delete HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 71

{
  "request_data": {
    "exception_ids": [
      "f87c6f24205249d896677ab63626d4f4"
    ]
  }
}
200

OK

{
  "reply": 1
}

Get Disable Injection and Prevention rules

post

Retrieves a paginated list of Disable Injection and Prevention rules based on optional filters and sorting criteria.

This endpoint allows you to:

  • Retrieve all rules or filter by specific criteria

  • Sort results by any field in ascending or descending order

  • Paginate through large result sets

  • Get total count and filtered count of rules

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

Successful response

application/json
post/public_api/v1/disable_injection_prevention_rules/fetch
POST /public_api/v1/disable_injection_prevention_rules/fetch HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 156

{
  "request_data": {
    "search_from": 0,
    "search_to": 1,
    "sort": {
      "field": "rule_id",
      "keyword": "desc"
    },
    "filters": [
      {
        "field": "status",
        "operator": "eq",
        "value": "active"
      }
    ]
  }
}
{
  "reply": {
    "data": [
      {
        "rule_id": "24bd70bab9d94905aa18773de2555969",
        "rule_name": "Protect Critical App",
        "description": "Disable injection prevention for critical business application",
        "platform": "windows",
        "status": "active",
        "expiration_time": 1770445053461,
        "process_name": "criticalApp.exe",
        "path": "string",
        "created_by": "John Doe",
        "creation_time": 1770358653000,
        "is_global": false,
        "profile_ids": [
          96
        ]
      }
    ],
    "filter_count": 1,
    "total_count": 6
  }
}

Add Disable Injection and Prevention rule

post

Creates a new Disable Injection and Prevention rule to allow specific processes to bypass injection prevention.

This endpoint allows you to:

  • Define a new rule with a unique name and description

  • Specify the target platform (Windows, Linux, or macOS)

  • Set the process name and path to be protected

  • Configure expiration time

  • Apply the rule globally or to specific profiles

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replystringOptional

Returns the Disable Injection and Prevention Rule ID.

Example: e35dcf2150b74d19ba354fbe871f978d
post/public_api/v1/disable_injection_prevention_rules/add
POST /public_api/v1/disable_injection_prevention_rules/add HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 312

{
  "request_data": {
    "rule_name": "Global Windows Exception",
    "description": "Allow injection for trusted Windows application across all endpoints",
    "platform": "windows",
    "process_name": "trustedapp.exe",
    "path": "C:\\Program Files\\TrustedApp\\trustedapp.exe",
    "hours_to_expiration": 24,
    "profile_ids": [
      96
    ],
    "scope": "profile"
  }
}
{
  "reply": "e35dcf2150b74d19ba354fbe871f978d"
}

Disable Disable Injection and Prevention Rules

post

Disables one or more existing Disable Injection and Prevention rules by their IDs.

This endpoint allows you to:

  • Disable multiple rules in a single request

  • Immediately stop rules from being applied

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replystringOptional

Describes the success message.

Example: The selected rules were disabled
post/public_api/v1/disable_injection_prevention_rules/disable
POST /public_api/v1/disable_injection_prevention_rules/disable HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 66

{
  "request_data": {
    "rule_ids": [
      "24bd70bab9d94905aa18773de2555969"
    ]
  }
}
{
  "reply": "The selected rules were disabled"
}

Get Disable Prevention Rules

post

Returns a list of Disable Prevention rules based on filters, sorting, and pagination.

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
post/public_api/v1/disable_prevention/fetch
POST /public_api/v1/disable_prevention/fetch HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 184

{
  "request_data": {
    "search_from": 0,
    "search_to": 100,
    "sort": {
      "field": "rule_id",
      "keyword": "asc"
    },
    "filters": [
      {
        "field": "rule_id",
        "operator": "eq",
        "value": "1bce99ee792e4f0682d7c9bde0aaf44e"
      }
    ]
  }
}
200

OK

{
  "reply": {
    "data": [
      {
        "rule_id": "1bce99ee792e4f0682d7c9bde0aaf44e",
        "rule_name": "DPR",
        "description": "Prevention rules using API",
        "platform": "linux",
        "conditions": {
          "hash": "3b7d28f7a6c1e9b0f4a5c2d9e8f1a0b6c7d4e5f8091a2b3c4d5e6f7a8b9c0d1 ",
          "path": "/*",
          "signer": "trusted company.inc",
          "command": "command line argument",
          "sign_thumbprint": "certificate thumbprint"
        },
        "module_ids": [
          56
        ],
        "profile_ids": [
          96
        ],
        "scope": "profile",
        "status": "enabled",
        "created_by": "Jane Doe",
        "user_email": "jane.doe@example.com",
        "modification_time": 1764475578200,
        "associated_targets": [
          "endpoint != AFDSFDS"
        ]
      }
    ],
    "filter_count": 1,
    "total_count": 4
  }
}

Get Disable Prevention Modules

post

Returns a list of available modules for a specific platform.

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
post/public_api/v1/disable_prevention/get_modules
POST /public_api/v1/disable_prevention/get_modules HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 39

{
  "request_data": {
    "platform": "windows"
  }
}
200

OK

{
  "reply": [
    {
      "module_id": 1,
      "name": "DLL Security",
      "description": "Memory Corruption Exploit",
      "profile_type": "Exploit",
      "conditions_definition": {
        "properties": {
          "hash": {
            "type": "string",
            "description": "Hash"
          },
          "path": {
            "type": "string",
            "description": "Files / Folders",
            "minLength": 1
          },
          "command": {
            "type": "string",
            "description": "Command Line",
            "minLength": 1
          },
          "signer": {
            "type": "string",
            "description": "Signer Name",
            "minLength": 1
          },
          "sign_thumbprint": {
            "type": "string",
            "description": "Certificate Thumbprint",
            "minLength": 1
          }
        }
      },
      "additionalProperties": false,
      "minProperties": 1
    }
  ]
}

Add Disable Prevention Rule

post

Creates a new Disable Prevention rule.

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replystringOptional

Returns the Disable Prevention Rule ID.

Example: 330fc8dec96a4810af886af328e73264
post/public_api/v1/disable_prevention/add
POST /public_api/v1/disable_prevention/add HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 356

{
  "request_data": {
    "rule_name": "My MacOS Rule",
    "description": "Data prevention rule for MacOS",
    "platform": "macos",
    "module_ids": [
      38
    ],
    "conditions": {
      "hash": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
      "path": "/usr/",
      "signer": "Trusted Company Inc.",
      "command": "command line argument"
    },
    "profile_ids": [
      96
    ],
    "status": "enabled",
    "scope": "profile"
  }
}
200

OK

{
  "reply": "330fc8dec96a4810af886af328e73264"
}

Edit Disable Prevention Rule

post

Updates an existing Disable Prevention rule.

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replystringOptional

Returns the Disable Prevention Rule ID.

Example: 330fc8dec96a4810af886af328e73264
post/public_api/v1/disable_prevention/edit
POST /public_api/v1/disable_prevention/edit HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 401

{
  "request_data": {
    "rule_name": "My MacOS Rule",
    "description": "Data prevention rule for MacOS",
    "platform": "macos",
    "module_ids": [
      38
    ],
    "conditions": {
      "hash": "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824",
      "path": "/usr/",
      "signer": "Trusted Company Inc.",
      "command": "command line argument"
    },
    "profile_ids": [
      96
    ],
    "status": "enabled",
    "scope": "profile",
    "rule_id": "5bfb2a15ca2a4525a4e69f11792dfe61"
  }
}
200

OK

{
  "reply": "330fc8dec96a4810af886af328e73264"
}

Delete Disable Prevention Rules

post

Deletes one or more Disable Prevention rules based on the provided rule ID.

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

OK

application/json
replystringOptional

Describes the result of the API operation.

Example: 1 rule was deleted.
post/public_api/v1/disable_prevention/delete
POST /public_api/v1/disable_prevention/delete HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP 
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 66

{
  "request_data": {
    "rule_ids": [
      "00e2308ad4a54fca8b478766ee9de57e"
    ]
  }
}
200

OK

{
  "reply": "1 rule was deleted."
}

Get Distribution version

post

Get a list of all the agent versions to use for creating a distribution list.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
objectOptional
Responses
200

Successful response

application/json
post/public_api/v1/distributions/get_versions
POST /public_api/v1/distributions/get_versions HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 2

{}
{
  "reply": {
    "windows": [
      "text"
    ],
    "linux": [
      "text"
    ],
    "macos": [
      "text"
    ]
  }
}

Create distributions

post

Create an installation package. This is an async call that returns the distribution ID; it does not mean that the creation succeeded. To confirm the package has been created, check the status of the distribution by running the Get Distribution Status API.

Required license:

Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

Successful response

application/json
post/public_api/v1/distributions/create
POST /public_api/v1/distributions/create HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 138

{
  "request_data": {
    "name": "<installation package name>",
    "platform": "windows",
    "package_type": "standalone",
    "agent_version": "windows_version"
  }
}
{
  "reply": {
    "distribution_id": "text"
  }
}

Get Distribution status

post

Check the status of the installation package.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/distributions/get_status
POST /public_api/v1/distributions/get_status HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 43

{
  "request_data": {
    "distribution_id": "text"
  }
}
{
  "reply": {
    "status": "text"
  }
}

Get Distribution URL

post

Get the distribution URL for downloading the installation package.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/distributions/get_dist_url
POST /public_api/v1/distributions/get_dist_url HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 77

{
  "request_data": {
    "distribution_id": "<distribution ID>",
    "package_type": "x86"
  }
}
{
  "reply": {
    "distribution_url": "<DOWNLOAD_URL>"
  }
}

Get Distributions

post

Retrieves a paginated list of existing agent installations and metadata based on optional filters and sorting criteria.

This endpoint allows you to:

  • Retrieve existing agent installations or filter by specific criteria

  • Paginate through large result sets

  • Sort results by any field in ascending or descending order

  • Get total count and filtered count of agent installations

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

Example: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-idstringRequired

{api_key_id}

Example: 241
Body
Responses
200

Successful response containing the list of distributions matching the criteria

application/json

Response object containing the list of distributions and metadata

post/public_api/v1/distributions/get_distributions
POST /public_api/v1/distributions/get_distributions HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 626

{
  "request_data": {
    "search_from": 0,
    "search_to": 5,
    "sort": {
      "field": "distribution_id",
      "keyword": "asc"
    },
    "filters": [
      {
        "field": "distribution_id",
        "operator": "eq",
        "value": "068bcaad02974ac5b223bfa786e7573c"
      },
      {
        "field": "name",
        "operator": "contains",
        "value": "macos-369121"
      },
      {
        "field": "description",
        "operator": "contains",
        "value": "Production-ready macos agent installer with enhanced monitoring capabilities"
      },
      {
        "field": "package_type",
        "operator": "eq",
        "value": "standalone"
      },
      {
        "field": "platform",
        "operator": "eq",
        "value": "macos"
      },
      {
        "field": "agent_version",
        "operator": "contains",
        "value": "9.1."
      },
      {
        "field": "status",
        "operator": "eq",
        "value": "completed"
      }
    ]
  }
}
{
  "reply": {
    "data": [
      {
        "distribution_id": "068bcaad02974ac5b223bfa786e7573c",
        "name": "macos-369121",
        "description": "Production-ready macos agent installer with enhanced monitoring capabilities",
        "package_type": "standalone",
        "platform": "macos",
        "agent_version": "9.1.0.9877",
        "status": "completed",
        "tags": [
          "production",
          "stable"
        ],
        "eol_time": 1735689600,
        "created_by": "John Doe",
        "creation_time": 1704067200,
        "modification_time": 1704153600,
        "supported_packages": [
          "pkg"
        ]
      }
    ],
    "filter_count": 1,
    "total_count": 10
  }
}

Delete agent installation packages

post

Delete an agent installation package. The distribution ID is required and can be found in the Create distributions API response or in the Agent Installations screen in the Cortex Console.

Note: Once you delete an installation package, it prevents new agents using the package, including VDI, from registering.

Required license:

Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

OK

application/json
replybooleanOptional

Whether the deletion was successful.

post/public_api/v1/distributions/delete
POST /public_api/v1/distributions/delete HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 71

{
  "request_data": {
    "distribution_id": "36ffe3f7ab7c4e7188e27d633ea72c3d"
  }
}
200

OK

{
  "reply": true
}

Get Violations

post

Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.

When filtering by multiple fields:

  • Response is concatenated using AND condition (OR is not supported).

  • Maximum result set size is 100.

  • Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/device_control/get_violations
POST /public_api/v1/device_control/get_violations HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "request_data": {}
}
{
  "reply": {
    "total_count": 1,
    "result_count": 1,
    "violations": [
      {
        "hostname": "text",
        "username": "text",
        "ip": "text",
        "timestamp": 1,
        "violation_id": 1,
        "type": "text",
        "vendor_id": "text",
        "vendor": "text",
        "product_id": "text",
        "product": "text",
        "serial": "text",
        "endpoint_id": "text"
      }
    ]
  }
}

Assign Tags

post

Assign one or more tags to one or more endpoints.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
booleanOptional

true=The tag name was assigned successfully.

post/public_api/v1/tags/agents/assign
POST /public_api/v1/tags/agents/assign HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 124

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<distribution_id>"
        ]
      }
    ],
    "tag": "<tag_name>"
  }
}
true

Create Tag

post

Create a new agent tag in the endpoint_tags family.

The tag name must be a string of no more than 64 characters and must not contain wildcard characters (for example, *). If a tag with the same name already exists, the request fails with a 409 error.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
stringOptional

Confirmation message, for example: "Successfully created a new tag - my-tag".

post/public_api/v1/tags/agents/create
POST /public_api/v1/tags/agents/create HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 33

{
  "request_data": {
    "tag": "my-tag"
  }
}
text

Remove Tags

post

Remove one or more tags from one or more endpoints.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
booleanOptional

true=tag name removed successfully.

post/public_api/v1/tags/agents/remove
POST /public_api/v1/tags/agents/remove HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 124

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<distribution_id>"
        ]
      }
    ],
    "tag": "<tag_name>"
  }
}
true

Add Prevention Profile

post

Create a new prevention profile with specified configuration.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
namestring · min: 1 · max: 600Required

Name of the profile.

profile_typestringRequired

Type of the prevention profile.

platformstringRequired

Platform (OS) for the profile.

descriptionstring · nullableOptional

Optional description of the profile.

Responses
200

Successful response

application/json
replyintegerOptional

The ID of the newly created profile.

post/public_api/v1/profiles/prevention/add
POST /public_api/v1/profiles/prevention/add HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 245

{
  "name": "Windows_Malware_Prevention",
  "profile_type": "malware",
  "platform": "windows",
  "description": "Standard prevention profile for Windows endpoints",
  "modules": {
    "wildfire": {
      "status": "enabled"
    },
    "behavioral_threat_protection": {
      "status": "enabled"
    }
  }
}
{
  "reply": 12345
}

Add Signer CN to Allowlist

post

Add one or more signer common names to the allowlist of a specific Windows malware prevention profile. This endpoint only works on Windows Malware profiles.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
profile_namestring · max: 600Required

The name of the Windows malware prevention profile. Cannot be 'Default'.

signersone ofRequired

A single signer CN string or a list of signer CN strings to add. Total signers cap is 1000.

string · max: 600Optional
or
string[] · max: 1000Optional
Responses
200

Successful response

application/json
replyobject · nullableOptional
post/public_api/v1/profiles/add_signer_cn_to_allowlist
POST /public_api/v1/profiles/add_signer_cn_to_allowlist HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 221

{
  "profile_name": "Windows_Malware_Prevention",
  "signers": [
    "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US",
    "CN=Palo Alto Networks, O=Palo Alto Networks, L=Santa Clara, S=California, C=US"
  ]
}
{
  "reply": null
}

Edit Prevention Profile

post

Update an existing prevention profile with new configuration. At least one field in update_data (name, description, or modules) must be provided.

Note: Default profiles cannot be edited.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
profile_idintegerRequired

The ID of the profile to edit.

Responses
200

Successful response

application/json
replybooleanOptional

True if the profile was successfully updated.

post/public_api/v1/profiles/prevention/edit
POST /public_api/v1/profiles/prevention/edit HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 132

{
  "profile_id": 12345,
  "update_data": {
    "description": "Updated description for the profile",
    "modules": {
      "wildfire": {
        "status": "enabled"
      }
    }
  }
}
{
  "reply": true
}

Get Prevention Profile Modules

post

Get a list of modules for a specific prevention profile type and platform.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
profile_typestringRequired

The type of prevention profile.

platformstringRequired

The platform (OS) for the profile.

Responses
200

Successful response

application/json
replyobject[]Optional

Module definition object.

post/public_api/v1/profiles/prevention/get_modules
POST /public_api/v1/profiles/prevention/get_modules HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 47

{
  "profile_type": "malware",
  "platform": "windows"
}
{
  "reply": [
    {
      "id": "additionalProcesses",
      "profile_type": "Exploit",
      "platform": "macOS",
      "pretty_name": "Exploit Protection for Additional Processes",
      "schema": {
        "type": "object",
        "properties": {
          "mode": {
            "type": "string",
            "enum": [
              "block",
              "report",
              "disabled"
            ],
            "description": "Action Mode"
          },
          "processes": {
            "type": "array",
            "items": {
              "type": "string",
              "description": "Path Array"
            }
          }
        },
        "required": [
          "mode",
          "processes"
        ],
        "additionalProperties": false
      }
    }
  ]
}

Delete Tags Permanently

post

Permanently delete one or more endpoint tags from the system. Tags that are currently assigned to endpoints cannot be deleted. A maximum of 10 tags can be deleted per API call.

Required role: Admin

Required license: Cortex XDR.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

Successful response — tags were permanently deleted from the system.

application/json
post/public_api/v1/tags/agents/delete_permanently
POST /public_api/v1/tags/agents/delete_permanently HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 123

{
  "request_data": {
    "tags": [
      "tag1",
      "tag2"
    ],
    "reason": "These tags are no longer needed and should be removed from the system."
  }
}
{
  "reply": {
    "message": "Tags were successfully deleted from the system"
  }
}
PreviousDataset Management
NextIncident Management

Last updated

Was this helpful?