> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/attack-surface-management.md).

# Attack Surface Management

APIs for attack surface management

## Get External Service

> Get service details according to the service ID. You can send up to 20 IDs.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_external_service":{"post":{"tags":["Attack surface management"],"summary":"Get External Service","description":"Get service details according to the service ID. You can send up to 20 IDs.\n\n**Required license:** Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_external_service","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"service_id_list":{"type":"array","description":"Represents the service ID you want to get details for.","items":{"type":"string"}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","description":"JSON object containing the query result.","properties":{"details":{"type":"array","description":"Service details according to the service ID.","items":{"type":"object","properties":{"service_id":{"type":"string"},"service_name":{"type":"string"},"service_type":{"type":"string"},"ip_address":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"object"}},"externally_detected_providers":{"type":"array","items":{"type":"string"}},"is_active":{"type":"string"},"first_observed":{"type":"integer"},"last_observed":{"type":"integer"},"port":{"type":"integer"},"protocol":{"type":"string"},"active_classifications":{"type":"array","items":{"type":"string"}},"inactive_classifications":{"type":"array","items":{"type":"object"}},"discovery_type":{"type":"string"},"business_units":{"type":"array","items":{"type":"string"}},"externally_inferred_vulnerability_score":{"type":"object","nullable":true},"externally_inferred_cves":{"type":"array","items":{"type":"object"}},"details":{"type":"object","properties":{"serviceKey":{"type":"string"},"serviceKeyType":{"type":"string"},"businessUnits":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"}}}},"providerDetails":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"firstObserved":{"type":"integer"},"lastObserved":{"type":"integer"}}}},"certificates":{"type":"array","items":{"type":"object","properties":{"certificate":{"type":"object","properties":{"issuer":{"type":"string"},"issuerAlternativeNames":{"type":"string"},"issuerCountry":{"type":"string"},"issuerEmail":{"nullable":true},"issuerLocality":{"type":"string"},"issuerName":{"type":"string"},"issuerOrg":{"type":"string"},"formattedIssuerOrg":{"type":"string"},"issuerOrgUnit":{"type":"string"},"issuerState":{"type":"string"},"publicKey":{"type":"string"},"publicKeyAlgorithm":{"type":"string"},"publicKeyRsaExponent":{"type":"integer"},"signatureAlgorithm":{"type":"string"},"subject":{"type":"string"},"subjectAlternativeNames":{"type":"string"},"subjectCountry":{"type":"string"},"subjectEmail":{"type":"string"},"subjectLocality":{"type":"string"},"subjectName":{"type":"string"},"subjectOrg":{"type":"string"},"subjectOrgUnit":{"type":"string"},"subjectState":{"type":"string"},"serialNumber":{"type":"string"},"validNotBefore":{"type":"integer"},"validNotAfter":{"type":"integer"},"version":{"type":"string"},"publicKeyBits":{"type":"integer"},"publicKeyModulus":{"type":"string"},"publicKeySpki":{"type":"string"},"sha1Fingerprint":{"type":"string"},"sha256Fingerprint":{"type":"string"},"md5Fingerprint":{"type":"string"}}},"activityStatus":{"type":"string"},"lastObserved":{"type":"integer"},"firstObserved":{"type":"integer"}}}},"domains":{"type":"array","items":{"type":"object"}},"ips":{"type":"array","items":{"type":"object","properties":{"ip":{"type":"string"},"protocol":{"type":"string"},"provider":{"type":"string"},"geolocation":{"type":"object","properties":{"latitude":{"type":"integer"},"longitude":{"type":"integer"},"countryCode":{"type":"string"},"city":{"type":"string"},"regionCode":{"type":"string"},"timeZone":{"type":"integer","nullable":true}}},"activityStatus":{"type":"string"},"lastObserved":{"type":"integer"},"firstObserved":{"type":"integer"}}}},"classifications":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"activityStatus":{"type":"string"},"values":{"type":"array","items":{"type":"object","properties":{"jsonValue":{"type":"string"},"firstObserved":{"type":"integer"},"lastObserved":{"type":"integer"}}}},"firstObserved":{"type":"integer"},"lastObserved":{"type":"integer"}}}},"tlsVersions":{"type":"array","items":{"type":"object","properties":{"tlsVersion":{"type":"string"},"cipherSuite":{"type":"string"},"firstObserved":{"type":"integer"},"lastObserved":{"type":"integer"},"activityStatus":{"type":"string"}}}},"inferredCvesObserved":{"type":"array","items":{"type":"object"}},"enrichedObservationSource":{"type":"string"},"ip_ranges":{"type":"object"}}}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get All Services

> Get a complete or filtered list of all your external services.\
> \
> The maximum result limit is 500.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_external_services":{"post":{"tags":["Attack surface management"],"summary":"Get All Services","description":"Get a complete or filtered list of all your external services.\n\nThe maximum result limit is 500.\n\n**Required license:** Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_external_services","parameters":[{"name":"authorization","in":"header","description":"api-key","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"api-key-id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"","content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","properties":{"filters":{"type":"object","description":"An array of filter fields. ","properties":{"field":{"type":"string","enum":["active_classifications","business_units_list","discovery_type","domain","externally_detected_providers","externally_inferred_cves","inactive_classifications","ip_address","ipv6_address","is_active","protocol","service_name","service_type","service_type_list","tags"],"description":"String that identifies the service field the filter is matching. Filters are based on the following case-sensitive keywords:\r\n\r\n- active_classifications\r\n- business_units_list\r\n- discovery_type\r\n- domain\r\n- externally_detected_providers\r\n- externally_inferred_cves\r\n- inactive_classifications\r\n- ip_address\r\n- ipv6_address\r\n- is_active\r\n- protocol\r\n- service_name\r\n- service_type\r\n- service_type_list\r\n- tags"},"operator":{"type":"string","enum":["contains","not_contains","eq","neq","in"],"description":"String that identifies the comparison operator you want to use for this filter. Valid keywords and values are:\r\n- **contains** / **not_contains**— use with `externally_detected_providers`, `domain`, `externally_inferred_cves`, `active_classifications`, `inactive_classifications`, service_name, `service_type`, `protocol`\r\n- **eq** / **neq**—  use with `service_name`, `service_type`, `protocol`, `ip_address`\r\n- **in** — use with `is_active`, `discovery_type`, `business_units_list`, `tags` "},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the services field that you specified for this filter:\r\n- active_classifications — String\r\n- business_units_list — String or list of strings in the format \"BU name\" or \"BU:BU name\", for example “Acme & Co, Inc.” or “BU:Acme & Co, Inc.”\r\n- discovery_type — String. Values are: `colocated_on_ip`, `directly_discovered`, `unknown`.\r\n- domain —  String\r\n- externally_detected_providers — String \r\n- externally_inferred_cves — String\r\n- inactive_classifications — String\r\n- ip_address — String\r\n- ipv6_address— String\r\n- is_active — String. Values are:`yes`, `no`\r\n- protocol — string \r\n- service_name —  String\r\n- service_type —  String\r\n- service_type_list —  String\r\n- tags — List of strings indicating the tags to filter on in the format `\"tag-family:tag-name\"`, for example `\"AR:registered to you\"`.","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"vulnerability_test_results":{"type":"boolean","enum":[true],"description":"Use this field with the value `true` to get vulnerability test results for the last 14 days for each service.\r\nUsing this field will slow down the endpoint."},"search_from":{"type":"integer","description":"An integer representing the start offset index of results.","default":0},"search_to":{"type":"integer","description":"An integer representing the start offset index of results. Use this field to specify the number of results on a page when using page token pagination.","default":5000},"sort":{"type":"object","description":"Identifies the sort order for the result set.","properties":{"keyword":{"type":"string","description":"Can be either ASC (ascending order) or DESC (descending order). Default is ASC. Values are case sensitive."},"field":{"type":"string","description":"Values are: \r\n- service_name \r\n- first_observed \r\n- last_observed \r\nBy default, case-sensitive, sort is defined as service_name.\r\n"}}}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer"},"result_count":{"type":"integer"},"external_services":{"type":"array","items":{"type":"object","properties":{"service_id":{"type":"string"},"service_name":{"type":"string"},"service_type":{"type":"string"},"ip_address":{"type":"array","items":{"type":"string"}},"domain":{"type":"array","items":{"type":"string"}},"externally_detected_providers":{"type":"array","items":{"type":"string"}},"is_active":{"type":"string"},"first_observed":{"type":"integer"},"last_observed":{"type":"integer"},"port":{"type":"integer"},"protocol":{"type":"string"},"active_classifications":{"type":"array","items":{"type":"string"}},"inactive_classifications":{"type":"array","items":{"type":"string"}},"discovery_type":{"type":"string"},"business_units":{"type":"array","items":{"type":"string"}},"externally_inferred_vulnerability_score":{"type":"string"},"externally_inferred_cves":{"type":"array","items":{"type":"object"}},"tls_versions":{"type":"array","items":{"type":"object"}},"inferred_cves_observed":{"type":"array","items":{"type":"object"}},"cloud_management_status":{"type":"string"}}}}}}}}}}},"400":{"description":"Bad Request. Got invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters."},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get all Internet Exposures

> Get a list of all your Internet exposure filtered by business units, externally detected providers, externally inferred CVEs, mac addresses, names, IP addresses, whether it has an XDR agent, whether it has active external services, and type.\
> \
> The maximum result limit is 500 assets.\
> \
> Note: You can send a request to retrieve either all or filtered results.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_assets_internet_exposure":{"post":{"tags":["Attack surface management"],"summary":"Get all Internet Exposures","description":"Get a list of all your Internet exposure filtered by business units, externally detected providers, externally inferred CVEs, mac addresses, names, IP addresses, whether it has an XDR agent, whether it has active external services, and type.\n\nThe maximum result limit is 500 assets.\n\nNote: You can send a request to retrieve either all or filtered results.\n\n**Required license:** Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_assets_internet_exposure","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.\n\nAn empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["business_units","externally_detected_providers","externally_inferred_cves","mac_addresses","name","ip_address","has_xdr_agent","has_active_external_services","type"],"description":"Identifies the assets field the filter is matching."},"operator":{"type":"string","enum":["contains","not_contains","eq","neq","in"],"description":"Identifies the comparison operator you want to use for this filter. Valid keywords and values are:\n`contains` / `not_contains`\n- `business_units`, `externally_detected_providers`, `externally_inferred_cves`, `mac_address`, `name`: String\n`eq` / `neq`\n- `name`, `ip_address`: String\n`in`\n- `has_xdr_agent`: List of strings. Permitted values are: `yes`, `no`, `unknown`, `n/a`.\n- `has_active_external_services`: List of strings. Permitted values are: `yes`, `no`, `unknown`.\n- `type`: List of strings. Permitted values are: `certificate`, `cloud_compute_instance`, `on_prem`, `domain`, `unassociated_responsive_ip`."},"value":{"description":"Value that this filter must match. Valid keywords:\n- `business_units`, `externally_detected_providers`, `externally_inferred_cves`, `mac_address`, `name`, `ip_address`: String\n- `has_xdr_agent`: List of strings. Permitted values are: `yes`, `no`, `unknown`, `n/a`.\n- `has_active_external_services`: List of strings. Permitted values are: `yes`, `no`, `unknown`.\n- `type`: List of strings. Permitted values are: `certificate`, `cloud_compute_instance`, `on_prem`, `domain`, `unassociated_responsive_ip`.","oneOf":[{"type":"array","items":{"type":"string"}},{"type":"string"}]}},"required":["field","operator","value"]}},"search_from":{"type":"integer","description":"Represents the start offset index of results.","default":0},"search_to":{"type":"integer","description":"Represents the end offset index of results.","default":500},"sort":{"type":"object","description":"Identifies the sort order for the result set.","properties":{"field":{"type":"string","enum":["name","first_observed","last_observed"],"description":"The field you want to sort by. Case-sensitive.","default":"name"},"keyword":{"type":"string","enum":["ASC","DESC"],"description":"Whether you want to sort in ascending or descending order.","default":"ASC"}},"required":["field","keyword"]}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"Total number of possible results.\nNote: The `total_count` value is limited to 9,999. If the filter returns 10,000 results or more, the value will be 9,999, but you can still use paging until the data finishes.","maximum":9999},"result_count":{"type":"integer","description":"The number of Internet exposure assets actually returned as results."},"assets_internet_exposure":{"type":"array","description":"A list of Internet exposure assets.","items":{"type":"object","properties":{"asm_ids":{"type":"array","items":{"type":"string"}},"name":{"type":"string"},"asset_type":{"type":"string"},"cloud_provider":{"nullable":true},"externally_detected_providers":{"type":"array","items":{"type":"string"}},"region":{"nullable":true},"ips":{"type":"array","items":{"type":"object"}},"business_units":{"type":"array","items":{"type":"string"}},"management_status":{"type":"array","items":{"type":"object"}},"iot_model":{"nullable":true},"iot_category":{"nullable":true},"iot_profile":{"nullable":true},"sensor":{"type":"array","items":{"type":"string"}},"service_type":{"type":"array","items":{"type":"object"}},"last_observed":{"type":"integer"},"first_observed":{"type":"integer"},"has_active_externally_services":{"type":"boolean"},"has_xdr_agent":{"type":"string"},"certificate_classifications":{"type":"array","items":{"type":"object"}},"certificate_issuer":{"nullable":true},"certificate_algorithm":{"nullable":true},"mac_addresses":{"type":"array","items":{"type":"object"}},"cloud_id":{"nullable":true},"ip_ranges":{"type":"array","items":{"type":"object"}},"domain_resolves":{"type":"boolean"},"operation_system":{"nullable":true},"asm_va_score":{"nullable":true},"externally_inferred_cves":{"type":"array","items":{"type":"object"}},"agent_id":{"nullable":true}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Internet Exposure

> Get Internet exposure asset details according to the asset ID. You can send up to 20 IDs.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_asset_internet_exposure":{"post":{"tags":["Attack surface management"],"summary":"Get Internet Exposure","description":"Get Internet exposure asset details according to the asset ID. You can send up to 20 IDs.\n\n**Required license:** Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_asset_internet_exposure","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"asm_id_list":{"type":"array","description":"Represents the asset ID for which you want to get the details.","items":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","description":"JSON object containing the query result.","properties":{"reply":{"type":"object","description":"Asset details according to the asset ID.","properties":{"details":{"type":"array","items":{"type":"object","properties":{"asm_ids":{"type":"string"},"name":{"type":"string"},"type":{"type":"string"},"last_observed":{"type":"integer"},"first_observed":{"type":"integer"},"externally_detected_providers":{"type":"array","items":{"type":"string"}},"created":{"type":"integer"},"ips":{"type":"array","items":{"type":"object"}},"business_units":{"type":"array","items":{"type":"string"}},"active_service_ids":{"type":"array","items":{"type":"object"}},"all_service_ids":{"type":"array","items":{"type":"string"}},"active_external_services_types":{"type":"array","items":{"type":"object"}},"domain":{"nullable":true},"certificate_issuer":{"nullable":true},"certificate_algorithm":{"nullable":true},"certificate_classifications":{"type":"array","items":{"type":"object"}},"resolves":{"type":"boolean"},"details":{"type":"object","properties":{"providerDetails":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"displayName":{"type":"string"}}}},"domain":{"nullable":true},"topLevelAssetMapperDomain":{"nullable":true},"domainAssetType":{"nullable":true},"isPaidLevelDomain":{"type":"boolean"},"domainDetails":{"nullable":true},"dnsZone":{"nullable":true},"latestSampledIp":{"nullable":true},"subdomainMetadata":{"nullable":true},"recentIps":{"type":"array","items":{"type":"object"}},"businessUnits":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"}}}},"certificateDetails":{"nullable":true},"inferredCvesObserved":{"type":"array","items":{"type":"object"}},"ip_ranges":{"type":"object","properties":{"<ip_address>":{"type":"object","properties":{"IP_RANGE_ID":{"type":"string"},"FIRST_IP":{"type":"string"},"LAST_IP":{"type":"string"}}}}}}},"external_services":{"type":"array","items":{"type":"object","properties":{"serviceType":{"type":"string"},"serviceKey":{"type":"string"},"activityStatus":{"type":"string"}}}},"externally_inferred_vulnerability_score":{"nullable":true},"externally_inferred_cves":{"type":"array","items":{"type":"object"}}}}}}}}}}}}}}}}}
```

## Get all External IP Address Ranges

> Get a list of all your Internet exposure filtered by business units and organization handles.\
> \
> The maximum result limit is 1000 ranges.\
> \
> Note: You can send a request to retrieve either \*\*all\*\* or \*\*filtered\*\* results.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_external_ip_address_ranges":{"post":{"summary":"Get all External IP Address Ranges","description":"Get a list of all your Internet exposure filtered by business units and organization handles.\n\nThe maximum result limit is 1000 ranges.\n\nNote: You can send a request to retrieve either **all** or **filtered** results.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_external_ip_address_ranges","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.\n\nAn empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["business_units","organization_handles"],"description":"Identifies the external IP ranges field the filter is matching."},"operator":{"type":"string","enum":["contains","not_contains"],"description":"Identifies the comparison operator you want to use for this filter."},"value":{"type":"string","description":"Value that this filter must match."}},"required":["field","operator","value"]}},"search_from":{"type":"integer","description":"Represents the start offset index of results.","default":0},"search_to":{"type":"integer","description":"Represents the end offset index of results.","default":1000},"sort":{"type":"object","description":"Identifies the sort order for the result set.","properties":{"field":{"type":"string","enum":["Id","first_ip","last_ip"],"description":"Identifies the field you want to sort by. Case-sensitive.","default":"first_ip"},"keyword":{"type":"string","enum":["ASC","DESC"],"description":"Whether you want to sort in ascending (`ASC`) or descending (`DESC`) order. Case-sensitive.","default":"DESC"}},"required":["field","keyword"]}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer","description":"The total number of possible results, value is limited to 9,999.\nNote: `total_count` value is limited. If the filter returns 10,000 results or more, the value will be 9,999, but you still can use paging until the data is finished.","maximum":9999},"result_count":{"type":"integer","description":"The number of external IP ranges actually returned as result."},"external_ip_address_ranges":{"type":"array","description":"A list of external IP address ranges (list).\nEach IP address range is JSON.","items":{"type":"object","properties":{"range_id":{"type":"string"},"first_ip":{"type":"string"},"last_ip":{"type":"string"},"ips_count":{"type":"integer"},"active_responsive_ips_count":{"type":"integer"},"date_added":{"type":"integer"},"business_units":{"type":"array","items":{"type":"string"}},"organization_handles":{"type":"array","items":{"type":"string"}}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Attack surface management"]}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get External IP Address Range

> Get external IP address range details according to the range IDs. You can send up to 100 IDs.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_external_ip_address_range":{"post":{"summary":"Get External IP Address Range","description":"Get external IP address range details according to the range IDs. You can send up to 100 IDs.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_external_ip_address_range","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"range_id_list":{"type":"array","description":"A list of strings representing the range ID for which you want to get the details.","items":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"details":{"type":"array","items":{"type":"object","properties":{"range_id":{"type":"string"},"first_ip":{"type":"string"},"last_ip":{"type":"string"},"ips_count":{"type":"integer"},"active_responsive_ips_count":{"type":"integer"},"date_added":{"type":"integer"},"organization_handles":{"type":"array","items":{"type":"string"}},"details":{"type":"object","properties":{"networkRecords":{"type":"array","items":{"type":"object","properties":{"handle":{"type":"string"},"firstIp":{"type":"string"},"lastIp":{"type":"string"},"name":{"type":"string"},"whoIsServer":{"type":"string"},"lastChanged":{"type":"integer"},"organizationRecords":{"type":"array","items":{"type":"object","properties":{"handle":{"type":"string"},"dateAdded":{"type":"integer"},"address":{"type":"string"},"email":{"type":"string"},"phone":{"type":"string"},"org":{"type":"string"},"formattedName":{"type":"string"},"kind":{"type":"string"},"roles":{"type":"array","items":{"type":"string"}},"lastChanged":{"type":"integer"},"firstRegistered":{"type":"integer"},"remarks":{"type":"string"}}}},"remarks":{"type":"string"}}}}}},"explainers":{"type":"array","items":{"type":"object"}},"ipaddress_version":{"type":"integer"},"business_units":{"type":"array","items":{"type":"string"}}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Attack surface management"]}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get vulnerability tests

> Get a complete or filtered list of vulnerability tests. Results include details about each test, including the number of services confirmed vulnerable.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_vulnerability_tests":{"post":{"summary":"Get vulnerability tests","description":"Get a complete or filtered list of vulnerability tests. Results include details about each test, including the number of services confirmed vulnerable.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_vulnerability_tests","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"\n\n","content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"type":"array","description":"An array of filter fields.","items":{"type":"object","properties":{"field":{"type":"string","enum":["name","status","vulnerability_ids","description","affected_software","cwe_ids","vendor_names","severity_score","epss_score","count_vulnerable_services"],"description":"Identifies the field the filter will match on."},"operator":{"type":"string","description":"Identifies the comparison operator to use for this filter. The following list shows which operator can be used for each filter field:\r\n- `name`: contains, eq, neq\r\n- `status`: eq\r\n- `vulnerability_ids`: contains, not_contains\r\n- `description`: contains\r\n- `affected_software`: contains, not_contains\r\n- `cwe_ids`: contains, not_contains\r\n- `vendor_names`: contains, not_contains\r\n- `severity_score`: eq, neq, gte, lte\r\n- `epss_score`: eq, neq, gte, lte\r\n- `count_vulnerable_services`: eq, neq, gte, lte\r\n"},"value":{"type":"string","description":"Value depends on the filter field used.\r\n- `name`: string e.g. apache\r\n- `status`: Enabled, Disabled\r\n- `vulnerability_ids`: strings in the form of CVE IDs, such as CVE-1, CVE-2\r\n- `description`: string e.g. apache\r\n- `affected_software`: strings\r\n- `cwe_ids`: strings in the form of CWE IDs such as CWE-20\r\n- `vendor_names`: strings such as Cisco, Siemens\r\n- `severity_score`: numbers, such as 2, 3.5\r\n- `epss_score`: numbers, such as 2, 3.5\r\n- `count_vulnerable_services`: integers, such as 1,2,5"}}}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer"},"result_count":{"type":"integer"},"vulnerability_tests":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"vulnerability_ids":{"type":"array","items":{"type":"string"}},"description":{"type":"string"},"status":{"type":"string"},"vendor_names":{"type":"array","items":{"type":"string"}},"affected_software":{"type":"array","items":{"type":"object","properties":{"NAME":{"type":"string"},"VERSION_START_INCLUDING":{"type":"integer","nullable":true},"VERSION_START_EXCLUDING":{"type":"integer","nullable":true},"VERSION_END_INCLUDING":{"type":"integer","nullable":true},"VERSION_END_EXCLUDING":{"type":"string"},"VENDOR":{"type":"string"},"PRODUCT":{"type":"string"},"VERSION":{"type":"string"}}}},"severity_score":{"type":"number"},"cwe_ids":{"type":"array","items":{"type":"string"}},"epss_score":{"type":"number"},"references":{"type":"array","items":{"type":"string"}},"remediation_guidance":{"type":"string"},"first_published":{"type":"integer"},"created":{"type":"integer"},"count_vulnerable_services":{"type":"integer","nullable":true}}}}}}}}}}}},"tags":["Attack surface management"]}}}}
```

## Bulk Update Vulnerability Tests

> Enable or disable vulnerability tests.\
> \
> To view vulnerability test results, use the \[Get All Services]\(<https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/attack-surface-management#post-public\\_api-v1-assets-get\\_external\\_services>) or \[Get Service Details]\(<https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/attack-surface-management#post-public\\_api-v1-assets-get\\_external\\_service>) endpoints.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/bulk_update_vulnerability_tests":{"post":{"tags":["Attack surface management"],"summary":"Bulk Update Vulnerability Tests","description":"Enable or disable vulnerability tests.\n\nTo view vulnerability test results, use the [Get All Services](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/attack-surface-management#post-public_api-v1-assets-get_external_services) or [Get Service Details](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/attack-surface-management#post-public_api-v1-assets-get_external_service) endpoints.\n\n**Required license:** Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on.","operationId":"post-public_api-v1-assets-bulk_update_vulnerability_tests","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","properties":{"test_names":{"type":"array","description":"Names of tests, for example [\"test1\", \"test2\", \"test3\"]\r\n ","items":{"type":"string"}},"status":{"type":"string","enum":["Enabled","Disabled"]}}}}}}}},"responses":{"200":{"description":"OK"}}}}}}
```

## Upload assets to the inventory

> Upload domains (paid-level domains (PLD) and subdomains) and IPv4 address ranges. You can upload up to 500 IP address ranges or domains in each request.\
> \
> You must have \*\*Instance Administrator\*\* permissions to run this endpoint.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/asm_management/upload_asm_data":{"post":{"summary":"Upload assets to the inventory","description":"Upload domains (paid-level domains (PLD) and subdomains) and IPv4 address ranges. You can upload up to 500 IP address ranges or domains in each request.\n\nYou must have **Instance Administrator** permissions to run this endpoint.\n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-asm_management-upload_asm_data","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"request_type":{"type":"string","enum":["Addition"],"description":"The action to take on the specified assets. Currently only `addition` is supported, to add the assets to the inventory."},"asset_type":{"type":"string","enum":["ip_range","domain"],"description":"The type of asset being added."},"asset_identifiers":{"type":"array","description":"A list of one or more assets you want to add to the inventory in the specified asset type.\nFor IP ranges, the accepted format is first-last or CIDR format.\nIndividual IP addresses can be listed using either CIDR notation (for example, 8.8.8.8/32) or first-last format (for example, 8.8.8.8-8.8.8.8).\n","items":{"type":"string"}},"business_units":{"type":"array","description":"List of business unit IDs or names that the assets will be applied to.\nIf the business unit is not specified, the default is the top-level business unit.","items":{"type":"string"}}},"required":["request_type","asset_type","asset_identifiers"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"string"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Payment Required","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Attack surface management"]}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Website Details

> Get details about specific websites based on website IDs. You can submit up to 20 website IDs. \
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_external_website":{"post":{"summary":"Get Website Details","description":"Get details about specific websites based on website IDs. You can submit up to 20 website IDs. \n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_external_website","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"website_id_list":{"type":"array","description":"A list of website IDs representing the websites you want to get details for. \nLimit is 20 website IDs.","minItems":1,"maxItems":20,"items":{"type":"string"}}}}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"details":{"type":"array","items":{"type":"object","properties":{"website_id":{"type":"string"},"host":{"type":"string"},"protocol":{"type":"string"},"is_active":{"type":"string"},"site_categories":{"type":"array","items":{"type":"string"}},"technology_ids":{"type":"array","items":{"type":"string"}},"first_observed":{"type":"integer"},"last_observed":{"type":"integer"},"provider_names":{"type":"array","items":{"type":"string"}},"ips":{"type":"array","items":{"type":"string"}},"port":{"type":"integer"},"active_service_ids":{"type":"array","items":{"type":"string"}},"http_type":{"type":"string"},"security_assessments":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"priority":{"type":"integer"},"score":{"type":"integer"},"securityAssessmentDetails":{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"message":{"type":"string"},"elements":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"value":{"type":"string"}}}}}}},"description":{"type":"string"}}}}}},"rootPageHttpStatusCode":{"type":"string"},"isNonConfiguredHost":{"type":"boolean"},"externally_inferred_vulnerability_score":{"type":"integer"},"externally_inferred_cves":{"type":"array","items":{"type":"string"}},"tags":{"type":"array","items":{"type":"string"}},"assets":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"assetType":{"type":"string"}}}},"technologies":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"version":{"type":"string"},"cpe":{"type":"string"},"categoryIds":{"type":"array","items":{"type":"integer"}},"technologyDetails":{"type":"object","properties":{"confidence":{"type":"integer"},"urls":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"ip":{"type":"string"},"observed":{"type":"integer"}}}},"evidence":{"type":"object","properties":{"impliedBy":{"type":"array","items":{"type":"string"}},"patterns":{"type":"array","items":{"type":"object","properties":{"type":{"type":"string"},"regex":{"type":"string"},"value":{"type":"string"}}}}}}}},"name":{"type":"string"}}}},"third_party_resources":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"type":{"type":"string"},"thirdPartyResourceDetails":{"type":"object","properties":{"observed":{"type":"integer"}}}}}},"forms":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"action":{"type":"string"},"purpose":{"type":"string"},"formDetails":{"type":"object","properties":{"fields":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"maxLength":{"type":"integer"},"required":{"type":"boolean"},"dataType":{"type":"string"}}}}}}}}},"details":{"type":"object","properties":{"ips":{"type":"array","items":{"type":"object","properties":{"ip":{"type":"string"},"lastObserved":{"type":"integer"},"firstObserved":{"type":"integer"}}}},"screenshots":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"ip":{"type":"string"},"size":{"type":"integer"},"observed":{"type":"integer"}}}}}}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Attack surface management"]}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get all Websites

> Get a complete or filtered list of your public-facing websites. \
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_external_websites":{"post":{"summary":"Get all Websites","description":"Get a complete or filtered list of your public-facing websites. \n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_external_websites","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"","required":true,"content":{"application/json":{"schema":{"type":"object","required":["request_data"],"properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields. An empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Array of filter fields. Each JSON object must contain a field, operator, and value.","items":{"type":"object","properties":{"field":{"type":"string","enum":["ips","technology_ids","http_type","is_active","provider_names","tags","active_service_ids","third_party_script_domains","host","authentication","site_categories","business_units_list"],"description":"String that identifies the external service field the filter is matching. Filters are based on the following case-sensitive keywords:"},"operator":{"type":"string","enum":["in","contains","eq","neq","not_contains"],"description":"String that identifies the comparison operator you want to use for this filter. Valid operator keywords and corresponding filter fields are:\n\n- **contains**/**not_contains** - used with `active_service_ids`, `authentication`, `host`, `provider_names`, `site_categories`, `technology_ids`, `third_party_script_domains`\n- **eq**/**ne** - used with `ips`, `host`\n- **in** - used with `is_active`, `http_type`, `tags`"},"value":{"description":"Value that the filter must match. The contents of this field will differ depending on the website field that you specified for this filter:\n\n- host - string\n- is_active - values are `yes` or `no`\n- technology_ids - list of strings\n- provider_names - string\n- site_categories - string\n- active_service_ids - list of strings\n- ips - list of strings\n- tags - list of strings\n- http_type - values are `http_only`, `http_redirects_to_https`, `https_only`\n- third_party_script_domains - list of strings\n- authentication - string\n- business_units_list - list of business unit names","oneOf":[{"type":"string"},{"type":"array","items":{}},{"type":"boolean"}]}}}},"search_from":{"type":"integer","description":"An integer representing the start offset index of results\nDefault value: 0","minimum":0,"default":0},"search_to":{"type":"integer","description":"An integer representing the start offset index of results. Use this field to specify the number of results on a page when using page token pagination.\nDefault value: 500","minimum":0,"default":500},"sort":{"type":"object","description":"Identifies the sort order for the result set. Values are case sensitive. The default sort is defined as `host` and `ASC`.","properties":{"field":{"type":"string","enum":["first_observed","host","last_observed"],"description":"Valid values are:\n- `host`\n- `first_observed`\n- `last_observed`"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Valid values are:\n\n- `ASC` - ascending order\n- `DESC` - descending order\n`ASC` is the default."}}}}}}}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"object","properties":{"total_count":{"type":"integer"},"result_count":{"type":"integer"},"websites":{"type":"array","items":{"type":"object","properties":{"website_id":{"type":"string"},"host":{"type":"string"},"protocol":{"type":"string"},"is_active":{"type":"string"},"site_categories":{"type":"array","items":{"type":"string"}},"technology_ids":{"type":"array","items":{"type":"string"}},"first_observed":{"type":"integer"},"last_observed":{"type":"integer"},"provider_names":{"type":"array","items":{"type":"string"}},"ips":{"type":"array","items":{"type":"string"}},"port":{"type":"integer"},"active_service_ids":{"type":"array","items":{"type":"string"}},"http_type":{"type":"string"},"third_party_script_domains":{"type":"array","items":{"type":"string"}},"security_assessments":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"priority":{"type":"integer"},"score":{"type":"integer"},"securityAssessmentDetails":{"type":"object","properties":{"pages":{"type":"array","items":{"type":"object","properties":{"url":{"type":"string"},"message":{"type":"string"},"elements":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string"},"value":{"type":"string"}}}}}}},"description":{"type":"string"}}}}}},"authentication":{"type":"array","items":{"type":"string"}},"rootPageHttpStatusCode":{"type":"string"},"isNonConfiguredHost":{"type":"boolean"},"externally_inferred_vulnerability_score":{"type":"integer"},"externally_inferred_cves":{"type":"array","items":{"type":"string"}},"tags":{"type":"array","items":{"type":"string"}}}}}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"422":{"description":"Unprocessable Entity","content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"integer","description":"Error code"},"status":{"type":"string","description":"Error name"},"message":{"type":"string","description":"Error message"},"errors":{"type":"object","description":"Errors"}}}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}},"tags":["Attack surface management"]}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get Websites Last Assessment

> Gets the time and status of the last update of websites data in Cortex. A status of "true" indicates the websites data update was successful.\
> \
> \*\*Required license:\*\* Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/assets/get_external_websites/last_external_assessment":{"post":{"tags":["Attack surface management"],"summary":"Get Websites Last Assessment","description":"Gets the time and status of the last update of websites data in Cortex. A status of \"true\" indicates the websites data update was successful.\n\n**Required license:** Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-assets-get_external_websites-last_external_assessment","parameters":[{"name":"Authorization","in":"header","description":"{api_key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api_key_id}","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"An empty dictionary returns the time and status of the last websites assessment."}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"last_external_assessment":{"type":"object","properties":{"status":{"type":"boolean","description":"`True`: Updating website data succeeded.\n`False`: Updating website data failed."},"time":{"type":"string"}}}}}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/reply"}}}}}}}},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## Get all Attack Surface Rules

> Get all or a subset of attack surface rules. \
> \
> \*\*Required license:\*\* Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.<br>

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/get_attack_surface_rules":{"post":{"summary":"Get all Attack Surface Rules","description":"Get all or a subset of attack surface rules. \n\n**Required license:** Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.\n","operationId":"post-public_api-v1-get-attack-surface-rules","parameters":[{"name":"authorization","in":"header","description":"api-key","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"api-key-id","required":true,"schema":{"type":"string"}}],"requestBody":{"description":"","required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetAttackSurfaceRulesRequest"}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetAttackSurfaceRulesResponse"}}}},"400":{"description":"Bad Request. Got an invalid JSON.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"401":{"description":"Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"403":{"description":"Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"422":{"$ref":"#/components/responses/UNPROCESSABLE_ENTITY"},"500":{"description":"Internal server error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}}},"tags":["Attack surface management"]}}},"components":{"schemas":{"GetAttackSurfaceRulesRequest":{"type":"object","properties":{"request_data":{"$ref":"#/components/schemas/GetAttackSurfaceRulesRequestData"}},"required":["request_data"]},"GetAttackSurfaceRulesRequestData":{"type":"object","description":"(Required) A dictionary containing the API request fields.<br />An empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Provides an array of filtered fields. Each JSON object can contain the following keywords:\n  - field\n  - operators\n  - value\n","items":{"$ref":"#/components/schemas/AttackSurfaceRulesFilter"}},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want attack surface rules returned","minimum":0,"default":0},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want attack surface rules returned. <br />Attack surface rules in the alerts list that are indexed higher than this value are not returned in the final results set.","minimum":0,"default":500},"sort":{"$ref":"#/components/schemas/GetAttackSurfaceRulesSort"}}},"AttackSurfaceRulesFilter":{"type":"object","properties":{"field":{"type":"string","enum":["attack_surface_rule_id","category","priority","enabled_status","asm_alert_categories"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\n  - enabled_status\n  - category\n  - priority\n  - attack_surface_rule_id\n  - asm_alert_categories\n"},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. \n  - in\n"},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"GetAttackSurfaceRulesSort":{"type":"object","description":"Identifies the sort order for the result set. By default, the sort is defined as created, DESC.","properties":{"field":{"type":"string","enum":["enabled_status","priority","category","attack_surface_rule_id","attack_surface_rule_name","created"],"default":"created"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Can either be ASC (ascending order) or DESC (descending order).","default":"desc"}}},"GetAttackSurfaceRulesResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/AttackSurfaceRulesPage"}},"required":["reply"]},"AttackSurfaceRulesPage":{"type":"object","properties":{"total_count":{"type":"integer","minimum":0},"result_count":{"type":"integer","minimum":0},"attack_surface_rules":{"type":"array","items":{"$ref":"#/components/schemas/AttackSurfaceRule"}}},"required":["total_count","result_count","attack_surface_rules"]},"AttackSurfaceRule":{"type":"object","properties":{"attack_surface_rule_name":{"type":"string"},"enabled_status":{"type":"string"},"priority":{"type":"string"},"description":{"type":"string"},"attack_surface_rule_id":{"type":"string"},"category":{"type":"string"},"knowledge_base_link":{"type":"string"},"created":{"type":"integer"},"modified":{"type":"integer"},"modified_by":{"type":"string"},"remediation_guidance":{"type":"string"},"asm_alert_categories":{"type":"array","items":{"type":"string"}}},"required":["attack_surface_rule_name","enabled_status","priority","description","attack_surface_rule_id","category","created","modified","remediation_guidance","asm_alert_categories"]},"DefaultApiErrorResponse":{"type":"object","properties":{"reply":{"description":"The query results upon error.","allOf":[{"$ref":"#/components/schemas/GenericReply"}]}},"required":["reply"]},"GenericReply":{"type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"Error code"},"status":{"type":"string","description":"Error name"},"message":{"type":"string","description":"Error message"},"errors":{"type":"object","description":"Errors"}}}},"responses":{"UNPROCESSABLE_ENTITY":{"description":"Unprocessable Entity","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}
```

## Remove Assets

> Remove certificates, domains (paid-level domains and subdomains), and IPv4 address ranges from your inventory. Remove up to 500 certificates, domains, or IP ranges per request.\
> \
> Removed assets appear the Asset Uploads/Removals table with the status \*\*Removed\*\*. Within 24 hours of submitting your request, assets are removed from the inventory. Within a few days, related cases, alerts, and services are also removed.\
> You cannot remove an asset that was uploaded in a previous upload request. \
> \
> When you remove a paid-level domain, related subdomains are also removed. When you remove an IPv4 range, the individual IPv4 addresses in that range are also removed.\
> \
> Required role: Instance Admin \
> \
> \*\*Required license:\*\* Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"tags":[{"name":"Attack surface management","description":"APIs for attack surface management"}],"servers":[{"url":"https://api-yourfqdn"}],"paths":{"/public_api/v1/asm_management/remove_asm_data":{"post":{"summary":"Remove Assets","description":"Remove certificates, domains (paid-level domains and subdomains), and IPv4 address ranges from your inventory. Remove up to 500 certificates, domains, or IP ranges per request.\n\nRemoved assets appear the Asset Uploads/Removals table with the status **Removed**. Within 24 hours of submitting your request, assets are removed from the inventory. Within a few days, related cases, alerts, and services are also removed.\nYou cannot remove an asset that was uploaded in a previous upload request. \n\nWhen you remove a paid-level domain, related subdomains are also removed. When you remove an IPv4 range, the individual IPv4 addresses in that range are also removed.\n\nRequired role: Instance Admin \n\n**Required license:** Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.","operationId":"post-public_api-v1-asm_management-remove_asm_data","parameters":[{"name":"authorization","in":"header","description":"{api-key}","required":true,"schema":{"type":"string"}},{"name":"x-xdr-auth-id","in":"header","description":"{api-key-id}","required":true,"schema":{"type":"string"}}],"requestBody":{"content":{"application/json":{"schema":{"type":"object","properties":{"request_data":{"type":"object","description":"A dictionary containing the API request fields.","properties":{"asset_type":{"type":"string","enum":["certificate","domain","ip_range"],"description":"The type of asset being removed."},"asset_identifiers":{"type":"array","description":"A list of one or more assets you want to add to the inventory. Note the following:\n- All assets in a request must be of the same asset type.\n- For IP ranges, the accepted format is first-last or CIDR format. \n- Individual IP addresses can be listed using either CIDR notation (for example, 8.8.8.8/32) or first-last format (for example, 8.8.8.8-8.8.8.8).","items":{"type":"string"}}},"required":["asset_type","asset_identifiers"]}},"required":["request_data"]}}}},"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"reply":{"type":"string"}}}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"401":{"description":"Unauthorized. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"402":{"description":"Unauthorized access. User does not have the required license type to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"403":{"description":"Forbidden access.  The provided API Key does not have the required RBAC permissions to run this API.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}},"422":{"description":"Unprocessable Entity ","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"500":{"description":"Internal Server Error. A unified status for API communication type errors.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DefaultApiErrorResponse"}}}}},"tags":["Attack surface management"]}}},"components":{"schemas":{"DefaultApiErrorResponse":{"type":"object","properties":{"reply":{"description":"The query results upon error.","allOf":[{"$ref":"#/components/schemas/GenericReply"}]}},"required":["reply"]},"GenericReply":{"type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}},"Error":{"type":"object","properties":{"code":{"type":"integer","description":"Error code"},"status":{"type":"string","description":"Error name"},"message":{"type":"string","description":"Error message"},"errors":{"type":"object","description":"Errors"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/attack-surface-management.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.