Additional References

Target Filter Fields

Used by the TargetFilter schema to define which endpoints a policy rule targets.

Field key	Description	Allowed operators	Value type
agent_type	Agent / sensor type	EQ, NEQ	string — one of the AgentType enum values
group_id	Endpoint group	AGENTS_GROUP_EQ, AGENTS_GROUP_NEQ	string — group name (resolved to ID internally)
hostname	Endpoint hostname	EQ, NEQ, CONTAINS, …	string
os_description	OS description string	EQ, NEQ, CONTAINS, …	string
tags	Endpoint tags	EQ, NEQ, CONTAINS, …	string or list of strings

Insert CSV Fields

Used by the Insert CSV endpoint to define the required and optional fields for the CSV payload.

Field	Description
indicator	(Required) String that identifies the indicator you want to insert into Cortex XDR.
type	(Required) Keyword identifying the type of indicator. Valid values are: HASH, IP, PATH, DOMAIN_NAME, or FILENAME
severity	(Required) Keyword identifying the indicator's severity. Valid values are: INFO, LOW, MEDIUM, HIGH, or CRITICAL
expiration_date	Integer representing the indicator's expiration timestamp. This is a Unix epoch timestamp value, in milliseconds. If this indicator has no expiration, use Never. If this value is NULL, the indicator receives the indicator's type value with the default expiration date. Valid values are: 7 days, 30 days, 90 days, or 180 days
comment	Comment string.
reputation	Keyword representing the indicator's reputation. Valid values are: GOOD, BAD, SUSPICIOUS, or UNKNOWN
reliability	Character representing the indicator's reliability rating. Valid values are A-F. A is the most reliable, F is the least.
class	String representing the indicator class (for example, "Malware")
vendor.name	String representing the name of the vendor who reported this indicator.
vendor.reputation	Keyword representing the vendor's reputation. Valid values are: GOOD, BAD, SUSPICIOUS, or UNKNOWN
vendor.reliability	Character representing the vendor's reliability rating. Valid values are A-F. A is the most reliable, F is the least.