Vulnerability Findings
vulnerability finding records (paginated or by ID)
Returns paginated vulnerability findings — one record per CVE/asset pair. Use next_page_token from the response to fetch subsequent pages.
Pagination: Control the number of records per page with the optional page_size field (default 1000, maximum 10000).
Rate limit: Up to 1,000 requests per 24-hour rolling window. Exceeding this limit returns HTTP 429.
Supported filter fields and filter types:
Each filter clause is an object with SEARCH_FIELD, SEARCH_TYPE, and SEARCH_VALUE. The SEARCH_TYPE values supported per field depend on the field's data type:
Filter field (SEARCH_FIELD)
Data type
Supported filter types (SEARCH_TYPE)
ASSET_NAME
string
EQ, NEQ, IN, NIN, CONTAINS, NCONTAINS, WILDCARD, WILDCARD_NOT
ASSET_GROUP_IDS
ID array
ARRAY_OVERLAPS
ASSET_CATEGORY
string
EQ, NEQ, IN, NIN
CVE_ID
string
EQ, NEQ, IN, NIN, CONTAINS
CVSS_SEVERITY
enum string
EQ, NEQ, IN, NIN
PLATFORM_ID
string
EQ, NEQ, IN, NIN
FIX_AVAILABLE
boolean
EQ
PACKAGE_IN_USE
boolean
EQ
HAS_KEV
boolean
EQ
EXPLOIT_LEVEL
enum string
EQ, NEQ, IN, NIN
EPSS_SCORE
number (0–1)
EQ, GT, GTE, LT, LTE, RANGE
INTERNET_EXPOSED
boolean
EQ
FIRST_OBSERVED
timestamp (ms)
GT, GTE, LT, LTE, RANGE, RELATIVE_TIMESTAMP
LAST_OBSERVED
timestamp (ms)
GT, GTE, LT, LTE, RANGE, RELATIVE_TIMESTAMP
Sortable fields: EPSS_SCORE, CVSS_SCORE, CORTEX_VULNERABILITY_RISK_SCORE.
Filter value reference:
When filtering on CVSS_SEVERITY or EXPLOIT_LEVEL with SEARCH_TYPE EQ, use the following SEARCH_VALUE values:
CVSS_SEVERITY:SEV_070_CRITICAL,SEV_060_HIGH,SEV_050_MEDIUM,SEV_040_LOWEXPLOIT_LEVEL:WEAPONIZED,POC,NONE
Filtering on ASSET_GROUP_IDS:
ASSET_GROUP_IDS is an array field, so it only supports the ARRAY_OVERLAPS filter type. Supply SEARCH_VALUE as a list of numeric asset-group IDs; the clause matches a finding when the asset belongs to any of the listed groups. To match findings that do not belong to any of the listed groups, wrap the clause in a NOT block instead of an AND block.
Example (match any of the groups):
Example (exclude the groups):
Note: Response payloads return normalized severity strings (for example, HIGH or LOW) that are not valid filter inputs. Always use the SEV_0xx_* values above when filtering by CVSS_SEVERITY.
Required license: Requires the Cortex Cloud Posture Management add-on.
Request body for paginated vulnerability findings search.
Successful response with vulnerability findings.
Paginated response containing vulnerability findings.
Invalid filter parameters or expired page token.
Rate limit exceeded. This endpoint allows up to 1,000 requests per 24-hour rolling window.
POST /vulnerability-management/v1/vulnerability-finding/search HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 178
{
"request_data": {
"filter": {
"AND": [
{
"SEARCH_FIELD": "LAST_OBSERVED",
"SEARCH_TYPE": "RELATIVE_TIMESTAMP",
"SEARCH_VALUE": 2592000000
}
]
},
"sort": [
{
"FIELD": "CVSS_SCORE",
"ORDER": "DESC"
}
]
}
}{
"reply": {
"data": [
{
"cortex_vulnerability_risk_score": null,
"asset_name": "SNMP Server at 89.170.90.209:161",
"cve_id": "CVE-2025-20169",
"cve_description": "A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. \r\nThis vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.",
"epss_score": 0.00368,
"cvss_score": 7.7,
"cvss_severity": "HIGH",
"fix_versions": [],
"fix_date": null,
"published_date": 1738713600000,
"cve_risk_factors": [
"Attack vector: network",
"High severity",
"Attack complexity: low",
"DoS - High"
],
"affected_software": null,
"has_kev": null,
"exploitable": false,
"exploit_level": "NONE",
"asset_type": "SERVICE",
"asset_category": "Service",
"has_issue": false,
"ipv4_addresses": [
"89.170.90.209"
],
"ipv6_addresses": [],
"operating_system": null,
"os_family": null,
"location": null,
"internet_exposed": true,
"provider": "ON_PREM",
"finding_sources": [
"CORTEX_ATTACK_SURFACE_MANAGEMENT"
],
"first_observed": 1764890719158,
"last_observed": 1764715866000,
"source_tags": [
"asm.attribution.organization_names:[Parameter FAKE_2332423424]"
],
"layer_id": null,
"image": null,
"origin_package_name": null,
"package_file_creation_time": null,
"package_licenses": [],
"package_version": null,
"package_purl": null,
"package_type": null,
"cve_publish_date": 1738713600000,
"platform_id": "c273519c3b61adfb7dc46547fbcbfa32",
"asset_id": "fef704015fd52a8495025f830b7483988d170f93b5807617761e4af827275a83",
"fix_available": false,
"package_in_use": null,
"file_path": null,
"package_symbols": [],
"package_author": null,
"application_version": null,
"asset_type_class": "External Surface",
"type_id": "140000000",
"derived_from_base_image": null,
"is_derived": false,
"image_name": null,
"asset_group_ids": [],
"volume_asset_id": null,
"is_root": null,
"volume_path": null,
"partition_id": null,
"partition_id_type": null,
"disk_name": null,
"remediation": null,
"issue_id": null
}
],
"filter_count": 342,
"total_count": 10500,
"next_page_token": "eyJsYXN0X2VsZW1lbnQiOiA1Njc4fQ=="
}
}Returns the vulnerability finding record for the given platform_id. Returns HTTP 404 when no matching finding exists.
Required license: Requires the Cortex Cloud Posture Management add-on.
Unique platform identifier for a vulnerability finding.
abc123def456Empty body — no request parameters required.
Vulnerability finding record.
Response containing a single vulnerability finding by platform ID.
Missing or invalid platform_id.
No finding found for the given platform_id.
POST /vulnerability-management/v1/vulnerability-finding/{platform_id} HTTP/1.1
Host: api-yourfqdn
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"reply": {
"data": [
{
"cortex_vulnerability_risk_score": null,
"asset_name": "SNMP Server at 89.170.90.209:161",
"cve_id": "CVE-2025-20169",
"cve_description": "A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. \r\nThis vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.",
"epss_score": 0.00368,
"cvss_score": 7.7,
"cvss_severity": "HIGH",
"fix_versions": [],
"fix_date": null,
"published_date": 1738713600000,
"cve_risk_factors": [
"Attack vector: network",
"High severity",
"Attack complexity: low",
"DoS - High"
],
"affected_software": null,
"has_kev": null,
"exploitable": false,
"exploit_level": "NONE",
"asset_type": "SERVICE",
"asset_category": "Service",
"has_issue": false,
"ipv4_addresses": [
"89.170.90.209"
],
"ipv6_addresses": [],
"operating_system": null,
"os_family": null,
"location": null,
"internet_exposed": true,
"provider": "ON_PREM",
"finding_sources": [
"CORTEX_ATTACK_SURFACE_MANAGEMENT"
],
"first_observed": 1764890719158,
"last_observed": 1764715866000,
"source_tags": [
"asm.attribution.organization_names:[Parameter FAKE_2332423424]"
],
"layer_id": null,
"image": null,
"origin_package_name": null,
"package_file_creation_time": null,
"package_licenses": [],
"package_version": null,
"package_purl": null,
"package_type": null,
"cve_publish_date": 1738713600000,
"platform_id": "c273519c3b61adfb7dc46547fbcbfa32",
"asset_id": "fef704015fd52a8495025f830b7483988d170f93b5807617761e4af827275a83",
"fix_available": false,
"package_in_use": null,
"file_path": null,
"package_symbols": [],
"package_author": null,
"application_version": null,
"asset_type_class": "External Surface",
"type_id": "140000000",
"derived_from_base_image": null,
"is_derived": false,
"image_name": null,
"asset_group_ids": [],
"volume_asset_id": null,
"is_root": null,
"volume_path": null,
"partition_id": null,
"partition_id_type": null,
"disk_name": null,
"remediation": null,
"issue_id": null
}
]
}
}Last updated
Was this helpful?