Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Response Action

APIs for response actions

Restore File

post

Restore a quarantined file on a requested endpoints. When filtering by multiple fields:

  • Response is concatenated using AND condition (OR is not supported).

  • Maximum result set size is 100.

  • Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/restore
POST /public_api/v1/endpoints/restore HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 63

{
  "request_data": {
    "file_hash": "<hash value>",
    "incident_id": 302
  }
}
{
  "reply": {
    "action_id": "<action ID>",
    "status": 1,
    "endpoints_count": "673"
  }
}

File Retrieval Details

post

View the API required to call in order to download the file retrieved by the Retrieve File API request according to the action ID.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

The response contains a file hash you need to download and then unzip to view:

  1. Download the file.

curl -XPOST "https://api-{fqdn}/public_api/v1/download/<api_value>" 
-H "x-xdr-auth-id:{API_KEY_ID}"  
-H "Authorization:{API_KEY}" 
-H 'Content-Type:application/json' 
--output /tmp/file.zip

  1. Unzip the file: unzip /tmp/file.zip

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/actions/file_retrieval_details
POST /public_api/v1/actions/file_retrieval_details HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 50

{
  "request_data": {
    "group_action_id": "<action ID>"
  }
}
{
  "reply": {
    "data": {
      "<endpoint_ID>": "https://api-{fqdn}/public_api/v1/download/<api_value>"
    }
  }
}

Allow List Files

post

Add files which do not exist in the allow or block lists to an allow list.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
booleanOptional

true=File successfully added to the allow list.

post/public_api/v1/hash_exceptions/allowlist
POST /public_api/v1/hash_exceptions/allowlist HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 211

{
  "request_data": {
    "hash_list": [
      "032196FB1A---DFCF69E5D553F0",
      "365296EB1B---FCF29E5D553E4",
      "365296EB1B---FCF69E3D553E4",
      "365296EB1B---FCF69E5D553D4",
      "365296EB1B---FCF79E5D553D4"
    ],
    "comment": "test",
    "incident_id": 5
  }
}
true

Get Quarantine Status

post

Retrieve the quarantine status for a specified files.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/quarantine/status
POST /public_api/v1/quarantine/status HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 131

{
  "request_data": {
    "files": [
      {
        "endpoint_id": "<endpoint ID>",
        "file_path": "C:\\<file path>\\test_x64.msi",
        "file_hash": "<hash value>"
      }
    ]
  }
}
{
  "reply": [
    {
      "endpoint_id": "<endpoint ID>",
      "file_path": "C:\\<file path>\\test_x64.msi",
      "file_hash": "<hash value>",
      "status": false
    }
  ]
}

Quarantine Files

post

Quarantine file on selected endpoints. You can select up to 1000 endpoints.

Note: A success response means that the request reached the defined endpoints, however if the file was not found there, no quarantine action will take place. To ensure if the file has been quarantined, check the Cortex XDR Action Center.

When filtering by multiple fields:

  • Response is concatenated using AND condition (OR is not supported).

  • Maximum result set size is 1000.

  • Offset is the zero-based number of incidents from the start of the result set.

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/quarantine
POST /public_api/v1/endpoints/quarantine HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 172

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "<endpoint ID>"
        ]
      }
    ],
    "file_path": "C:\\<file path>\\test_x64.msi",
    "file_hash": "<hash value>"
  }
}
{
  "reply": {
    "action_id": "[ID value]",
    "status": "1",
    "endpoints_count": "673"
  }
}

Block List Files

post

Add files which do not exist in the allow or block lists to a block list. You can view the block list in the UI at Incident Response > Action Center > Block List.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
booleanOptional

true=File successfully added to block list.

post/public_api/v1/hash_exceptions/blocklist
POST /public_api/v1/hash_exceptions/blocklist HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 211

{
  "request_data": {
    "hash_list": [
      "032196FB1A---DFCF69E5D553F0",
      "365296EB1B---FCF69E7D553E4",
      "365296EB1B---FCF69E5D523E4",
      "365296EB1B---FCF69E5D553D4",
      "365296EB1B---FCF63E5D553D4"
    ],
    "comment": "test",
    "incident_id": 5
  }
}
true

Unisolate Endpoints

post

Reverse the isolation of one or more endpoints in single request.

Note: You can only send a request with either endpoint_id to unisolate one endpoint or with filters to unisolate more than one endpoint. An error is raised if you try to use both endpoint_id and the filters.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/unisolate
POST /public_api/v1/endpoints/unisolate HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 48

{
  "request_data": {
    "endpoint_id": "<endpoint ID>"
  }
}
{
  "reply": {
    "action_id": "<action ID>",
    "status": "1",
    "endpoints_count": "673"
  }
}

Cancel Scan Endpoints

post

Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are in Pending or in Progress status.

When filtering by multiple fields:

  • Response is concatenated using AND condition (OR is not supported).

  • Offset is the zero-based number of endpoints from the start of the result set.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/abort_scan
POST /public_api/v1/endpoints/abort_scan HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 34

{
  "request_data": {
    "filters": "all"
  }
}
{
  "reply": {
    "action_id": "text",
    "endpoints_count": "text"
  }
}

Scan Endpoints

post

Run a scan on selected endpoints.

  • Response is concatenated using AND condition (OR is not supported).

  • Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Body
Responses
200

Successful response

application/json
post/public_api/v1/endpoints/scan
POST /public_api/v1/endpoints/scan HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 34

{
  "request_data": {
    "filters": "all"
  }
}
{
  "reply": {
    "action_id": "text",
    "endpoints_count": "text"
  }
}

Get Action Status

post

Retrieve the status of the requested actions according to the action ID.

Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

Successful response

application/json
post/public_api/v1/actions/get_action_status
POST /public_api/v1/actions/get_action_status HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 46

{
  "request_data": {
    "group_action_id": 123456789
  }
}
{
  "reply": {
    "data": {
      "<agent ID>": "COMPLETED_SUCCESSFULLY"
    }
  }
}

Retrieve File

post

Retrieve files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints.

  • Response is concatenated using AND condition (OR is not supported).

  • Offset is the zero-based number of incidents from the start of the result set.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

OK

application/json
post/public_api/v1/endpoints/file_retrieval
POST /public_api/v1/endpoints/file_retrieval HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 176

{
  "request_data": {
    "filters": [
      {
        "field": "endpoint_id_list",
        "operator": "in",
        "value": [
          "text"
        ]
      }
    ],
    "files": {
      "windows": [
        "text"
      ],
      "linux": [
        "text"
      ],
      "macos": [
        "text"
      ]
    },
    "incident_id": "text"
  }
}
{
  "reply": {
    "action_id": "text",
    "status": "text",
    "endpoints_count": "text"
  }
}

Isolate Endpoints

post

Isolate one or more endpoints in a single request. Request is limited to 1000 endpoints.

Required license: Cortex XDR Prevent or Cortex XDR Pro per Endpoint

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

OK

application/json
post/public_api/v1/endpoints/isolate
POST /public_api/v1/endpoints/isolate HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 48

{
  "request_data": {
    "endpoint_id": "<endpoint ID>"
  }
}
{
  "reply": {
    "action_id": "<action ID>",
    "status": "1",
    "endpoints_count": "673"
  }
}

Initiate Forensics Triage

post

Initiate forensics triage for the specified agents.

  • Maximum of 10 concurrent triage actions at a time.

  • Specified agents must have Forensics License enabled.

  • Specified agents must be the same OS, Windows or macOS, but not a mixture of both.

  • Specified configuration must must support Triage Type = Online.

Required license: Forensics add-on

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
Responses
200

OK

application/json
post/public_api/v1/triage_endpoint
POST /public_api/v1/triage_endpoint HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 119

{
  "request_data": {
    "agent_ids": [
      "a1f7c60ca7954876a0146a0b5b9d6ea2"
    ],
    "collector_uuid": "5162122974c247eeb152089d516035ab"
  }
}
{
  "reply": {
    "group_action_id": 325,
    "successful_agent_ids": [
      "5111c5eb93944e2f97674db4f36b4211"
    ],
    "unsuccessful_agent_ids": []
  }
}

Get triage presets

post

Get all triage preset information including triage name, platform, description, created by, and triage type.

Required license: Forensics add-on

Header parameters
AuthorizationstringRequired

{api_key}

x-xdr-auth-idstringRequired

{api_key_id}

Accept-EncodingstringOptional

For retrieving a compressed gzipped response

Default: gzip
Body
request_dataobjectOptional
Responses
200

OK

application/json
post/public_api/v1/get_triage_presets
POST /public_api/v1/get_triage_presets HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19

{
  "request_data": {}
}
{
  "reply": {
    "triage_presets": [
      {
        "uuid": "374ecf0457c944c39791e5a60d1a6d24",
        "name": "XDR Default",
        "os": "MACOS",
        "description": "Default macOS Triage configuration included with the XDR Forensics add-on",
        "created_by": "user@company.com",
        "type": "Online / Offline"
      },
      {
        "uuid": "ea7a5d3ff52d41629e96fbd1d5f68535",
        "name": "XDR Default",
        "os": "WINDOWS",
        "description": "Default Triage configuration included with XDR Forensics add-on",
        "created_by": "user@company.com",
        "type": "Online / Offline"
      }
    ]
  }
}
PreviousLookup Datasets
NextRule Management

Last updated

Was this helpful?