Attack Surface Management
APIs for attack surface management
Get service details according to the service ID. You can send up to 20 IDs.
Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_external_service HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"request_data": {
"service_id_list": [
"text"
]
}
}{
"reply": {
"details": [
{
"service_id": "text",
"service_name": "text",
"service_type": "text",
"ip_address": [
"text"
],
"domain": [
{}
],
"externally_detected_providers": [
"text"
],
"is_active": "text",
"first_observed": 1,
"last_observed": 1,
"port": 1,
"protocol": "text",
"active_classifications": [
"text"
],
"inactive_classifications": [
{}
],
"discovery_type": "text",
"business_units": [
"text"
],
"externally_inferred_vulnerability_score": {},
"externally_inferred_cves": [
{}
],
"details": {
"serviceKey": "text",
"serviceKeyType": "text",
"businessUnits": [
{
"name": "text"
}
],
"providerDetails": [
{
"name": "text",
"firstObserved": 1,
"lastObserved": 1
}
],
"certificates": [
{
"certificate": {
"issuer": "text",
"issuerAlternativeNames": "text",
"issuerCountry": "text",
"issuerEmail": null,
"issuerLocality": "text",
"issuerName": "text",
"issuerOrg": "text",
"formattedIssuerOrg": "text",
"issuerOrgUnit": "text",
"issuerState": "text",
"publicKey": "text",
"publicKeyAlgorithm": "text",
"publicKeyRsaExponent": 1,
"signatureAlgorithm": "text",
"subject": "text",
"subjectAlternativeNames": "text",
"subjectCountry": "text",
"subjectEmail": "text",
"subjectLocality": "text",
"subjectName": "text",
"subjectOrg": "text",
"subjectOrgUnit": "text",
"subjectState": "text",
"serialNumber": "text",
"validNotBefore": 1,
"validNotAfter": 1,
"version": "text",
"publicKeyBits": 1,
"publicKeyModulus": "text",
"publicKeySpki": "text",
"sha1Fingerprint": "text",
"sha256Fingerprint": "text",
"md5Fingerprint": "text"
},
"activityStatus": "text",
"lastObserved": 1,
"firstObserved": 1
}
],
"domains": [
{}
],
"ips": [
{
"ip": "text",
"protocol": "text",
"provider": "text",
"geolocation": {
"latitude": 1,
"longitude": 1,
"countryCode": "text",
"city": "text",
"regionCode": "text",
"timeZone": 1
},
"activityStatus": "text",
"lastObserved": 1,
"firstObserved": 1
}
],
"classifications": [
{
"name": "text",
"activityStatus": "text",
"values": [
{
"jsonValue": "text",
"firstObserved": 1,
"lastObserved": 1
}
],
"firstObserved": 1,
"lastObserved": 1
}
],
"tlsVersions": [
{
"tlsVersion": "text",
"cipherSuite": "text",
"firstObserved": 1,
"lastObserved": 1,
"activityStatus": "text"
}
],
"inferredCvesObserved": [
{}
],
"enrichedObservationSource": "text",
"ip_ranges": {}
}
}
]
}
}Get a complete or filtered list of all your external services.
The maximum result limit is 500.
Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
api-key
api-key-id
OK
Bad Request. Got invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_external_services HTTP/1.1
Host: api-yourfqdn
authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 108
{
"request_data": {
"filters": [
{
"field": "string",
"operator": "string",
"value": "string"
}
],
"use_page_token": true
}
}{
"reply": {
"total_count": 0,
"result_count": 0,
"external_services": [
{
"service_id": "string",
"service_name": "string",
"service_type": "string",
"ip_address": [
"string"
],
"domain": [
"string"
],
"externally_detected_providers": [
"string"
],
"is_active": "string",
"first_observed": 0,
"last_observed": 0,
"port": 0,
"protocol": "string",
"active_classifications": [
"string"
],
"inactive_classifications": [
"string"
],
"discovery_type": "string",
"business_units": [
"string"
],
"externally_inferred_vulnerability_score": "null",
"externally_inferred_cves": [
{}
],
"tls_versions": [
{}
],
"inferred_cves_observed": [
{}
],
"cloud_management_status": "null"
}
]
}
}Get a list of all your Internet exposure filtered by business units, externally detected providers, externally inferred CVEs, mac addresses, names, IP addresses, whether it has an XDR agent, whether it has active external services, and type.
The maximum result limit is 500 assets.
Note: You can send a request to retrieve either all or filtered results.
Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_assets_internet_exposure HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 260
{
"request_data": {
"filters": [
{
"field": "has_xdr_agent",
"operator": "in",
"value": [
"n/a",
"false",
"true"
]
},
{
"field": "has_active_external_services",
"operator": "in",
"value": [
"false"
]
}
],
"search_from": 0,
"search_to": 500,
"sort": {
"field": "last_observed",
"keyword": "DESC"
}
}
}{
"reply": {
"total_count": 1,
"result_count": 1,
"assets_internet_exposure": [
{
"asm_ids": [
"text"
],
"name": "text",
"asset_type": "text",
"cloud_provider": null,
"externally_detected_providers": [
"text"
],
"region": null,
"ips": [
{}
],
"business_units": [
"text"
],
"management_status": [
{}
],
"iot_model": null,
"iot_category": null,
"iot_profile": null,
"sensor": [
"text"
],
"service_type": [
{}
],
"last_observed": 1,
"first_observed": 1,
"has_active_externally_services": true,
"has_xdr_agent": "text",
"certificate_classifications": [
{}
],
"certificate_issuer": null,
"certificate_algorithm": null,
"mac_addresses": [
{}
],
"cloud_id": null,
"ip_ranges": [
{}
],
"domain_resolves": true,
"operation_system": null,
"asm_va_score": null,
"externally_inferred_cves": [
{}
],
"agent_id": null
}
]
}
}Get Internet exposure asset details according to the asset ID. You can send up to 20 IDs.
Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
JSON object containing the query result.
POST /public_api/v1/assets/get_asset_internet_exposure HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 41
{
"request_data": {
"asm_id_list": [
"text"
]
}
}OK
{
"reply": {
"details": [
{
"asm_ids": "<id>",
"name": "<name>",
"type": "ResponsiveIP",
"last_observed": 1648590706000,
"first_observed": 1646738134000,
"externally_detected_providers": [
"On Prem"
],
"created": 1646959543881,
"ips": [],
"business_units": [
"Test"
],
"active_service_ids": [],
"all_service_ids": [
"<id>"
],
"active_external_services_types": [],
"domain": null,
"certificate_issuer": null,
"certificate_algorithm": null,
"certificate_classifications": [],
"resolves": false,
"details": {
"providerDetails": [
{
"name": "OnPrem",
"displayName": "On Prem"
}
],
"domain": null,
"topLevelAssetMapperDomain": null,
"domainAssetType": null,
"isPaidLevelDomain": false,
"domainDetails": null,
"dnsZone": null,
"latestSampledIp": null,
"subdomainMetadata": null,
"recentIps": [],
"businessUnits": [
{
"name": "Test"
}
],
"certificateDetails": null,
"inferredCvesObserved": [],
"ip_ranges": {
"52.14.147.179": {
"IP_RANGE_ID": "<range>",
"FIRST_IP": "<ip_address>",
"LAST_IP": "<ip_address>"
}
}
},
"external_services": [
{
"serviceType": "SshServer",
"serviceKey": "<key>",
"activityStatus": "Inactive"
}
],
"externally_inferred_vulnerability_score": null,
"externally_inferred_cves": []
}
]
}
}Get a list of all your Internet exposure filtered by business units and organization handles.
The maximum result limit is 1000 ranges.
Note: You can send a request to retrieve either all or filtered results.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_external_ip_address_ranges HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 131
{
"request_data": {
"filters": [
{
"field": "organization_handles",
"operator": "contains",
"value": "irt"
}
],
"search_from": 0,
"search_to": 500
}
}{
"reply": {
"total_count": 2,
"result_count": 2,
"external_ip_address_ranges": [
{
"range_id": "<range_id>",
"first_ip": "<ip_address>",
"last_ip": "<ip_address>",
"ips_count": 8,
"active_responsive_ips_count": 0,
"date_added": 1649644918955,
"business_units": [
"Test - Acme Supply"
],
"organization_handles": [
"MAINT-YY",
"IRT-PCCW",
"BNA2-YY",
"AP-AP",
"TA-AP"
]
},
{
"range_id": "<range_id>",
"first_ip": "<ip_address>",
"last_ip": "<ip_address>",
"ips_count": 32768,
"active_responsive_ips_count": 0,
"date_added": 1649644918955,
"business_units": [
"Test - Acme Supply"
],
"organization_handles": [
"IA-AP",
"IRT-P",
"AP-AP",
"MAINT-HK",
"NIC-HM",
"ORG-AP"
]
}
]
}
}Get external IP address range details according to the range IDs. You can send up to 100 IDs.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_external_ip_address_range HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 49
{
"request_data": {
"range_id_list": [
"<range_ID>"
]
}
}{
"reply": {
"details": [
{
"range_id": "text",
"first_ip": "text",
"last_ip": "text",
"ips_count": 1,
"active_responsive_ips_count": 1,
"date_added": 1,
"organization_handles": [
"text"
],
"details": {
"networkRecords": [
{
"handle": "text",
"firstIp": "text",
"lastIp": "text",
"name": "text",
"whoIsServer": "text",
"lastChanged": 1,
"organizationRecords": [
{
"handle": "text",
"dateAdded": 1,
"address": "text",
"email": "text",
"phone": "text",
"org": "text",
"formattedName": "text",
"kind": "text",
"roles": [
"text"
],
"lastChanged": 1,
"firstRegistered": 1,
"remarks": "text"
}
],
"remarks": "text"
}
]
},
"explainers": [
{}
],
"ipaddress_version": 1,
"business_units": [
"text"
]
}
]
}
}Get a complete or filtered list of vulnerability tests. Results include details about each test, including the number of services confirmed vulnerable.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
POST /public_api/v1/assets/get_vulnerability_tests HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 86
{
"request_data": {
"filters": [
{
"field": "name",
"operator": "contains",
"value": "apache"
}
]
}
}OK
{
"reply": {
"total_count": 1,
"result_count": 1,
"vulnerability_tests": [
{
"id": "69527826-e1c5-42d8-b8d8-2c2005b75cbe",
"name": "Apache Solr DataImportHandler Code Injection Vulnerability",
"vulnerability_ids": [
"CVE-2019-0193"
],
"description": "Apache Solr, a popular open-source search platform built on Apache Lucene, is affected by a remote code execution vulnerability. Solr's DataImportHandler (DIH), an optional module widely used to import data from databases and other sources, allows the entire DIH configuration to come from a request's \"dataConfig\" parameter. The debug mode of the DIH admin screen uses this feature for convenient debugging and development of a DIH configuration. However, since a DIH configuration can contain scripts, this parameter poses a security risk. The affected products can potentially be exposed to the public internet, making them vulnerable to exploitation.\n",
"status": "DISABLED",
"vendor_names": [
"apache"
],
"affected_software": [
{
"NAME": "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*",
"VERSION_START_INCLUDING": null,
"VERSION_START_EXCLUDING": null,
"VERSION_END_INCLUDING": null,
"VERSION_END_EXCLUDING": "8.2.0",
"VENDOR": "apache",
"PRODUCT": "solr",
"VERSION": "*"
}
],
"severity_score": 7.2,
"cwe_ids": [
"CWE-94"
],
"epss_score": 0.9605,
"references": [
"https://issues.apache.org/jira/browse/SOLR-13669"
],
"remediation_guidance": "Exploiting this vulnerability may lead to remote code execution, which could compromise the security and integrity of the affected system. To address this issue, follow these steps:\n\n1. Upgrade to Apache Solr 8.2.0 or later, which is secure by default.\n2. Alternatively, edit the solrconfig.xml to configure all DataImportHandler usages with an \"invariants\" section listing the \"dataConfig\" parameter set to an empty string.\n3. Ensure your network settings are configured so that only trusted traffic communicates with Solr, especially to the DIH request handler. This is a best practice for all Solr installations.\n\nBy implementing these fixes and mitigations, you can protect your Apache Solr installation from the remote code execution vulnerability described in CVE-2019-0193.\n",
"first_published": 1699326060000,
"created": 1711058940000,
"count_vulnerable_services": null
}
]
}
}Enable or disable vulnerability tests.
To view vulnerability test results, use the Get All Services or Get Service Details endpoints.
Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the Cortex Cloud Posture Management add-on.
{api_key}
{api_key_id}
OK
No content
POST /public_api/v1/assets/bulk_update_vulnerability_tests HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 113
{
"request_data": {
"test_names": [
"Apache Solr DataImportHandler Code Injection Vulnerability"
],
"status": "Enabled"
}
}OK
No content
Upload domains (paid-level domains (PLD) and subdomains) and IPv4 address ranges. You can upload up to 500 IP address ranges or domains in each request.
You must have Instance Administrator permissions to run this endpoint.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
Bad Request
Unauthorized
Payment Required
Forbidden
Internal Server Error
POST /public_api/v1/asm_management/upload_asm_data HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 136
{
"request_data": {
"request_type": "Addition",
"asset_type": "ip_range",
"asset_identifiers": [
"192.84.12.55-192.84.12.68",
"12.156.37.64/27"
]
}
}{
"reply": "succeeded"
}Get details about specific websites based on website IDs. You can submit up to 20 website IDs.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_external_website HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"request_data": {
"website_id_list": [
"text"
]
}
}{
"reply": {
"details": [
{
"website_id": "text",
"host": "text",
"protocol": "text",
"is_active": "text",
"site_categories": [
"text"
],
"technology_ids": [
"text"
],
"first_observed": 1,
"last_observed": 1,
"provider_names": [
"text"
],
"ips": [
"text"
],
"port": 1,
"active_service_ids": [
"text"
],
"http_type": "text",
"security_assessments": [
{
"name": "text",
"priority": 1,
"score": 1,
"securityAssessmentDetails": {
"pages": [
{
"url": "text",
"message": "text",
"elements": [
{
"name": "text",
"value": "text"
}
]
}
],
"description": "text"
}
}
],
"rootPageHttpStatusCode": "text",
"isNonConfiguredHost": true,
"externally_inferred_vulnerability_score": 1,
"externally_inferred_cves": [
"text"
],
"tags": [
"text"
],
"assets": [
{
"id": "text",
"name": "text",
"assetType": "text"
}
],
"technologies": [
{
"id": "text",
"version": "text",
"cpe": "text",
"categoryIds": [
1
],
"technologyDetails": {
"confidence": 1,
"urls": [
{
"url": "text",
"ip": "text",
"observed": 1
}
],
"evidence": {
"impliedBy": [
"text"
],
"patterns": [
{
"type": "text",
"regex": "text",
"value": "text"
}
]
}
},
"name": "text"
}
],
"third_party_resources": [
{
"url": "text",
"type": "text",
"thirdPartyResourceDetails": {
"observed": 1
}
}
],
"forms": [
{
"url": "text",
"action": "text",
"purpose": "text",
"formDetails": {
"fields": [
{
"name": "text",
"maxLength": 1,
"required": true,
"dataType": "text"
}
]
}
}
],
"details": {
"ips": [
{
"ip": "text",
"lastObserved": 1,
"firstObserved": 1
}
],
"screenshots": [
{
"url": "text",
"ip": "text",
"size": 1,
"observed": 1
}
]
}
}
]
}
}Get a complete or filtered list of your public-facing websites.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Unprocessable Entity
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_external_websites HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 151
{
"request_data": {
"filters": [
{
"field": "ips",
"operator": "in",
"value": "string"
}
],
"search_from": 0,
"search_to": 500,
"sort": {
"field": "host",
"keyword": "asc"
}
}
}{
"reply": {
"total_count": 1,
"result_count": 1,
"websites": [
{
"website_id": "text",
"host": "text",
"protocol": "text",
"is_active": "text",
"site_categories": [
"text"
],
"technology_ids": [
"text"
],
"first_observed": 1,
"last_observed": 1,
"provider_names": [
"text"
],
"ips": [
"text"
],
"port": 1,
"active_service_ids": [
"text"
],
"http_type": "text",
"third_party_script_domains": [
"text"
],
"security_assessments": [
{
"name": "text",
"priority": 1,
"score": 1,
"securityAssessmentDetails": {
"pages": [
{
"url": "text",
"message": "text",
"elements": [
{
"name": "text",
"value": "text"
}
]
}
],
"description": "text"
}
}
],
"authentication": [
"text"
],
"rootPageHttpStatusCode": "text",
"isNonConfiguredHost": true,
"externally_inferred_vulnerability_score": 1,
"externally_inferred_cves": [
"text"
],
"tags": [
"text"
]
}
]
}
}Gets the time and status of the last update of websites data in Cortex. A status of "true" indicates the websites data update was successful.
Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api_key}
{api_key_id}
An empty dictionary returns the time and status of the last websites assessment.
OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/assets/get_external_websites/last_external_assessment HTTP/1.1
Host: api-yourfqdn
Authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 19
{
"request_data": {}
}{
"last_external_assessment": {
"status": true,
"time": "text"
}
}Get all or a subset of attack surface rules.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise Plus. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
api-key
{{api_key}}api-key-id
{{api_key_id}}OK
Bad Request. Got an invalid JSON.
Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Unprocessable Entity
Internal server error. A unified status for API communication type errors.
POST /public_api/v1/get_attack_surface_rules HTTP/1.1
Host: api-yourfqdn
authorization: {{api_key}}
x-xdr-auth-id: {{api_key_id}}
Content-Type: application/json
Accept: */*
Content-Length: 172
{
"request_data": {
"filters": [
{
"field": "attack_surface_rule_id",
"operator": "in",
"value": "text"
}
],
"search_from": 0,
"search_to": 500,
"sort": {
"field": "created",
"keyword": "desc"
}
}
}{
"reply": {
"total_count": 1,
"result_count": 1,
"attack_surface_rules": [
{
"attack_surface_rule_name": "text",
"enabled_status": "text",
"priority": "text",
"description": "text",
"attack_surface_rule_id": "text",
"category": "text",
"knowledge_base_link": "text",
"created": 1,
"modified": 1,
"modified_by": "text",
"remediation_guidance": "text",
"asm_alert_categories": [
"text"
]
}
]
}
}Remove certificates, domains (paid-level domains and subdomains), and IPv4 address ranges from your inventory. Remove up to 500 certificates, domains, or IP ranges per request.
Removed assets appear the Asset Uploads/Removals table with the status Removed. Within 24 hours of submitting your request, assets are removed from the inventory. Within a few days, related cases, alerts, and services are also removed. You cannot remove an asset that was uploaded in a previous upload request.
When you remove a paid-level domain, related subdomains are also removed. When you remove an IPv4 range, the individual IPv4 addresses in that range are also removed.
Required role: Instance Admin
Required license: Cortex XSIAM Premium. In Cortex XSIAM Enterprise and Cortex NG SIEM, requires the ASM add-on.
{api-key}
{api-key-id}
OK
Bad Request
Unauthorized. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.
Unauthorized access. User does not have the required license type to run this API.
Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.
Unprocessable Entity
Internal Server Error. A unified status for API communication type errors.
POST /public_api/v1/asm_management/remove_asm_data HTTP/1.1
Host: api-yourfqdn
authorization: text
x-xdr-auth-id: text
Content-Type: application/json
Accept: */*
Content-Length: 74
{
"request_data": {
"asset_type": "certificate",
"asset_identifiers": [
"text"
]
}
}{
"reply": "text"
}Last updated
Was this helpful?