> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/response-action.md). # Response Action APIs for response actions ## Restore File > Restore a quarantined file on a requested endpoints.\ > When filtering by multiple fields:\ > \- Response is concatenated using AND condition (OR is not supported).\ > \- Maximum result set size is 100.\ > \- Offset is the zero-based number of incidents from the start of the result set.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/restore":{"post":{"operationId":"postRestore","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Restore File","description":"Restore a quarantined file on a requested endpoints.\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 100.\n- Offset is the zero-based number of incidents from the start of the result set.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["file_hash"],"description":"A dictionary containing the API request fields.","properties":{"file_hash":{"type":"string","description":"String that represents the file in hash. Hash must be a valid SHA256."},"endpoint_id":{"type":"string","description":"Endpoint ID.\n\nNote: If you do not enter a specific endpoint ID, the request will run restore on all endpoints which relate to the quarantined file you defined."},"incident_id":{"type":"integer","description":"String representing the incident ID.\nWhen included in the request, the Restore File action will appear in the Cortex XDR Incident View Timeline tab."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"action_id":{"type":"string"},"endpoints_count":{"type":"string"}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## File Retrieval Details > View the API required to call in order to download the file retrieved by the \[Retrieve File]\() API request according to the action ID.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\*\ > \ > The response contains a file hash you need to download and then unzip to view:\ > 1\. Download the file.\ > \ > \\ > \`\`\` curl\ > curl -XPOST "\" \ > -H "x-xdr-auth-id:{API\_KEY\_ID}" \ > -H "Authorization:{API\_KEY}" \ > -H 'Content-Type:application/json' \ > \--output /tmp/file.zip\ > \`\`\`\ > 2\. Unzip the file: \`unzip /tmp/file.zip\`
````json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/actions/file_retrieval_details":{"post":{"operationId":"postFileRetrievalDetails","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"File Retrieval Details","description":"View the API required to call in order to download the file retrieved by the [Retrieve File](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/response-action#post-public_api-v1-endpoints-file_retrieval) API request according to the action ID.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**\n\nThe response contains a file hash you need to download and then unzip to view:\n1. Download the file.\n\n\n``` curl\ncurl -XPOST \"https://api-{fqdn}/public_api/v1/download/\" \n-H \"x-xdr-auth-id:{API_KEY_ID}\" \n-H \"Authorization:{API_KEY}\" \n-H 'Content-Type:application/json' \n--output /tmp/file.zip\n```\n2. Unzip the file: `unzip /tmp/file.zip`\n","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["group_action_id"],"description":"A dictionary containing the API request fields.","properties":{"group_action_id":{"type":"string","description":"The action ID of the [Retrieve File](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/response-action#post-public_api-v1-endpoints-file_retrieval) API response."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"data":{"type":"object","properties":{"endpoint_ID":{"type":"string","description":"API required to call in order to download the retrieved result."}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ```` ## Allow List Files > Add files which do not exist in the allow or block lists to an allow list.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/hash_exceptions/allowlist":{"post":{"operationId":"postAllowlist","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Allow List Files","description":"Add files which do not exist in the allow or block lists to an allow list.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["hash_list"],"description":"A dictionary containing the API request fields.","properties":{"hash_list":{"type":"array","description":"A list of hashed files you want to add to the allow list. Hash must be a valid SH256.","items":{"type":"string"}},"comment":{"type":"string","description":"Additional information regarding the action."},"incident_id":{"type":"integer","description":"The incident ID related to the hash.\nWhen included in the request, the **Allow List** action will appear in the **Cortex XDR Incident View Timeline** tab."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=File successfully added to the allow list."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Get Quarantine Status > Retrieve the quarantine status for a specified files.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/quarantine/status":{"post":{"operationId":"postStatus","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Get Quarantine Status","description":"Retrieve the quarantine status for a specified files.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["files"],"properties":{"files":{"type":"array","description":"Array of endpoint IDs, filepaths, and file hash.","items":{"type":"object","properties":{"endpoint_id":{"type":"string","description":"Endpoint ID"},"file_path":{"type":"string","description":"File hash. Must be a valid SHA256."},"file_hash":{"type":"string","description":"File path."}}}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"array","items":{"type":"object","properties":{"endpoint_id":{"type":"string","description":"Endpoint ID."},"file_path":{"type":"string","description":"File path."},"file_hash":{"type":"string","description":"File hash."},"status":{"type":"boolean","description":"The file's status.\nTrue: The file is quarantined.\nFalse: The file is not quarantined."}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Quarantine Files > Quarantine file on selected endpoints. You can select up to 1000 endpoints.\ > \ > Note: A success response means that the request reached the defined endpoints, however if the file was not found there, no quarantine action will take place. To ensure if the file has been quarantined, check the Cortex XDR Action Center.\ > \ > When filtering by multiple fields:\ > \- Response is concatenated using AND condition (OR is not supported).\ > \- Maximum result set size is 1000.\ > \- Offset is the zero-based number of incidents from the start of the result set. ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/quarantine":{"post":{"operationId":"postQuarantine","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Quarantine Files","description":"Quarantine file on selected endpoints. You can select up to 1000 endpoints.\n\nNote: A success response means that the request reached the defined endpoints, however if the file was not found there, no quarantine action will take place. To ensure if the file has been quarantined, check the Cortex XDR Action Center.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Maximum result set size is 1000.\n- Offset is the zero-based number of incidents from the start of the result set.","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["filters","file_path","file_hash"],"properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.","enum":["endpoint_id_list"]},"operator":{"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings","enum":["in"]},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: Array of strings","items":{"type":"string"}}},"required":["field","operator","value"]}},"file_path":{"type":"string","description":"The path of the file you want to quarantine. You must enter a proper path and not symbolic links."},"file_hash":{"type":"string","description":"Incident ID.\nWhen included in the request, the **Quarentine File** action will appear in the **Cortex XDR Incident View Timeline** tab."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of action to quarantine selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the file quarantine succeeded either:\n- In Cortex XDR console, navigate to **Response** > **Action Center** and search for the action ID. Make sure the **Action ID** field is selected in the table **Layout** settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/response-action#post-public_api-v1-actions-get_action_status) API request."},"status":{"type":"string","description":"Integer representing whether the action:\n- `1`: succeeded\n- `0`: failed"},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Block List Files > Add files which do not exist in the allow or block lists to a block list. You can view the block list in the UI at \*\*Incident Response\*\* > \*\*Action Center\*\* > \*\*Block List\*\*.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/hash_exceptions/blocklist":{"post":{"operationId":"postBlocklist","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Block List Files","description":"Add files which do not exist in the allow or block lists to a block list. You can view the block list in the UI at **Incident Response** > **Action Center** > **Block List**.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["hash_list"],"description":"A dictionary containing the API request fields.","properties":{"hash_list":{"type":"array","description":"A list of hashed files you want add to a block list. Hash must be a valid SH256.","items":{"type":"string"}},"comment":{"type":"string","description":"Additional information regarding the action."},"incident_id":{"type":"integer","description":"The incident ID related to the hash.\nWhen included in the request, the **Block List** action appears in the **Cortex XDR Incident View Timeline** tab."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"boolean","description":"true=File successfully added to block list."}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Unisolate Endpoints > Reverse the isolation of one or more endpoints in single request.\ > \ > Note: You can only send a request with either \`endpoint\_id\` to unisolate one endpoint or with filters to unisolate more than one endpoint. An error is raised if you try to use both \`endpoint\_id\` and the filters.\ > \ > Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/unisolate":{"post":{"operationId":"postUnisolate","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Unisolate Endpoints","description":"Reverse the isolation of one or more endpoints in single request.\n\nNote: You can only send a request with either `endpoint_id` to unisolate one endpoint or with filters to unisolate more than one endpoint. An error is raised if you try to use both `endpoint_id` and the filters.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"filters":{"type":"array","description":"An array of filter fields for unisolating a number of endpoints at once.\nNote: This field is only required if unisolating more than one endpoint.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.","enum":["endpoint_id_list"]},"operator":{"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`: List of strings","enum":["IN"]},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: List of strings","items":{"type":"string"}}}}},"endpoint_id":{"type":"string","description":"The ID of the endpoint to unisolate.\n\nNote: this field is only required if unisolating one endpoint."},"incident_id":{"type":"string","description":"Incident ID.\nWhen included in the request, the **Unisolate Endpoints** action will appear in the **Cortex XDR Incident View Timeline** tab."}}}}}}},"description":"One of `endpoint_id` of `filters` is required, but not both."},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of the action to unisolate selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the endpoint was restored either:\n- In the Cortex XDR console, navigate to **Response** > **Action Center** > **Isolation** and search for the action ID. Make sure the **Action ID** field is selected in the table **Layout** settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/response-action#post-public_api-v1-actions-get_action_status) API request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Cancel Scan Endpoints > Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are in \*\*Pending\*\* or in \*\*Progress\*\* status.\ > \ > When filtering by multiple fields:\ > \- Response is concatenated using AND condition (OR is not supported).\ > \- Offset is the zero-based number of endpoints from the start of the result set.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/abort_scan":{"post":{"operationId":"postAbortScan","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Cancel Scan Endpoints","description":"Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are in **Pending** or in **Progress** status.\n\nWhen filtering by multiple fields:\n- Response is concatenated using AND condition (OR is not supported).\n- Offset is the zero-based number of endpoints from the start of the result set.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["filters"],"properties":{"filters":{"type":["array","string"],"description":"An array of filter fields to filter which endpoints to cancel scanning.\nTo cancel scan of all endpoints, use the value \"all\".","items":{"type":"object","properties":{"field":{"type":"string","description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `dist_name`: Name of the distribution list.\n- `first_seen`: When an endpoint was first seen.\n- `last_seen`: When an endpoint was last seen.\n- `ip_list`: List of IP addresses.\n- `group_name`: Name of endpoint group.\n- `platform`: Type of operating system.\n- `alias`: Endpoint alias name.\n- `isolate`: If an endpoint has been isolated.\n- `hostname`: Name of host.\n- `username`: Name of user.","enum":["endpoint_id_list","dist_name","first_seen","last_seen","ip_list","group_name","platform","alias","isolate","hostname","username","scan_status"]},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`: List of strings\n- `ip_list`: List of strings, for example 192.168.5.12\n- `platform`: Permitted values are `windows`, `linux`, `macos`, `android`\n- `isolate`: Permitted values are `isolated` or `unisolated`\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.","enum":["in","gte","lte"]},"value":{"type":["integer","array","string"],"description":"Value that this filter must match. Valid keywords:\n- `first_seen`, `last_seen`: Integer in timestamp epoch milliseconds, UTC timezone\n- `endpoint_id_list`, `dist_name`, `hostname`, `alias`, `group_name`: List of strings\n- `ip_list`: List of strings, for example 192.168.5.12\n- `isolate`: Permitted values are `isolated` or `unisolated`.\n- `platform`: Permitted values are `windows`, `linux`, `macos`, or `android`","items":{"type":"string"}}},"required":["field","operator","value"]}},"incident_id":{"type":"string","description":"Incident ID.\nWhen included in the request, the **Cancel Scan Endpoints** action will appear in the **Cortex XDR Incident View Timeline** tab."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of action to cancel scan selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the scan succeeded either:\n- In Cortex XDR console, navigate to **Response** > **Action Center** and search for the action ID. Make sure the **Action ID** field is selected in the table Layout settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/response-action#post-public_api-v1-actions-get_action_status) API request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Scan Endpoints > Run a scan on selected endpoints.\ > \- Response is concatenated using AND condition (OR is not supported).\ > \- Offset is the zero-based number of incidents from the start of the result set.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/scan":{"post":{"operationId":"postScan","tags":["Response Action"],"summary":"Scan Endpoints","requestBody":{"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["filters"],"properties":{"filters":{"type":"object","description":"An array of filter fields. To scan all endpoints, use the value `all`.","additionalProperties":{"type":"object","required":["field","operator","value"],"properties":{"field":{"description":"String that identifies a list the filters match. Filters are based on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.\n- `dist_name`: Name of the distribution list.\n- `first_seen`: When an endpoint was first seen.\n- `last_seen`: When an endpoint was last seen.\n- `ip_list`: List of IP addresses.\n- `group_name`: Name of endpoint group.\n- `platform`: Type of operating system.\n- `alias`: Endpoint alias name.\n- `isolate`: If an endpoint has been isolated.\n- `hostname`: Name of host.","enum":["endpoint_id_list","dist_name","first_seen","last_seen","ip_list","group_name","platform","alias","isolate","hostname"]},"operator":{"type":"string","description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list`, `dist_name`, `group_name`, `alias`, `hostname`, `username`: List of strings\n- `ip_list`: List of strings, for example 192.168.5.12\n- `platform`: Permitted values are `windows`, `linux`, `macos`, `android`\n- `isolate`: Permitted values are `isolated` or `unisolated`\n- `scan_status`: Permitted values are `none`, `pending`, `in_progress`, `canceled`, `aborted`, `pending_cancellation`, `success`, or `error`\n`gte` / `lte`\n- `first_seen` and `last_seen`: Integer in timestamp epoch milliseconds.","enum":["in","gte","lte"]},"value":{"type":["array","string","integer"],"description":"Value that this filter must match. Valid keywords:\n- `first_seen`, `last_seen`: Integer representing the number of milliseconds after the Unix epoch, UTC timezone.\n- `endpoint_id_list`, `dist_name`, `hostname`, `alias`, `group_name`: List of strings\n- `ip_list`: Must contain an IP address string\n- `isolate`: Must be `isolated` or `unisolated`.\n- `platform`: Must be either `windows`, `linux`, `macos`, or `android`.","items":{"type":"string"}}}}},"incident_id":{"type":"string","description":"Incident ID.\nWhen included in the request, the **Scan Endpoints** action will appear in the **Cortex XDR Incident View Timeline** tab."}}}}}}},"description":"Note: You can send a request to retrieve either **all** or **filtered** results."},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of action to scan selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the scan was successful either:\n- In Cortex XDR console, navigate to **Response** > **Action Center** > **All Actions** and search for the action ID. Make sure the **Action ID** field is selected in the table **Layout** settings.\n- Send a [Get Action Status](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/response-action#post-public_api-v1-actions-get_action_status) API request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"description":"Run a scan on selected endpoints.\n- Response is concatenated using AND condition (OR is not supported).\n- Offset is the zero-based number of incidents from the start of the result set.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Get Action Status > Retrieve the status of the requested actions according to the action ID.\ > \ > Required license: \*\*Cortex XDR Prevent\*\*, \*\*Cortex XDR Pro per Endpoint\*\*, or \*\*Cortex XDR Pro per GB\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/actions/get_action_status":{"post":{"operationId":"postGetActionStatus","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"summary":"Get Action Status","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["group_action_id"],"properties":{"group_action_id":{"type":"integer","description":"Action ID of the selected request."}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"data":{"type":"object","properties":{"agent_id":{"type":"string","enum":["PENDING","IN_PROGRESS","CANCELLED","PENDING_ABORT","ABORTED","EXPIRED","COMPLETED_PARTIAL","COMPLETED_SUCCESSFULLY","FAILED","TIMEOUT"]}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"description":"Retrieve the status of the requested actions according to the action ID.\n\nRequired license: **Cortex XDR Prevent**, **Cortex XDR Pro per Endpoint**, or **Cortex XDR Pro per GB**"}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Retrieve File > Retrieve files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints.\ > \- Response is concatenated using AND condition (OR is not supported).\ > \- Offset is the zero-based number of incidents from the start of the result set.\ > \ > Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/file_retrieval":{"post":{"summary":"Retrieve File","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"ID of action to retrieve files from selected endpoints.\nResponse only indicates the request was successfully sent to the endpoint. To track if the file was retrieved successfully either: in the Cortex XDR console, navigate to Response > Action Center > Isolation and search for the action ID. Make sure the Action ID field is selected in the table Layout settings by selecting the three vertical dots.\nTo view the file, send a File Retrieval Details request."},"status":{"type":"string"},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON."},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters."},"402":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal server error. A unified status for API communication type errors."}},"operationId":"post-public_api-v1-endpoints-file_retrieval","description":"Retrieve files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints.\n- Response is concatenated using AND condition (OR is not supported).\n- Offset is the zero-based number of incidents from the start of the result set.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["filters","files"],"properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["endpoint_id_list"],"description":"Identifies the field the filter must match:\r\n- `endpoint_id_list`"},"operator":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\r\n`in`\r\n- 'endpoint_id_list'","enum":["in"]},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\r\n- 'endpoint_id_list': List of strings.","items":{"type":"string"}}},"required":["field","operator","value"]}},"files":{"type":"object","description":"One of the operating system types must be included.","properties":{"windows":{"type":"array","items":{"type":"string"}},"linux":{"type":"array","items":{"type":"string"}},"macos":{"type":"array","items":{"type":"string"}}}},"incident_id":{"type":"string","description":"Incident ID. When included in the request, the Retrieve File action will appear in the Cortex XDR Incident View Timeline tab."}}}},"required":["request_data"]}}}}}}}} ``` ## Isolate Endpoints > Isolate one or more endpoints in a single request. Request is limited to 1000 endpoints.\ > \ > Required license: \*\*Cortex XDR Prevent\*\* or \*\*Cortex XDR Pro per Endpoint\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/endpoints/isolate":{"post":{"summary":"Isolate Endpoints","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"tags":["Response Action"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"action_id":{"type":"string","description":"Action ID to scan selected endpoints.\nThe response only indicates the request was successfully sent to the endpoint. To track if the isolation succeeded either:\n- In the Cortex XDR console, navigate to **Response** > **Action Center** > **Isolation** and search for\nthe action ID. Make sure the Action ID field is\nselected in the table Layout settings by selecting\nthe vertical elipses.\n- Send a [Get Action Status](https://app.gitbook.com/s/bcaz3nnErYwzhJKuv5Ls/cortex-xdr-3.x-apis/response-action#post-public_api-v1-actions-get_action_status) request."},"endpoints_count":{"type":"string","description":"Number of endpoints included in the request."}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON."},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters."},"402":{"description":"Unauthorized access. User does not have the required license type to run this API."},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API."},"500":{"description":"Internal server error. A unified status for API communication type errors."}},"operationId":"post-public_api-v1-endpoints-isolate","description":"Isolate one or more endpoints in a single request. Request is limited to 1000 endpoints.\n\nRequired license: **Cortex XDR Prevent** or **Cortex XDR Pro per Endpoint**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","required":["endpoint_id"],"properties":{"filters":{"type":"array","description":"Array of filtered fields for isolating a number of endpoints at once.\nNote: Only required if isolating more than one endpoint.","items":{"type":"object","properties":{"field":{"type":"string","description":"Identifies a list the filters match. Filters are\nbased on the following keywords:\n- `endpoint_id_list`: List of endpoint IDs.","enum":["endpoint_id_list"]},"operator":{"type":"string","description":"Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`in`\n- `endpoint_id_list` —List of strings","enum":["in"]},"value":{"type":"array","description":"Value that this filter must match. Valid keywords:\n- `endpoint_id_list`: List of strings","items":{"type":"string"}}},"required":["field","operator","value"]}},"endpoint_id":{"type":"string","description":"Identifies the endpoint to isolate.\nNote: Only required if isolating one endpoint."},"incident_id":{"type":"string","description":"The incident ID.\nWhen included in the request, the **Isolate Endpoints action** will appear in the Cortex XDR Incident ViewTimeline tab."}}}},"required":["request_data"]}}},"description":"Note: You can send a request with either `endpoint_id` for isolating one endpoint or `filters` for isolating more than one endpoint. You cannot use both parameters in the same call."}}}}} ``` ## Initiate Forensics Triage > Initiate forensics triage for the specified agents.\ > \- Maximum of 10 concurrent triage actions at a time.\ > \- Specified agents must have Forensics License enabled.\ > \- Specified agents must be the same OS, Windows or macOS, but not a mixture of both.\ > \- Specified configuration must must support Triage Type = Online.\ > \ > Required license: \*\*Forensics add-on\*\*
```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/triage_endpoint":{"post":{"summary":"Initiate Forensics Triage","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"group_action_id":{"type":"integer","description":"Unique ID for triage action."},"successful_agent_ids":{"type":"array","description":"List of agent IDs that successfully received the triage action.","items":{"type":"string"}},"unsuccessful_agent_ids":{"type":"array","description":"List of agent IDs that did not successfully receive the triage action.","items":{"type":"object"}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-triage_endpoint","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"description":"Initiate forensics triage for the specified agents.\n- Maximum of 10 concurrent triage actions at a time.\n- Specified agents must have Forensics License enabled.\n- Specified agents must be the same OS, Windows or macOS, but not a mixture of both.\n- Specified configuration must must support Triage Type = Online.\n\nRequired license: **Forensics add-on**\n","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","required":["agent_ids"],"properties":{"agent_ids":{"type":"array","description":"List of agents to run forensics triage on. ","items":{"type":"string"}},"collector_uuid":{"type":"string","description":"UUID of the triage configuration. If none is specified, the default configuration is used for this action."}}}},"required":["request_data"]}}}},"tags":["Response Action"]}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` ## Get triage presets > Get all triage preset information including triage name, platform, description, created by, and triage type. > \\ > > \ > Required license: \*\*Forensics add-on\*\* ```json {"openapi":"3.0.0","info":{"title":"Cortex XDR REST API","version":"3.18"},"tags":[{"name":"Response Action","description":"APIs for response actions"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/get_triage_presets":{"post":{"summary":"Get triage presets","tags":["Response Action"],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"triage_presets":{"type":"array","items":{"type":"object","properties":{"uuid":{"type":"string","description":"Preset/configuration UUID"},"name":{"type":"string","description":"Triage name"},"os":{"type":"string","description":"Triage operating system/platform: `Windows` or `macOS`"},"description":{"type":"string","description":"Description"},"created_by":{"type":"string","description":"Triage was created by"},"type":{"type":"string","description":"Triage type: Online, Offline, Online/Offline"}}}}}}}}}}},"400":{"description":"ad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"operationId":"post-public_api-v1-get_triage_presets","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"schema":{"type":"string","default":"gzip"},"in":"header","name":"Accept-Encoding","description":"For retrieving a compressed gzipped response"}],"description":"Get all triage preset information including triage name, platform, description, created by, and triage type.\r\n\r\nRequired license: **Forensics add-on**","requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{}}}}}}}}}},"components":{"schemas":{"reply":{"title":"reply","type":"object","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xdr-3-api/cortex-xdr-3.x-apis/response-action.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.