> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/models.md).

# Models

## The event object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"event":{"title":"event","type":"object","properties":{"agent_install_type":{"type":"string"},"agent_host_boot_time":{"type":"integer"},"event_sub_type":{"type":"string"},"module_id":{"type":"string"},"association_strength":{"type":"string"},"dst_association_strength":{"type":"string"},"story_id":{"type":"string"},"event_id":{"type":"string"},"event_type":{"type":"string"},"event_timestamp":{"type":"integer"},"actor_process_instance_id":{"type":"string"},"actor_process_image_path":{"type":"string"},"actor_process_image_name":{"type":"string"},"actor_process_command_line":{"type":"string"},"actor_process_signature_status":{"type":"string"},"actor_process_signature_vendor":{"type":"string"},"actor_process_image_sha256":{"type":"string"},"actor_process_image_md5":{"type":"string"},"actor_process_causality_id":{"type":"string"},"actor_causality_id":{"type":"string"},"actor_process_os_pid":{"type":"string"},"actor_thread_thread_id":{"type":"string"},"causality_actor_process_image_name":{"type":"string"},"causality_actor_process_command_line":{"type":"string"},"causality_actor_process_image_path":{"type":"string"},"causality_actor_process_signature_vendor":{"type":"string"},"causality_actor_process_signature_status":{"type":"string"},"causality_actor_causality_id":{"type":"string"},"causality_actor_process_execution_time":{"type":"integer"},"causality_actor_process_image_md5":{"type":"string"},"causality_actor_process_image_sha256":{"type":"string"},"action_file_path":{"type":"string"},"action_file_name":{"type":"string"},"action_file_md5":{"type":"string"},"action_file_sha256":{"type":"string"},"action_file_macro_sha256":{"type":"string"},"action_registry_data":{"type":"string"},"action_registry_key_name":{"type":"string"},"action_registry_value_name":{"type":"string"},"action_registry_full_key":{"type":"string"},"action_local_ip":{"type":"string"},"action_local_port":{"type":"string"},"action_remote_ip":{"type":"string"},"action_remote_port":{"type":"string"},"action_external_hostname":{"type":"string"},"action_country":{"type":"string"},"action_process_instance_id":{"type":"string"},"action_process_causality_id":{"type":"string"},"action_process_image_name":{"type":"string"},"action_process_image_sha256":{"type":"string"},"action_process_image_command_line":{"type":"string"},"action_process_signature_status":{"type":"string"},"action_process_signature_vendor":{"type":"string"},"os_actor_effective_username":{"type":"string"},"os_actor_process_instance_id":{"type":"string"},"os_actor_process_image_path":{"type":"string"},"os_actor_process_image_name":{"type":"string"},"os_actor_process_command_line":{"type":"string"},"os_actor_process_signature_status":{"type":"string"},"os_actor_process_signature_vendor":{"type":"string"},"os_actor_process_image_sha256":{"type":"string"},"os_actor_process_causality_id":{"type":"string"},"os_actor_causality_id":{"type":"string"},"os_actor_process_os_pid":{"type":"string"},"os_actor_thread_thread_id":{"type":"string"},"fw_app_id":{"type":"string"},"fw_interface_from":{"type":"string"},"fw_interface_to":{"type":"string"},"fw_rule":{"type":"string"},"fw_rule_id":{"type":"string"},"fw_device_name":{"type":"string"},"fw_serial_number":{"type":"integer"},"fw_url_domain":{"type":"string"},"fw_email_subject":{"type":"string"},"fw_email_sender":{"type":"string"},"fw_email_recipient":{"type":"string"},"fw_app_subcategory":{"type":"string"},"fw_app_category":{"type":"string"},"fw_app_technology":{"type":"string"},"fw_vsys":{"type":"string"},"fw_xff":{"type":"string"},"fw_misc":{"type":"string"},"fw_is_phishing":{"type":"string"},"dst_agent_id":{"type":"string"},"dst_causality_actor_process_execution_time":{"type":"integer"},"dns_query_name":{"type":"string"},"dst_action_external_hostname":{"type":"string"},"dst_action_country":{"type":"string"},"dst_action_external_port":{"type":"string"},"user_name":{"type":"string"}}}}}}
```

## The alert object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"alert":{"title":"alert","type":"object","properties":{"external_id":{"type":"string"},"severity":{"type":"string"},"matching_status":{"type":"string"},"end_match_attempt_ts":{"type":"integer"},"local_insert_ts":{"type":"integer"},"bioc_indicator":{"type":"string"},"matching_service_rule_id":{"type":"string"},"attempt_counter":{"type":"integer"},"bioc_category_enum_key":{"type":"string"},"is_whitelisted":{"type":"boolean"},"starred":{"type":"boolean"},"deduplicate_tokens":{"type":"string"},"filter_rule_id":{"type":"string"},"mitre_technique_id_and_name":{"type":"array","items":{"type":"string"}},"mitre_tactic_id_and_name":{"type":"array","items":{"type":"string"}},"agent_version":{"type":"string"},"agent_device_domain":{"type":"string"},"agent_fqdn":{"type":"string"},"agent_os_type":{"type":"string"},"agent_os_sub_type":{"type":"string"},"agent_data_collection_status":{"type":"boolean"},"mac":{"type":"string"},"mac_address":{"type":"array","items":{"type":"string"}},"agent_is_vdi":{"type":"boolean"},"contains_featured_host":{"type":"string","enum":["YES","NO"]},"contains_featured_user":{"type":"string","enum":["YES","NO"]},"contains_featured_ip":{"type":"string","enum":["YES","NO"]},"events":{"type":"array","items":{"$ref":"#/components/schemas/event"}},"alert_id":{"type":"string"},"detection_timestamp":{"type":"integer"},"name":{"type":"string"},"category":{"type":"string"},"endpoint_id":{"type":"string"},"description":{"type":"string"},"host_ip":{"type":"array","items":{"type":"string"}},"host_name":{"type":"string"},"source":{"type":"string"},"action":{"type":"string"},"action_pretty":{"type":"string"}}},"event":{"title":"event","type":"object","properties":{"agent_install_type":{"type":"string"},"agent_host_boot_time":{"type":"integer"},"event_sub_type":{"type":"string"},"module_id":{"type":"string"},"association_strength":{"type":"string"},"dst_association_strength":{"type":"string"},"story_id":{"type":"string"},"event_id":{"type":"string"},"event_type":{"type":"string"},"event_timestamp":{"type":"integer"},"actor_process_instance_id":{"type":"string"},"actor_process_image_path":{"type":"string"},"actor_process_image_name":{"type":"string"},"actor_process_command_line":{"type":"string"},"actor_process_signature_status":{"type":"string"},"actor_process_signature_vendor":{"type":"string"},"actor_process_image_sha256":{"type":"string"},"actor_process_image_md5":{"type":"string"},"actor_process_causality_id":{"type":"string"},"actor_causality_id":{"type":"string"},"actor_process_os_pid":{"type":"string"},"actor_thread_thread_id":{"type":"string"},"causality_actor_process_image_name":{"type":"string"},"causality_actor_process_command_line":{"type":"string"},"causality_actor_process_image_path":{"type":"string"},"causality_actor_process_signature_vendor":{"type":"string"},"causality_actor_process_signature_status":{"type":"string"},"causality_actor_causality_id":{"type":"string"},"causality_actor_process_execution_time":{"type":"integer"},"causality_actor_process_image_md5":{"type":"string"},"causality_actor_process_image_sha256":{"type":"string"},"action_file_path":{"type":"string"},"action_file_name":{"type":"string"},"action_file_md5":{"type":"string"},"action_file_sha256":{"type":"string"},"action_file_macro_sha256":{"type":"string"},"action_registry_data":{"type":"string"},"action_registry_key_name":{"type":"string"},"action_registry_value_name":{"type":"string"},"action_registry_full_key":{"type":"string"},"action_local_ip":{"type":"string"},"action_local_port":{"type":"string"},"action_remote_ip":{"type":"string"},"action_remote_port":{"type":"string"},"action_external_hostname":{"type":"string"},"action_country":{"type":"string"},"action_process_instance_id":{"type":"string"},"action_process_causality_id":{"type":"string"},"action_process_image_name":{"type":"string"},"action_process_image_sha256":{"type":"string"},"action_process_image_command_line":{"type":"string"},"action_process_signature_status":{"type":"string"},"action_process_signature_vendor":{"type":"string"},"os_actor_effective_username":{"type":"string"},"os_actor_process_instance_id":{"type":"string"},"os_actor_process_image_path":{"type":"string"},"os_actor_process_image_name":{"type":"string"},"os_actor_process_command_line":{"type":"string"},"os_actor_process_signature_status":{"type":"string"},"os_actor_process_signature_vendor":{"type":"string"},"os_actor_process_image_sha256":{"type":"string"},"os_actor_process_causality_id":{"type":"string"},"os_actor_causality_id":{"type":"string"},"os_actor_process_os_pid":{"type":"string"},"os_actor_thread_thread_id":{"type":"string"},"fw_app_id":{"type":"string"},"fw_interface_from":{"type":"string"},"fw_interface_to":{"type":"string"},"fw_rule":{"type":"string"},"fw_rule_id":{"type":"string"},"fw_device_name":{"type":"string"},"fw_serial_number":{"type":"integer"},"fw_url_domain":{"type":"string"},"fw_email_subject":{"type":"string"},"fw_email_sender":{"type":"string"},"fw_email_recipient":{"type":"string"},"fw_app_subcategory":{"type":"string"},"fw_app_category":{"type":"string"},"fw_app_technology":{"type":"string"},"fw_vsys":{"type":"string"},"fw_xff":{"type":"string"},"fw_misc":{"type":"string"},"fw_is_phishing":{"type":"string"},"dst_agent_id":{"type":"string"},"dst_causality_actor_process_execution_time":{"type":"integer"},"dns_query_name":{"type":"string"},"dst_action_external_hostname":{"type":"string"},"dst_action_country":{"type":"string"},"dst_action_external_port":{"type":"string"},"user_name":{"type":"string"}}}}}}
```

## The reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## The violation object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"violation":{"title":"violation","type":"object","properties":{"hostname":{"type":"string"},"username":{"type":"string"},"ip":{"type":"string"},"timestamp":{"type":"integer"},"violation_id":{"type":"integer"},"type":{"type":"string"},"vendor_id":{"type":"string"},"vendor":{"type":"string"},"product_id":{"type":"string"},"product":{"type":"string"},"serial":{"type":"string"},"endpoint_id":{"type":"string"}}}}}}
```

## The GetProfilesRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetProfilesRequestData":{"title":"GetProfilesRequestData","type":"object","description":"Parameters for the `get_profiles` call","required":["type"],"properties":{"type":{"type":"string","enum":["prevention","extension"],"description":"The category of profiles to retrieve.\n- `prevention` – standard endpoint prevention profiles managed by\n  `ProfilesService` (malware, exploit, restrictions, agent-settings,\n  exceptions, etc.)\n- `extension` – device-control and host-firewall profiles managed by\n  `DeviceControlProfilesService`\n"},"profile_ids":{"type":"array","description":"Optional list of profile IDs to filter by.\nWhen omitted or `null`, all profiles of the requested type are returned.\nWhen provided, only profiles whose `id` is in this list are returned.\nMust be a JSON array; passing a non-array value yields HTTP 400.\n","items":{"type":"integer","format":"int64","nullable":true}}}}}}}
```

## The GetProfilesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetProfilesResponse":{"title":"GetProfilesResponse","type":"object","description":"Successful response envelope","properties":{"reply":{"type":"array","description":"List of matching profile objects.","items":{"$ref":"#/components/schemas/ProfileObject"}}}},"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}}}}}
```

## The ProfileObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}}}}}
```

## The GetLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetLegacyExceptionDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters for fetching legacy exception rules.","required":["request_data"],"properties":{"request_data":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results.","default":0,"minimum":0},"search_to":{"type":"integer","description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from).","minimum":1,"default":100},"sort":{"type":"object","description":"Defines sorting criteria for query results.","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Field name to sort by. For example, `id`, `rule_name`, `platform`, `modification_time`, `status`, and `user_email`."},"keyword":{"type":"string","description":"Determines the sort order.","enum":["asc","desc"]}}},"filters":{"type":"array","description":"List of filter conditions. Multiple filters are combined with AND logic.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The field name to filter on. For example, `id`, `rule_name`, `platform`, `status`, `created_by`, `user_email`, `module` and `profile_ids`."},"operator":{"type":"string","description":"The comparison operator. Most fields support `eq` operator. The `module` and `profile_ids` fields support `in` operator."},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `ENABLED` or `DISABLED`\n* If the `field` is `platform`, the `value` can be a string such as `Windows`, `macOS`, or `Linux`","oneOf":[{"type":"string"},{"type":"integer"}]}}}}}}}}}}}
```

## The AddLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"AddLegacyExceptionDataRequest":{"type":"object","description":"Request body for creating a legacy exception rule.","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule.","minLength":1,"maxLength":128},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint.","minimum":1},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [/public_api/v1/endpoints/get_profiles](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule.","nullable":true},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}
```

## The EditLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"EditLegacyExceptionDataRequest":{"type":"object","description":"Request body for editing or updating an existing legacy exception rule.","required":["exception_id","update_data"],"properties":{"exception_id":{"type":"string","description":"The ID of the legacy exception to edit. Corresponds to the `id` field returned by the fetch API."},"update_data":{"type":"object","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [/public_api/v1/endpoints/get_profiles](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule."},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [/public_api/v1/legacy_exceptions/get_modules](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}}}
```

## The GetPublicLegacyExceptionResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetPublicLegacyExceptionResponse":{"type":"object","title":"Get Legacy Exception Response","description":"A legacy exception record as returned by the fetch API.","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the legacy exception rule."},"rule_name":{"type":"string","description":"Name of the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception rule."},"conditions":{"type":"string","description":"Human-readable string representation of the exception conditions. This is a display string only."},"module":{"type":"integer","description":"Numeric ID of the protection module this exception applies to."},"module_name":{"type":"string","description":"Name of the protection module."},"description":{"type":"string","description":"Optional description of the exception rule."},"generating_alert_id":{"description":"ID of the alert that generated this exception, if applicable.","nullable":true},"created_by":{"type":"string","description":"Name of the user or API key that created the legacy exception rule. **Note**: API-created exception rules show as \"Public API - <key_id>\"."},"modification_time":{"type":"integer","description":"Unix timestamp in milliseconds of the last modification."},"user_email":{"type":"string","description":"Email of the user who created the exception. **Note**: API-created exceptions show `n/a`."},"status":{"type":"string","description":"Indicates the current status of the rule."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception is scoped to. Empty array `[]` indicates a GLOBAL scope exception.","items":{"type":"integer"}},"associated_targets":{"type":"array","description":"Describes the endpoint targeting scope of the exception.","items":{"type":"string"}},"is_in_user_scope":{"type":"boolean","description":"Whether the exception is within the current user's RBAC scope."}}}},"FILTER_COUNT":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"TOTAL_COUNT":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}}}}}
```

## The GetInjectionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetInjectionDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","minimum":0,"default":0,"description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results."},"search_to":{"type":"integer","minimum":1,"default":100,"description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from)."},"sort":{"$ref":"#/components/schemas/SortingInjectionRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterInjectionRequest"}}}},"SortingInjectionRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}},"description":"Defines sorting criteria for query results."},"FilterInjectionRequest":{"type":"object","description":"Define filter condition for querying data.","required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering. For example, (`eq` (equals), `neq` (not equals), `gte` (greater than or equal), `lte` (less than or equal), `contains` or `not_contains`)","default":"eq"},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `active`, `disabled`, or `expired`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`                \n"}}}}}}
```

## The SortingInjectionRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"SortingInjectionRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}},"description":"Defines sorting criteria for query results."}}}}
```

## The FilterInjectionRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"FilterInjectionRequest":{"type":"object","description":"Define filter condition for querying data.","required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. For example, `rule_id`, `rule_name`, `status`,`platform`."},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering. For example, (`eq` (equals), `neq` (not equals), `gte` (greater than or equal), `lte` (less than or equal), `contains` or `not_contains`)","default":"eq"},"value":{"type":"string","description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `active`, `disabled`, or `expired`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`                \n"}}}}}}
```

## The PublicGetInjectionDataResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"PublicGetInjectionDataResponse":{"type":"object","properties":{"reply":{"type":"object","description":"Container object for the response data and metadata","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisableInjectionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisableInjectionRulePAPIObject":{"type":"object","description":"Array of Disable Injection and Prevention rule objects matching the query criteria.","properties":{"rule_id":{"type":"string","description":"Unique identifier for the rule. Auto-generated upon rule creation and used for all subsequent operations."},"rule_name":{"type":"string","description":"Name of the rule."},"description":{"type":"string","description":"Description of the rule's purpose and context. "},"platform":{"type":"string","description":"Target operating system to which the rule applies. For example: `windows`, `linux`, or `macos`."},"status":{"type":"string","description":"Current status of the rule. For example: `active`, `disabled`, or `expired`.\n- `active`: Rule is active and being applied\n- `disabled`: Rule is inactive and not being applied\n- `expired`: Rule has passed its expiration time"},"expiration_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule will expire."},"process_name":{"type":"string","description":"Name of the process executable to which this rule applies. Should match the exact process name as it appears in the system."},"path":{"type":"string","description":"Full file system path to the process executable. "},"created_by":{"type":"string","description":"Name of the user or API key ID that created this rule."},"creation_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule was created."},"is_global":{"type":"boolean","description":"Indicates whether the rule applies globally to all endpoints or only to specific profiles.\n- `true`: Rule applies to all endpoints in the tenant.\n- `false`: Rule applies only to endpoints in the specified `profile_ids`.","default":false},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule applies. Only relevant when is_global is false. \n`null` or empty when `is_global` is `true`.","nullable":true,"items":{"type":"integer"}}}}}}}
```

## The InjectionResponseString object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"InjectionResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Injection and Prevention Rule ID."}}}}}}
```

## The DisableInjectionResponseString object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisableInjectionResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the success message."}}}}}}
```

## The DisableInjectionRulePAPIObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisableInjectionRulePAPIObject":{"type":"object","description":"Array of Disable Injection and Prevention rule objects matching the query criteria.","properties":{"rule_id":{"type":"string","description":"Unique identifier for the rule. Auto-generated upon rule creation and used for all subsequent operations."},"rule_name":{"type":"string","description":"Name of the rule."},"description":{"type":"string","description":"Description of the rule's purpose and context. "},"platform":{"type":"string","description":"Target operating system to which the rule applies. For example: `windows`, `linux`, or `macos`."},"status":{"type":"string","description":"Current status of the rule. For example: `active`, `disabled`, or `expired`.\n- `active`: Rule is active and being applied\n- `disabled`: Rule is inactive and not being applied\n- `expired`: Rule has passed its expiration time"},"expiration_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule will expire."},"process_name":{"type":"string","description":"Name of the process executable to which this rule applies. Should match the exact process name as it appears in the system."},"path":{"type":"string","description":"Full file system path to the process executable. "},"created_by":{"type":"string","description":"Name of the user or API key ID that created this rule."},"creation_time":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the rule was created."},"is_global":{"type":"boolean","description":"Indicates whether the rule applies globally to all endpoints or only to specific profiles.\n- `true`: Rule applies to all endpoints in the tenant.\n- `false`: Rule applies only to endpoints in the specified `profile_ids`.","default":false},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule applies. Only relevant when is_global is false. \n`null` or empty when `is_global` is `true`.","nullable":true,"items":{"type":"integer"}}}}}}}
```

## The DisableInjectionAddRulePAPIRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisableInjectionAddRulePAPIRequest":{"type":"object","description":"Request schema for creating a new Disable Injection and Prevention rule. All required fields must be provided to successfully create a rule.","required":["rule_name","description","platform","process_name","path","hours_to_expiration","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":100,"description":"Unique name for the new rule. Must be between 1-100 characters and should be descriptive of the rule's purpose."},"description":{"type":"string","maxLength":500,"description":"Description explaining the purpose and context of this rule. Maximum 500 characters."},"platform":{"type":"string","enum":["windows","linux","macos"],"description":"Target operating system to which the rule applies. "},"process_name":{"type":"string","minLength":1,"maxLength":100,"description":"Name of the process executable to protect. Must match the exact process name (1-100 characters)."},"path":{"type":"string","minLength":1,"maxLength":1000,"description":"Full file system path to the process executable. Must be a valid path for the specified platform (1-1000 characters)."},"hours_to_expiration":{"type":"integer","enum":[24,48],"description":"Number of hours until the rule expires. After expiration, the rule will no longer be applied. For example, 24 hours."},"profile_ids":{"type":"array","description":"Array of profile IDs to which this rule should apply. \nRequired when `scope` is `profile`. Must be `null` or omitted when scope is `global`.","nullable":true,"items":{"type":"integer","default":96}},"scope":{"type":"string","enum":["global","profile"],"description":"Defines the application scope of the rule.\n- `global`: Rule applies to all endpoints all matching endpoints (by platform and agent version >= 7.9)\n- `profile`: Rule applies only to endpoints in the specified `profile_ids`"}}}}}}
```

## The DisableInjectionDisableRulesPAPIRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisableInjectionDisableRulesPAPIRequest":{"type":"object","description":"Request schema for disabling one or more existing Disable Injection Prevention rules. Requires at least one valid rule ID.","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"Array of rule IDs to disable. Must contain at least one valid rule ID.","items":{"type":"string"}}}}}}}
```

## The GetDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetDataRequest":{"type":"object","properties":{"search_from":{"type":"integer","default":0,"description":"Zero-based index of the first Disable Prevention rule to return. Used for pagination.","minimum":0},"search_to":{"type":"integer","minimum":1,"maximum":100,"default":100,"description":"Index number of Disable Prevention rules to return starting from `search_from`."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}},"FilterRequest":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"operator":{"type":"string","description":"Comparison operator used for filtering. For example, (`eq`, `neq`, `gte`, `lte`, `contains` or `not_contains`)","default":"eq"},"value":{"type":"object","description":"The value to compare against the specified field. The expected data type and format depend on the field being filtered and the operator used.\n\n**Examples:**\n\n* If the `field` is `status`, the `value` can be `enabled` or `disabled`.\n* If the `field` is `modification_time`, the `value` should be a Unix timestamp in milliseconds (for example, **`1762870187000`**).\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`\n"}}}}}}
```

## The SortingRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"SortingRequest":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}}}}}
```

## The FilterRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"FilterRequest":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"Rule attribute to apply the filter on. For example: `rule_id`, `status`, `modification_time`, `platform`)."},"operator":{"type":"string","description":"Comparison operator used for filtering. For example, (`eq`, `neq`, `gte`, `lte`, `contains` or `not_contains`)","default":"eq"},"value":{"type":"object","description":"The value to compare against the specified field. The expected data type and format depend on the field being filtered and the operator used.\n\n**Examples:**\n\n* If the `field` is `status`, the `value` can be `enabled` or `disabled`.\n* If the `field` is `modification_time`, the `value` should be a Unix timestamp in milliseconds (for example, **`1762870187000`**).\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, or `linux`\n"}}}}}}
```

## The PublicGetDataResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"PublicGetDataResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionRulePAPIObject"}},"filter_count":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"total_count":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}},"DisablePreventionRulePAPIObject":{"type":"object","properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."},"rule_name":{"type":"string","description":"Name of the Disable Prevention rule."},"description":{"type":"string","description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"module_ids":{"type":"array","description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","items":{"type":"integer"}},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."},"status":{"type":"string","description":"Current state of the rule (for example, `enabled` or `disabled`)."},"created_by":{"type":"string","description":"Name of the user who created the rule."},"user_email":{"type":"string","description":"Email address of the user associated with the creation or last modification of the rule."},"modification_time":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified."},"associated_targets":{"type":"array","items":{"type":"string"}}}}}}}
```

## The BaseResponseString object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"BaseResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Returns the Disable Prevention Rule ID."}}}}}}
```

## The DeleteResponseString object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DeleteResponseString":{"type":"object","properties":{"reply":{"type":"string","description":"Describes the result of the API operation."}}}}}}
```

## The BaseResponseArrayModules object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"BaseResponseArrayModules":{"type":"object","properties":{"reply":{"type":"array","items":{"$ref":"#/components/schemas/DisablePreventionModulePAPIObject"}}}},"DisablePreventionModulePAPIObject":{"type":"object","properties":{"module_id":{"type":"integer","description":"Module ID associated with the rule."},"name":{"type":"string","description":"Name of the security module."},"description":{"type":"string","description":"Description of the disable prevention rule."},"profile_type":{"type":"string","description":"Type of security profile."},"conditions_definition":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"properties":{"type":"object","properties":{"hash":{"type":"object","description":"SHA256 hash","properties":{"type":{"type":"string"},"description":{"type":"string"}}},"path":{"type":"object","description":"Path to the required files or folders","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"command":{"type":"object","description":"Command line argument","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"signer":{"type":"object","description":"Trusted signer","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"sign_thumbprint":{"type":"object","description":"Certificate thumbprint","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}}}}}},"additionalProperties":{"type":"boolean"},"minProperties":{"type":"integer"}}}}}}
```

## The DisablePreventionRulePAPIObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisablePreventionRulePAPIObject":{"type":"object","properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."},"rule_name":{"type":"string","description":"Name of the Disable Prevention rule."},"description":{"type":"string","description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"module_ids":{"type":"array","description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","items":{"type":"integer"}},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."},"status":{"type":"string","description":"Current state of the rule (for example, `enabled` or `disabled`)."},"created_by":{"type":"string","description":"Name of the user who created the rule."},"user_email":{"type":"string","description":"Email address of the user associated with the creation or last modification of the rule."},"modification_time":{"type":"integer","format":"int64","description":"Timestamp when the rule was last modified."},"associated_targets":{"type":"array","items":{"type":"string"}}}}}}}
```

## The DisablePreventionGetModulesPAPIRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisablePreventionGetModulesPAPIRequest":{"type":"object","required":["platform"],"properties":{"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`."}}}}}}
```

## The DisablePreventionModulePAPIObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisablePreventionModulePAPIObject":{"type":"object","properties":{"module_id":{"type":"integer","description":"Module ID associated with the rule."},"name":{"type":"string","description":"Name of the security module."},"description":{"type":"string","description":"Description of the disable prevention rule."},"profile_type":{"type":"string","description":"Type of security profile."},"conditions_definition":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"properties":{"type":"object","properties":{"hash":{"type":"object","description":"SHA256 hash","properties":{"type":{"type":"string"},"description":{"type":"string"}}},"path":{"type":"object","description":"Path to the required files or folders","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"command":{"type":"object","description":"Command line argument","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"signer":{"type":"object","description":"Trusted signer","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}},"sign_thumbprint":{"type":"object","description":"Certificate thumbprint","properties":{"type":{"type":"string"},"description":{"type":"string"},"minLength":{"type":"integer"}}}}}}},"additionalProperties":{"type":"boolean"},"minProperties":{"type":"integer"}}}}}}
```

## The DisablePreventionAddRulePAPIRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisablePreventionAddRulePAPIRequest":{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}}}}}
```

## The DisablePreventionEditRulePAPIRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisablePreventionEditRulePAPIRequest":{"allOf":[{"$ref":"#/components/schemas/DisablePreventionModifyRulePAPIRequestBase"},{"type":"object","required":["rule_id"],"properties":{"rule_id":{"type":"string","description":"The unique identifier of the Disable Prevention rule."}}}]},"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}}}}}
```

## The DisablePreventionModifyRulePAPIRequestBase object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisablePreventionModifyRulePAPIRequestBase":{"type":"object","required":["rule_name","description","platform","module_ids","conditions","status","scope"],"properties":{"rule_name":{"type":"string","minLength":1,"maxLength":700,"description":"Name of the disable prevention rule."},"description":{"type":"string","minLength":1,"maxLength":1000,"description":"Description explaining the purpose and behavior of the rule."},"platform":{"type":"string","description":"Indicates the operating system to which the rule applies. For example, `windows`, `linux`, or `macos`"},"module_ids":{"type":"array","minLength":1,"description":"A list of module ids associated with the rule.","items":{"type":"integer"}},"conditions":{"type":"object","description":"A combination of parameters configured during rule creation.","properties":{"hash":{"type":"string","description":"SHA256 hash"},"path":{"type":"string","description":"Path to the required files or folders"},"signer":{"type":"string","description":"Trusted signer"},"command":{"type":"string","description":"Command line argument"},"sign_thumbprint":{"type":"string","description":"Certificate thumbprint"}}},"profile_ids":{"type":"array","description":"A list of profile ids to which the rule is applied.","nullable":true,"items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule (for example, `enabled` or `disabled`)."},"scope":{"type":"string","description":"Specifies the scope of the rule, such as `global` (All endpoints) or `profile` (Exception profiles)."}}}}}}
```

## The DisablePreventionDeleteRulesPAPIRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"DisablePreventionDeleteRulesPAPIRequest":{"type":"object","required":["rule_ids"],"properties":{"rule_ids":{"type":"array","minLength":1,"description":"The unique identifier of the Disable Prevention rule.","items":{"type":"string"}}}}}}}
```

## The GetDistributionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetDistributionDataRequest":{"title":"GetDistributionDataRequest","type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results.","minimum":0,"default":0},"search_to":{"type":"integer","description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (`search_to` - `search_from`). The maximum allowed value is <=100. Requests exceeding this limit will return a 400 error.","minimum":1,"maximum":100,"default":100},"sort":{"type":"object","required":["field","keyword"],"properties":{"field":{"type":"string","description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`"},"keyword":{"description":"Determines the sort order.","enum":["asc","desc"]}}},"filters":{"type":"array","description":"Filter condition to apply to the query","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`\n","minLength":1},"operator":{"description":"Comparison operator to use for filtering.\n**Note:** The `package_type`, `platform`, and `status` fields are **enum** types and therefore do not support the `contains` or `not_contains` filter operators.\n","enum":["eq","neq","contains","not_contains"]},"value":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `completed`, `in_progress`, or `failed`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, `ios`, `serverless`, or `linux`\n* If the `field` is `package_type`, the `value` can be `standalone`, `kubernetes`, `upgrade`, or `helm` "}}}}}}}}}
```

## The GetDistributionDataResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"GetDistributionDataResponse":{"type":"object","description":"Response object containing the list of distributions and metadata","required":["reply"],"properties":{"reply":{"type":"object","description":"Container object for the response data","properties":{"data":{"type":"array","description":"Array of distribution objects matching the filter criteria","items":{"$ref":"#/components/schemas/Distribution"}},"filter_count":{"type":"integer","description":"Number of distributions returned in the current response after applying filters."},"total_count":{"type":"integer","description":"Total number of distributions available in the system without filters."}}}}},"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```

## The Distribution object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"components":{"schemas":{"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.