Asset Inventory
APIs for managing assets in the asset inventory
Retrieve detailed information about all assets within your environment, including enterprise, multi-cloud, code, and external surfaces.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
{api_key}
{api_key_id}
Ok
Unauthorized
Internal Server Error, Invalid Input
POST /public_api/v1/assets HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 252
{
"request_data": {
"filters": {
"AND": [
{
"SEARCH_FIELD": "xdm.asset.type.class",
"SEARCH_TYPE": "NEQ",
"SEARCH_VALUE": "Other"
}
]
},
"on_demand_fields": [
"xdm.host.ipv4_addresses"
],
"sort": [
{
"FIELD": "xdm.asset.name",
"ORDER": "DESC"
}
],
"search_from": 1,
"search_to": 1000
}
}{
"reply": {
"data": [
{
"issues_breakdown": {
"critical": 0,
"high": 0,
"low": 0,
"medium": 0
},
"xdm.asset.first_observed": 1747834085000,
"xdm.asset.cloud.region": null,
"xdm.asset.last_observed": 1748399709000,
"issues_critical": 0,
"xdm.asset.strong_id": "172.16.33.51",
"xdm.asset.type.category": "Device",
"xdm.asset.name": null,
"xdm.asset.type.name": "Generic Device",
"cases_breakdown": {
"critical": 0,
"high": 0,
"low": 0,
"medium": 0
},
"xdm.asset.provider": "ON_PREM",
"xdm.asset.type.class": "Compute",
"xdm.asset.id": "fffd007cff1c15f3a0d152ae630df9630ce00e39bc66811a9fa9b6457a788afc",
"xdm.asset.type.id": "GENERIC_DEVICE",
"cases_critical": 0,
"xdm.asset.group_ids": [],
"xdm.asset.realm": "Other",
"xdm.asset.hierarchy.path": "Acme Corp/Engineering",
"xdm.asset.hierarchy.id_path": "5590382716",
"xdm.host.ipv4_addresses": [
"172.16.33.51"
]
}
],
"metadata": {
"filter_count": 1,
"total_count": 915
}
}
}Retrieve detailed information about the asset specified by asset ID.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
Asset ID
{api_key}
{api_key_id}
Ok
Unauthorized
Asset Not Found
Internal Server Error
GET /public_api/v1/assets/{id} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
{
"reply": {
"data": [
{
"xdm.asset.last_observed": 1748399709000,
"xdm.asset.cloud.region": null,
"xdm.asset.id": "fffd007cff1c15f3a0d132ae630df9630fe00e39bc66813a9fa9b6457a786afc",
"xdm.asset.provider": "ON_PREM",
"xdm.asset.first_observed": 1747834085000,
"xdm.asset.type.name": "Generic Device",
"xdm.asset.strong_id": "172.16.33.51",
"xdm.asset.name": null,
"xdm.asset.type.class": "Compute",
"xdm.asset.type.id": "GENERIC_DEVICE",
"xdm.asset.type.category": "Device",
"issues_critical": 0,
"xdm.asset.realm": "Other",
"xdm.asset.group_ids": [],
"cases_breakdown": {
"critical": 0,
"high": 0,
"low": 0,
"medium": 0
},
"issues_breakdown": {
"critical": 0,
"high": 0,
"low": 0,
"medium": 0
},
"cases_critical": 0,
"xdm.host.ipv4_addresses": [
"172.16.33.51"
]
}
],
"metadata": {
"filter_count": 1,
"total_count": 915
}
}
}Get the raw fields of the asset specified by asset ID.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
Asset ID
{api_key}
{api_key_id}
Ok
Unauthorized
Asset Not Found
Internal Server Error
GET /public_api/v1/assets/{id}/raw_fields HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
{
"reply": {
"data": [
{
"xdm__asset__raw_fields": {
"Platform Discovery": {
"Adjustable": false,
"Description": "The maximum number of times that you can call model inference in one minute for Anthropic Claude 3.5 Sonnet. The quota considers the combined sum of Converse, ConverseStream, InvokeModel and InvokeModelWithResponseStream.",
"GlobalQuota": false,
"QuotaAppliedAtLevel": "ACCOUNT",
"QuotaArn": "arn:aws:servicequotas:ap-south-1:384346710675:bedrock/L-F457545D",
"QuotaCode": "L-F457545D",
"QuotaName": "Cross-region InvokeModel requests per minute for Anthropic Claude 3.5 Sonnet",
"ServiceCode": "bedrock",
"ServiceName": "Amazon Bedrock",
"Unit": "None",
"Value": 100
}
}
}
],
"metadata": {
"filter_count": 1,
"total_count": 921
}
}
}Get the schema of the asset inventory, including the field names, pretty field names, and field type for every entry in the data model.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
{api_key}
{api_key_id}
Ok
Unauthorized
Internal Server Error
GET /public_api/v1/assets/schema HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
{
"reply": {
"DATA": [
{
"field_name": "xdm.asset.id",
"field_pretty_name": "Asset ID",
"data_type": "TEXT"
},
{
"field_name": "xdm.asset.name",
"field_pretty_name": "Name",
"data_type": "TEXT"
},
{
"field_name": "xdm.asset.provider",
"field_pretty_name": "Provider",
"data_type": "ENUM"
},
{
"field_name": "xdm.asset.type.class",
"field_pretty_name": "Class",
"data_type": "ENUM"
},
{
"field_name": "xdm.asset.hierarchy.path",
"field_pretty_name": "Hierarchy Path",
"data_type": "TEXT"
},
{
"field_name": "xdm.asset.hierarchy.id_path",
"field_pretty_name": "Hierarchy ID Path",
"data_type": "TEXT"
},
{
"field_name": "xdm.asset.resource_group",
"field_pretty_name": "Resource Group",
"data_type": "TEXT"
}
]
}
}Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM NG SIEM or Cortex XSIAM Enterprise Plus.
Field name - must be of type Enum
{api_key}
{api_key_id}
Ok
Unauthorized
Internal Server Error
GET /public_api/v1/assets/enum/{field_name} HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Accept: */*
{
"reply": {
"DATA": [
{
"NAME": "ACTIVE_DIRECTORY",
"PRETTY_NAME": "Active Directory"
},
{
"NAME": "AKAMAI",
"PRETTY_NAME": "Akamai"
},
{
"NAME": "ALIBABA_CLOUD",
"PRETTY_NAME": "Alibaba Cloud"
}
]
}
}Last updated
Was this helpful?