> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/models.md).

# Models

## The EditPreventionPolicyRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"EditPreventionPolicyRequest":{"type":"object","required":["request_data"],"properties":{"request_data":{"$ref":"#/components/schemas/EditPreventionPolicyRequestData"}}},"EditPreventionPolicyRequestData":{"type":"object","required":["edit_requests"],"properties":{"edit_requests":{"type":"array","minItems":1,"description":"List of policy rule edits to apply. All edits are validated before any change is persisted.\n","items":{"$ref":"#/components/schemas/PreventionPolicyEditParameters"}}}},"PreventionPolicyEditParameters":{"type":"object","required":["id"],"properties":{"id":{"type":"string","minLength":32,"maxLength":32,"pattern":"^[0-9a-fA-F]{32}$","description":"32-character hexadecimal UUID of the prevention policy rule to edit. Must be an existing rule ID.\n"},"name":{"type":"string","minLength":1,"nullable":true,"description":"New display name for the rule. Must be a non-empty string. Cannot be set on the default (catch-all) rule.\n"},"description":{"type":"string","nullable":true,"description":"New description for the rule. Must be a string (may be empty only if the field is omitted entirely; an explicit empty string is rejected). Cannot be set on the default rule.\n"},"target_filter":{"type":"object","nullable":true,"description":"Replaces the rule's target filter. Must be a valid filter object (see `TargetFilter`). Cannot be set on the default rule. The locked portion of the existing filter is preserved automatically.\n","allOf":[{"$ref":"#/components/schemas/TargetFilter"}]},"exploit_id":{"type":"integer","nullable":true,"description":"ID of the **Exploit** profile to assign to this rule. The profile must exist, be of type `EXPLOIT`, and match the rule's OS platform.\n"},"malware_id":{"type":"integer","nullable":true,"description":"ID of the **Malware** profile to assign to this rule. The profile must exist, be of type `MALWARE`, and match the rule's OS platform.\n"},"restrictions_id":{"type":"integer","nullable":true,"description":"ID of the **Restrictions** profile to assign to this rule. The profile must exist, be of type `RESTRICTIONS`, and match the rule's OS platform.\n"},"agent_settings_id":{"type":"integer","nullable":true,"description":"ID of the **Agent Settings** profile to assign to this rule. The profile must exist, be of type `AGENT_SETTINGS`, and match the rule's OS platform.\n"},"exceptions_id":{"type":"integer","nullable":true,"description":"ID of the **Exceptions** profile to assign to this rule. The profile must exist, be of type `EXCEPTIONS`, and match the rule's OS platform.\n"}}},"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/cortex-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The EditPreventionPolicyRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"EditPreventionPolicyRequestData":{"type":"object","required":["edit_requests"],"properties":{"edit_requests":{"type":"array","minItems":1,"description":"List of policy rule edits to apply. All edits are validated before any change is persisted.\n","items":{"$ref":"#/components/schemas/PreventionPolicyEditParameters"}}}},"PreventionPolicyEditParameters":{"type":"object","required":["id"],"properties":{"id":{"type":"string","minLength":32,"maxLength":32,"pattern":"^[0-9a-fA-F]{32}$","description":"32-character hexadecimal UUID of the prevention policy rule to edit. Must be an existing rule ID.\n"},"name":{"type":"string","minLength":1,"nullable":true,"description":"New display name for the rule. Must be a non-empty string. Cannot be set on the default (catch-all) rule.\n"},"description":{"type":"string","nullable":true,"description":"New description for the rule. Must be a string (may be empty only if the field is omitted entirely; an explicit empty string is rejected). Cannot be set on the default rule.\n"},"target_filter":{"type":"object","nullable":true,"description":"Replaces the rule's target filter. Must be a valid filter object (see `TargetFilter`). Cannot be set on the default rule. The locked portion of the existing filter is preserved automatically.\n","allOf":[{"$ref":"#/components/schemas/TargetFilter"}]},"exploit_id":{"type":"integer","nullable":true,"description":"ID of the **Exploit** profile to assign to this rule. The profile must exist, be of type `EXPLOIT`, and match the rule's OS platform.\n"},"malware_id":{"type":"integer","nullable":true,"description":"ID of the **Malware** profile to assign to this rule. The profile must exist, be of type `MALWARE`, and match the rule's OS platform.\n"},"restrictions_id":{"type":"integer","nullable":true,"description":"ID of the **Restrictions** profile to assign to this rule. The profile must exist, be of type `RESTRICTIONS`, and match the rule's OS platform.\n"},"agent_settings_id":{"type":"integer","nullable":true,"description":"ID of the **Agent Settings** profile to assign to this rule. The profile must exist, be of type `AGENT_SETTINGS`, and match the rule's OS platform.\n"},"exceptions_id":{"type":"integer","nullable":true,"description":"ID of the **Exceptions** profile to assign to this rule. The profile must exist, be of type `EXCEPTIONS`, and match the rule's OS platform.\n"}}},"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/cortex-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The PreventionPolicyEditParameters object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"PreventionPolicyEditParameters":{"type":"object","required":["id"],"properties":{"id":{"type":"string","minLength":32,"maxLength":32,"pattern":"^[0-9a-fA-F]{32}$","description":"32-character hexadecimal UUID of the prevention policy rule to edit. Must be an existing rule ID.\n"},"name":{"type":"string","minLength":1,"nullable":true,"description":"New display name for the rule. Must be a non-empty string. Cannot be set on the default (catch-all) rule.\n"},"description":{"type":"string","nullable":true,"description":"New description for the rule. Must be a string (may be empty only if the field is omitted entirely; an explicit empty string is rejected). Cannot be set on the default rule.\n"},"target_filter":{"type":"object","nullable":true,"description":"Replaces the rule's target filter. Must be a valid filter object (see `TargetFilter`). Cannot be set on the default rule. The locked portion of the existing filter is preserved automatically.\n","allOf":[{"$ref":"#/components/schemas/TargetFilter"}]},"exploit_id":{"type":"integer","nullable":true,"description":"ID of the **Exploit** profile to assign to this rule. The profile must exist, be of type `EXPLOIT`, and match the rule's OS platform.\n"},"malware_id":{"type":"integer","nullable":true,"description":"ID of the **Malware** profile to assign to this rule. The profile must exist, be of type `MALWARE`, and match the rule's OS platform.\n"},"restrictions_id":{"type":"integer","nullable":true,"description":"ID of the **Restrictions** profile to assign to this rule. The profile must exist, be of type `RESTRICTIONS`, and match the rule's OS platform.\n"},"agent_settings_id":{"type":"integer","nullable":true,"description":"ID of the **Agent Settings** profile to assign to this rule. The profile must exist, be of type `AGENT_SETTINGS`, and match the rule's OS platform.\n"},"exceptions_id":{"type":"integer","nullable":true,"description":"ID of the **Exceptions** profile to assign to this rule. The profile must exist, be of type `EXCEPTIONS`, and match the rule's OS platform.\n"}}},"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/cortex-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The TargetFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"TargetFilter":{"type":"object","description":"Defines which endpoints the policy rule targets. The filter is a structured condition tree with a single root connector (`AND` or `OR`).\n\nSee the [Target Filter Fields](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/cortex-platform-papi-tables#target-filter-fields) table for allowed filter fields.\n","properties":{"filterData":{"type":"object","description":"Root of the condition tree. Must contain exactly one key: either `AND` or `OR`.\n","oneOf":[{"$ref":"#/components/schemas/PolicyAndFilter"},{"$ref":"#/components/schemas/PolicyOrFilter"}]}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}}}}}
```

## The PolicyAndFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The PolicyOrFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"PolicyOrFilter":{"type":"object","required":["OR"],"properties":{"OR":{"type":"array","minItems":2,"description":"List of AND-groups (at least two). The rule matches if any group matches.\n","items":{"$ref":"#/components/schemas/PolicyAndFilter"}}}},"PolicyAndFilter":{"type":"object","required":["AND"],"properties":{"AND":{"type":"array","minItems":1,"description":"List of search condition objects (all must match).","items":{"$ref":"#/components/schemas/SearchCondition"}}}},"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The SearchCondition object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SearchCondition":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The endpoint attribute to filter on. Must be one of: `agent_type`, `group_id`, `hostname`, `os_description`, `tags`.\n"},"operator":{"type":"string","description":"Comparison operator. Valid operators depend on the field:\n- `agent_type`: `EQ`, `NEQ`\n- `group_id`: `AGENTS_GROUP_EQ`, `AGENTS_GROUP_NEQ`\n- `hostname`, `os_description`: string operators (e.g. `EQ`, `NEQ`, `CONTAINS`)\n- `tags`: string or list operators\n"},"value":{"description":"The value to compare against. Type depends on the field:\n- `agent_type`: string (AgentType enum value)\n- `group_id`: string (group name)\n- `hostname`, `os_description`: string\n- `tags`: string or array of strings\n","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The SuccessResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SuccessResponse":{"type":"object","properties":{"reply":{"type":"boolean","description":"Always `true` on success."}}}}}}
```

## The ErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"ErrorResponse":{"type":"object","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer","description":"HTTP-aligned error code."},"err_msg":{"type":"string","description":"Human-readable error message."},"err_extra":{"type":"object","description":"Additional context about the error (field names, IDs, invalid values, etc.). Shape varies by error type.\n","additionalProperties":true}}}}}}}}
```

## The reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"reply":{"type":"object","title":"reply","description":"The query result upon error.","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## The violation object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"violation":{"type":"object","title":"violation","properties":{"hostname":{"type":"string"},"username":{"type":"string"},"ip":{"type":"string"},"timestamp":{"type":"integer"},"violation_id":{"type":"integer"},"type":{"type":"string"},"vendor_id":{"type":"string"},"vendor":{"type":"string"},"product_id":{"type":"string"},"product":{"type":"string"},"serial":{"type":"string"},"endpoint_id":{"type":"string"}}}}}}
```

## The GetAttackSurfaceRulesRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetAttackSurfaceRulesRequest":{"type":"object","properties":{"request_data":{"$ref":"#/components/schemas/GetAttackSurfaceRulesRequestData"}},"required":["request_data"]},"GetAttackSurfaceRulesRequestData":{"type":"object","description":"(Required) A dictionary containing the API request fields.<br />An empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Provides an array of filtered fields. Each JSON object can contain the following keywords:\n  - field\n  - operators\n  - value\n","items":{"$ref":"#/components/schemas/AttackSurfaceRulesFilter"}},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want attack surface rules returned","minimum":0,"default":0},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want attack surface rules returned. <br />Attack surface rules in the alerts list that are indexed higher than this value are not returned in the final results set.","minimum":0,"default":500},"sort":{"$ref":"#/components/schemas/GetAttackSurfaceRulesSort"}}},"AttackSurfaceRulesFilter":{"type":"object","properties":{"field":{"type":"string","enum":["attack_surface_rule_id","category","priority","enabled_status","asm_alert_categories"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\n  - enabled_status\n  - category\n  - priority\n  - attack_surface_rule_id\n  - asm_alert_categories\n"},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. \n  - in\n"},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"GetAttackSurfaceRulesSort":{"type":"object","description":"Identifies the sort order for the result set. By default, the sort is defined as created, DESC.","properties":{"field":{"type":"string","enum":["enabled_status","priority","category","attack_surface_rule_id","attack_surface_rule_name","created"],"default":"created"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Can either be ASC (ascending order) or DESC (descending order).","default":"desc"}}}}}}
```

## The GetAttackSurfaceRulesRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetAttackSurfaceRulesRequestData":{"type":"object","description":"(Required) A dictionary containing the API request fields.<br />An empty dictionary returns all results.","properties":{"filters":{"type":"array","description":"Provides an array of filtered fields. Each JSON object can contain the following keywords:\n  - field\n  - operators\n  - value\n","items":{"$ref":"#/components/schemas/AttackSurfaceRulesFilter"}},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want attack surface rules returned","minimum":0,"default":0},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want attack surface rules returned. <br />Attack surface rules in the alerts list that are indexed higher than this value are not returned in the final results set.","minimum":0,"default":500},"sort":{"$ref":"#/components/schemas/GetAttackSurfaceRulesSort"}}},"AttackSurfaceRulesFilter":{"type":"object","properties":{"field":{"type":"string","enum":["attack_surface_rule_id","category","priority","enabled_status","asm_alert_categories"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\n  - enabled_status\n  - category\n  - priority\n  - attack_surface_rule_id\n  - asm_alert_categories\n"},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. \n  - in\n"},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}},"GetAttackSurfaceRulesSort":{"type":"object","description":"Identifies the sort order for the result set. By default, the sort is defined as created, DESC.","properties":{"field":{"type":"string","enum":["enabled_status","priority","category","attack_surface_rule_id","attack_surface_rule_name","created"],"default":"created"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Can either be ASC (ascending order) or DESC (descending order).","default":"desc"}}}}}}
```

## The AttackSurfaceRulesFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"AttackSurfaceRulesFilter":{"type":"object","properties":{"field":{"type":"string","enum":["attack_surface_rule_id","category","priority","enabled_status","asm_alert_categories"],"description":"Identifies the alert field the filter is matching. Filters are based on the following keywords:\n  - enabled_status\n  - category\n  - priority\n  - attack_surface_rule_id\n  - asm_alert_categories\n"},"operator":{"type":"string","enum":["in"],"description":"String that identifies the comparison operator you want to use for this filter. \n  - in\n"},"value":{"description":"Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter","oneOf":[{"type":"string"},{"type":"array","items":{"type":"string"}}]}}}}}}
```

## The GetAttackSurfaceRulesSort object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetAttackSurfaceRulesSort":{"type":"object","description":"Identifies the sort order for the result set. By default, the sort is defined as created, DESC.","properties":{"field":{"type":"string","enum":["enabled_status","priority","category","attack_surface_rule_id","attack_surface_rule_name","created"],"default":"created"},"keyword":{"type":"string","enum":["ASC","asc","DESC","desc"],"description":"Can either be ASC (ascending order) or DESC (descending order).","default":"desc"}}}}}}
```

## The GetAttackSurfaceRulesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetAttackSurfaceRulesResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/AttackSurfaceRulesPage"}},"required":["reply"]},"AttackSurfaceRulesPage":{"type":"object","properties":{"total_count":{"type":"integer","minimum":0},"result_count":{"type":"integer","minimum":0},"attack_surface_rules":{"type":"array","items":{"$ref":"#/components/schemas/AttackSurfaceRule"}}},"required":["total_count","result_count","attack_surface_rules"]},"AttackSurfaceRule":{"type":"object","properties":{"attack_surface_rule_name":{"type":"string"},"enabled_status":{"type":"string"},"priority":{"type":"string"},"description":{"type":"string"},"attack_surface_rule_id":{"type":"string"},"category":{"type":"string"},"knowledge_base_link":{"type":"string"},"created":{"type":"integer"},"modified":{"type":"integer"},"modified_by":{"type":"string"},"remediation_guidance":{"type":"string"},"asm_alert_categories":{"type":"array","items":{"type":"string"}}},"required":["attack_surface_rule_name","enabled_status","priority","description","attack_surface_rule_id","category","created","modified","remediation_guidance","asm_alert_categories"]}}}}
```

## The AttackSurfaceRulesPage object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"AttackSurfaceRulesPage":{"type":"object","properties":{"total_count":{"type":"integer","minimum":0},"result_count":{"type":"integer","minimum":0},"attack_surface_rules":{"type":"array","items":{"$ref":"#/components/schemas/AttackSurfaceRule"}}},"required":["total_count","result_count","attack_surface_rules"]},"AttackSurfaceRule":{"type":"object","properties":{"attack_surface_rule_name":{"type":"string"},"enabled_status":{"type":"string"},"priority":{"type":"string"},"description":{"type":"string"},"attack_surface_rule_id":{"type":"string"},"category":{"type":"string"},"knowledge_base_link":{"type":"string"},"created":{"type":"integer"},"modified":{"type":"integer"},"modified_by":{"type":"string"},"remediation_guidance":{"type":"string"},"asm_alert_categories":{"type":"array","items":{"type":"string"}}},"required":["attack_surface_rule_name","enabled_status","priority","description","attack_surface_rule_id","category","created","modified","remediation_guidance","asm_alert_categories"]}}}}
```

## The AttackSurfaceRule object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"AttackSurfaceRule":{"type":"object","properties":{"attack_surface_rule_name":{"type":"string"},"enabled_status":{"type":"string"},"priority":{"type":"string"},"description":{"type":"string"},"attack_surface_rule_id":{"type":"string"},"category":{"type":"string"},"knowledge_base_link":{"type":"string"},"created":{"type":"integer"},"modified":{"type":"integer"},"modified_by":{"type":"string"},"remediation_guidance":{"type":"string"},"asm_alert_categories":{"type":"array","items":{"type":"string"}}},"required":["attack_surface_rule_name","enabled_status","priority","description","attack_surface_rule_id","category","created","modified","remediation_guidance","asm_alert_categories"]}}}}
```

## The DefaultApiErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"DefaultApiErrorResponse":{"type":"object","properties":{"reply":{"description":"The query results upon error.","allOf":[{"$ref":"#/components/schemas/GenericReply"}]}},"required":["reply"]},"GenericReply":{"type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## The GenericReply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericReply":{"type":"object","properties":{"err_code":{"type":"string","description":"HTTP response code."},"err_msg":{"type":"string","description":"Error message."},"err_extra":{"type":"string","description":"Additional information describing the error."}}}}}}
```

## The Error object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"Error":{"type":"object","properties":{"code":{"type":"integer","description":"Error code"},"status":{"type":"string","description":"Error name"},"message":{"type":"string","description":"Error message"},"errors":{"type":"object","description":"Errors"}}}}}}
```

## The VersionObj object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"VersionObj":{"title":"VersionObj","type":"object","required":["version"],"properties":{"version":{"type":"string","description":"Cortex CLI version"}}}}}}
```

## The NormalizedFields object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"NormalizedFields":{"type":"object","properties":{"xdm.source.location.country":{"type":"string"},"xdm.source.ipv4":{"type":"string"},"xdm.source.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.source.identity.username":{"type":"string"},"xdm.source.process.causality_id":{"type":"string"},"xdm.source.process.command_line":{"type":"string"},"xdm.source.process.executable.filename":{"type":"string"},"xdm.source.process.name":{"type":"string"},"xdm.source.process.executable.path":{"type":"string"},"xdm.source.process.executable.sha256":{"type":"string"},"xdm.source.host.hostname":{"type":"string"},"xdm.source.host.os_family":{"type":"string"},"xdm.source.agent.identifier":{"type":"string"},"xdm.source.agent.installation_id":{"type":"string"},"xdm.source.host.fqdn":{"type":"string"},"xdm.source.process.executable.signature_status":{"type":"string"},"xdm.target.file.filename":{"type":"string"},"xdm.target.module.filename":{"type":"string"},"xdm.target.file.sha256":{"type":"string"},"xdm.target.module.sha256":{"type":"string"},"xdm.target.process.command_line":{"type":"string"},"xdm.target.process.executable.sha256":{"type":"string"},"xdm.target.process.executable.signature_status":{"type":"string"},"xdm.target.process.executable.signer":{"type":"array","items":{"type":"string"}},"xdm.target.process.executable.path":{"type":"array","items":{"type":"string"}},"xdm.target.ipv4":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv4_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.host.ipv6_addresses":{"type":"array","items":{"type":"string"}},"xdm.target.ipv6":{"type":"array","items":{"type":"string"}},"xdm.target.port":{"type":"integer"},"xdm.target.location.country":{"type":"string"},"xdm.target.host.hostname":{"type":"string"},"xdm.target.identity.username":{"type":"string"},"xdm.target.url":{"type":"string"},"xdm.target.process.executable.filename":{"type":"string"},"xdm.target.process.name":{"type":"string"},"xdm.target.agent.identifier":{"type":"string"},"xdm.target.registry.value":{"type":"string"},"xdm.target.registry.data":{"type":"string"},"xdm.target.registry.key":{"type":"string"},"xdm.email.attachment.sha256":{"type":"string"},"xdm.email.attachment.filename":{"type":"string"},"xdm.email.sender":{"type":"string"},"xdm.event.type":{"type":"string"},"xdm.cloud.provider":{"type":"string"},"xdm.cloud.project":{"type":"string"},"xdm.cloud.project_id":{"type":"string"},"xdm.cloud.region":{"type":"string"},"xdm.cloud.function.id":{"type":"string"},"xdm.cloud.function.name":{"type":"string"},"xdm.cloud.function.version":{"type":"string"},"xdm.cloud.function.request_id":{"type":"string"},"xdm.cloud.function.runtime":{"type":"string"},"xdm.observer.unique_identifier":{"type":"string"},"xdm.observer.type":{"type":"string"},"xdm.observer.sub_type":{"type":"string"},"xdm.observer.name":{"type":"string"},"xdm.vulnerability.cve_id":{"type":"string"},"xdm.vulnerability.severity":{"type":"string","enum":["INFO","LOW","MEDIUM","HIGH","CRITICAL"]},"xdm.vulnerability.fix_versions":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cve_risk_factors":{"type":"array","items":{"type":"string"}},"xdm.vulnerability.cvss_score":{"type":"number","format":"float"},"xdm.vulnerability.cvss_vector":{"type":"string"},"xdm.software_package.version":{"type":"string"},"xdm.software_package.purl":{"type":"string"},"xdm.software_package.layer_id":{"type":"string"},"xdm.software_package.type":{"type":"string"},"xdm.software_package.installation_type":{"type":"string"},"xdm.software_package.package_manager":{"type":"string"},"xdm.software_package.dependency_type":{"type":"string"},"xdm.software_package.language":{"type":"string"},"xdm.malware.verdict":{"type":"string"},"xdm.malware.virus_total_link":{"type":"string"},"xdm.malware.layer_id":{"type":"string"},"xdm.secret.secret_type":{"type":"string"},"xdm.secret.unique_identifier":{"type":"string"},"xdm.secret.snippet":{"type":"string"},"xdm.secret.layer_id":{"type":"string"},"xdm.file.filename":{"type":"string"},"xdm.file.path":{"type":"string"},"xdm.file.sha256":{"type":"string"},"xdm.file.size":{"type":"integer"},"xdm.file.last_modified":{"type":"integer"},"xdm.file.metadata_change_time":{"type":"integer"},"xdm.file.owner_id":{"type":"string"},"xdm.file.owner_name":{"type":"string"},"xdm.file.group_id":{"type":"string"},"xdm.file.group_name":{"type":"string"},"xdm.file.permissions.owner":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.group":{"type":"array","items":{"type":"string"}},"xdm.file.permissions.others":{"type":"array","items":{"type":"string"}},"xdm.file.position.start.line":{"type":"integer"},"xdm.file.position.start.character":{"type":"integer"},"xdm.file.position.end.line":{"type":"integer"},"xdm.file.position.end.character":{"type":"integer"},"xdm.url":{"type":"string"},"xdm.domain":{"type":"string"},"xdm.application_protocol":{"type":"string"}}}}}}
```

## The GetDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","additionalProperties":false,"properties":{"search_from":{"type":"integer","minimum":0,"default":0,"description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results."},"search_to":{"type":"integer","minimum":1,"maximum":100,"default":100,"description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (`search_to` - `search_from`). The maximum allowed value is <=100. Requests exceeding this limit will return a 400 error."},"sort":{"$ref":"#/components/schemas/SortingRequest"},"filters":{"type":"array","description":"Array of filter conditions to apply. Multiple filters are combined with either `AND` or `OR` logic.","items":{"$ref":"#/components/schemas/FilterRequest"}}}},"SortingRequest":{"type":"object","description":"Sorting criteria for query results.","additionalProperties":false,"required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`"},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}},"FilterRequest":{"type":"object","description":"Filter condition to apply to the query","additionalProperties":false,"required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`\n"},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering.\n**Note:** The `package_type`, `platform`, and `status` fields are **enum** types and therefore do not support the `contains` or `not_contains` filter operators.\n","enum":["eq","neq","contains","not_contains"]},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `completed`, `in_progress`, or `failed`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, `ios`, `serverless`, or `linux`\n* If the `field` is `package_type`, the `value` can be `standalone`, `kubernetes`, `upgrade`, or `helm` ","nullable":true,"oneOf":[{"type":"string"},{"type":"integer"}]}}}}}}
```

## The SortingRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SortingRequest":{"type":"object","description":"Sorting criteria for query results.","additionalProperties":false,"required":["field","keyword"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`"},"keyword":{"type":"string","enum":["asc","desc"],"description":"Determines the sort order."}}}}}}
```

## The FilterRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"FilterRequest":{"type":"object","description":"Filter condition to apply to the query","additionalProperties":false,"required":["field","operator","value"],"properties":{"field":{"type":"string","minLength":1,"description":"The field name to filter on. Available fields include:\n- `distribution_id`\n- `name`\n- `description`\n- `package_type`\n- `platform`\n- `agent_version`\n- `status`\n"},"operator":{"type":"string","minLength":1,"description":"Comparison operator to use for filtering.\n**Note:** The `package_type`, `platform`, and `status` fields are **enum** types and therefore do not support the `contains` or `not_contains` filter operators.\n","enum":["eq","neq","contains","not_contains"]},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `completed`, `in_progress`, or `failed`\n* If the `field` is `platform`, the `value` can be a string such as `windows`, `macos`, `ios`, `serverless`, or `linux`\n* If the `field` is `package_type`, the `value` can be `standalone`, `kubernetes`, `upgrade`, or `helm` ","nullable":true,"oneOf":[{"type":"string"},{"type":"integer"}]}}}}}}
```

## The PublicGetDataResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"PublicGetDataResponse":{"type":"object","description":"Response object containing the list of distributions and metadata","required":["reply"],"properties":{"reply":{"type":"object","description":"Container object for the response data","properties":{"data":{"type":"array","description":"Array of distribution objects matching the filter criteria","items":{"$ref":"#/components/schemas/Distribution"}},"filter_count":{"type":"integer","description":"Number of distributions returned in the current response after applying filters."},"total_count":{"type":"integer","description":"Total number of distributions available in the system without filters."}}}}},"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```

## The Distribution object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"Distribution":{"type":"object","description":"Represents an agent distribution package/installer","properties":{"distribution_id":{"type":"string","description":"Unique identifier for the distribution"},"name":{"type":"string","description":"Human-readable name of the distribution"},"description":{"type":"string","description":"Detailed description of the distribution, its features, or release notes","nullable":true},"package_type":{"type":"string","description":"Type of installation package"},"platform":{"type":"string","description":"Target operating system or platform"},"agent_version":{"type":"string","description":"Version number of the agent in semantic versioning format"},"status":{"type":"string","description":"Current lifecycle status of the distribution."},"tags":{"type":"array","description":"Array of tags for categorization and filtering","items":{"type":"string"}},"eol_time":{"type":"integer","format":"int64","description":"Unix timestamp in milliseconds (UTC) indicating the date and time when the resource reaches End-of-Life (EOL).","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key ID that created the distribution."},"creation_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was created."},"modification_time":{"type":"integer","description":"Unix timestamp (milliseconds) when the distribution was modified."},"supported_packages":{"type":"array","description":"List of package formats supported by this distribution","items":{"type":"string"}}}}}}}
```

## The Artifact object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"Artifact":{"type":"object","properties":{"artifact_id":{"type":"string","description":"Unique identifier for the artifact"},"file_name":{"type":"string","description":"File name for the artifact"},"file_sha256":{"type":"string","description":"File sha256 for the artifact"},"file_signature_status":{"type":"string","description":"File signature for the artifact"},"file_wildfire_verdict":{"type":"string","description":"File wildfire verdict for the artifact"},"is_malicous":{"type":"boolean","description":"Indicates if the artifact is malicous"},"is_manual":{"type":"boolean","description":"Indicates if the artifact is manual"},"is_process":{"type":"boolean","description":"Indicates if the artifact is related_to_process"},"low_confidence":{"type":"boolean","description":"Indicates the artifact confidence"},"type":{"type":"string","description":"Type of the artifact"}}}}}}
```

## The AndFilterForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"AndFilterForGroups":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}}}}}
```

## The OrFilterForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"OrFilterForGroups":{"required":["OR"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}}}}}
```

## The AndFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}}}}}
```

## The OrFilter object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}}}}}
```

## The Sort object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"Sort":{"type":"array","items":{"$ref":"#/components/schemas/SortObject"}},"SortObject":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field according to which you want the results to be sorted."},"ORDER":{"type":"string","enum":["DESC","ASC"],"description":"Sort order. Valid values include:\n- `ASC` (ascending order)\n- `DESC` (descending order)"}}}}}}
```

## The SortForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SortForGroups":{"type":"array","items":{"$ref":"#/components/schemas/SortObjectForGroups"}},"SortObjectForGroups":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string","enum":["DESC","ASC"]}}}}}}
```

## The SortObjectForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SortObjectForGroups":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string","enum":["DESC","ASC"]}}}}}}
```

## The SortObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SortObject":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field according to which you want the results to be sorted."},"ORDER":{"type":"string","enum":["DESC","ASC"],"description":"Sort order. Valid values include:\n- `ASC` (ascending order)\n- `DESC` (descending order)"}}}}}}
```

## The FilterCondition object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}}}}}
```

## The FilterConditionForGroups object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}}}}}
```

## The AssetGroup object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"AssetGroup":{"type":"object","properties":{"group_name":{"type":"string","description":"Asset Group name"},"group_type":{"type":"string","enum":["Dynamic","Static"],"description":"The type of Asset Group. Valid values include:\n- `Dynamic`: Assets grouped using filters. Any asset that meets the defined criteria is included.\n- `Static`: Manually add individual assets to be included in a group."},"group_description":{"type":"string","description":"Add an optional description to clarify the purpose of the Asset Group."},"membership_predicate":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}],"description":"Define the filter conditions for selecting which assets to be included in a dynamic Asset Group."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}}}}}
```

## The GenericErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```

## The NotFoundErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"NotFoundErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```

## The UnauthorizedErrorResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"UnauthorizedErrorResponse":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}
```

## The GenericAssetGroupsResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericAssetGroupsResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/GenericAssetGroupsResponse_reply"}}},"GenericAssetGroupsResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/GenericAssetGroupsResponse_reply_data"}}},"GenericAssetGroupsResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean"}}}}}}
```

## The CreateAssetGroupResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"CreateAssetGroupResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/CreateAssetGroupResponse_reply"}}},"CreateAssetGroupResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/CreateAssetGroupResponse_reply_data"}}},"CreateAssetGroupResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the Asset Group creation was successful"},"asset_group_id":{"type":"integer","description":"ID of the new Asset Group"}}}}}}
```

## The GenericApiResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericApiResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/GenericApiResponse_reply"}}},"GenericApiResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object"}},"metadata":{"$ref":"#/components/schemas/GenericApiResponse_reply_metadata"}}},"GenericApiResponse_reply_metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}
```

## The SchemaField object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"SchemaField":{"type":"object","properties":{"field_name":{"type":"string","description":"Data model field name"},"field_pretty_name":{"type":"string","description":"Data model pretty field name"},"data_type":{"type":"string","enum":["TEXT","ENUM","INT","JSON","BOOLEAN","TIMESTAMP","FLOAT"],"description":"Data type"}}}}}}
```

## The EnumField object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"EnumField":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The GetSchemaResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetSchemaResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/GetSchemaResponse_reply"}}},"GetSchemaResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/SchemaField"}}}},"SchemaField":{"type":"object","properties":{"field_name":{"type":"string","description":"Data model field name"},"field_pretty_name":{"type":"string","description":"Data model pretty field name"},"data_type":{"type":"string","enum":["TEXT","ENUM","INT","JSON","BOOLEAN","TIMESTAMP","FLOAT"],"description":"Data type"}}}}}}
```

## The EnumValuesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"EnumValuesResponse":{"type":"object","properties":{"reply":{"$ref":"#/components/schemas/EnumValuesResponse_reply"}}},"EnumValuesResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EnumField"}}}},"EnumField":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The assets\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"assets_body":{"type":"object","properties":{"filters":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}]},"on_demand_fields":{"type":"array","items":{"type":"string"}},"sort":{"$ref":"#/components/schemas/Sort"},"search_from":{"type":"integer","description":"An integer representing the starting offset within the query result set from which you want assets returned."},"search_to":{"type":"integer","description":"An integer representing the end offset within the result set after which you do not want assets returned. <br />Assets in the asset inventory that are indexed higher than this value are not returned in the final results set."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"Sort":{"type":"array","items":{"$ref":"#/components/schemas/SortObject"}},"SortObject":{"type":"object","properties":{"FIELD":{"type":"string","description":"The field according to which you want the results to be sorted."},"ORDER":{"type":"string","enum":["DESC","ASC"],"description":"Sort order. Valid values include:\n- `ASC` (ascending order)\n- `DESC` (descending order)"}}}}}}
```

## The assetgroups\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"assetgroups_body":{"type":"object","properties":{"request_data":{"type":"object","properties":{"filters":{"oneOf":[{"$ref":"#/components/schemas/AndFilterForGroups"},{"$ref":"#/components/schemas/OrFilterForGroups"}]},"sort":{"$ref":"#/components/schemas/SortForGroups"},"search_from":{"type":"integer"},"search_to":{"type":"integer"}}}}},"AndFilterForGroups":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"FilterConditionForGroups":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string"},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"]},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"}]}}},"OrFilterForGroups":{"required":["OR"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterConditionForGroups"}}}},"SortForGroups":{"type":"array","items":{"$ref":"#/components/schemas/SortObjectForGroups"}},"SortObjectForGroups":{"type":"object","properties":{"FIELD":{"type":"string"},"ORDER":{"type":"string","enum":["DESC","ASC"]}}}}}}
```

## The assetgroups\_create\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"assetgroups_create_body":{"type":"object","properties":{"request_data":{"type":"object","properties":{"asset_group":{"$ref":"#/components/schemas/AssetGroup"}}}}},"AssetGroup":{"type":"object","properties":{"group_name":{"type":"string","description":"Asset Group name"},"group_type":{"type":"string","enum":["Dynamic","Static"],"description":"The type of Asset Group. Valid values include:\n- `Dynamic`: Assets grouped using filters. Any asset that meets the defined criteria is included.\n- `Static`: Manually add individual assets to be included in a group."},"group_description":{"type":"string","description":"Add an optional description to clarify the purpose of the Asset Group."},"membership_predicate":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}],"description":"Define the filter conditions for selecting which assets to be included in a dynamic Asset Group."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}}}}}
```

## The update\_group\_id\_body object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"update_group_id_body":{"type":"object","properties":{"request_data":{"type":"object","properties":{"asset_group":{"$ref":"#/components/schemas/AssetGroup"}}}}},"AssetGroup":{"type":"object","properties":{"group_name":{"type":"string","description":"Asset Group name"},"group_type":{"type":"string","enum":["Dynamic","Static"],"description":"The type of Asset Group. Valid values include:\n- `Dynamic`: Assets grouped using filters. Any asset that meets the defined criteria is included.\n- `Static`: Manually add individual assets to be included in a group."},"group_description":{"type":"string","description":"Add an optional description to clarify the purpose of the Asset Group."},"membership_predicate":{"anyOf":[{"$ref":"#/components/schemas/AndFilter"},{"$ref":"#/components/schemas/OrFilter"}],"description":"Define the filter conditions for selecting which assets to be included in a dynamic Asset Group."}}},"AndFilter":{"required":["AND"],"type":"object","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}},"FilterCondition":{"type":"object","properties":{"SEARCH_FIELD":{"type":"string","description":"The field you want to filter."},"SEARCH_TYPE":{"type":"string","enum":["EQ","NEQ","GT","LT","GTE","LTE","IN","NIN","RLIKE","NRLIKE","WILDCARD","WILDCARD_NOT","CONTAINS","NCONTAINS","IP_MATCH","NIP_MATCH","ARRAY_CONTAINS","ARRAY_NOT_CONTAINS","IS_EMPTY","NIS_EMPTY","REGEX","REGEX_NOT","REGEX_MATCH","REGEX_NOT_MATCH","IPLIST_MATCH","NLISTIP_MATCH","INCIDR","NINCIDR","INCIDR6","NINCIDR6","RANGE","RELATIVE_TIMESTAMP","JSON_OVERLAPS","JSON_ARRAY_CONTAINED_IN","JSON_IS_NOT_EMPTY"],"description":"The operator to apply to the `SEARCH_FIELD`. It defines how the `SEARCH_VALUE` will be used to evaluate the `SEARCH_FIELD`."},"SEARCH_VALUE":{"oneOf":[{"type":"string"},{"type":"boolean"},{"type":"integer"},{"type":"object"}],"description":"The value that the `SEARCH_FIELD` will be compared to, based on the `SEARCH_TYPE` operator.\nValid values include: EQ`, `IN`, `NIN`, `NEQ`, `IS`, `IS_NOT`, `LIKE_ANY`, `NOT_LIKE_ANY`, `WILDCARD`, `WILDCARD_NOT`, `REGEX`, `REGEX_NOT`, `GT`, `LT`, `GTE`, `LTE`, `RELATIVE_TIMESTAMP`, `RANGE`, `CONTAINS`, `JSON_SEARCH`, `JSON_OVERLAPS`, `JSON_OVERLAPS_NOT`, `NCONTAINS`, `CONTAINS_IN_LIST`, `NOT_CONTAINS_IN_LIST`, `ARRAY_LEN_EQ`, `ARRAY_LEN_NEQ`, `ARRAY_CONTAINS`, `ARRAY_CONTAINS_NUMBERS`, `ARRAY_NOT_CONTAINS`, `JSON_EQ`, `JSON_NEQ`, `JSON_WILDCARD_NOT`, `JSON_WILDCARD`, `JSON_GTE`, `JSON_LTE`, `JSON_GT`, `JSON_LT`, `JSON_CONTAINS_NOT`, `JSON_CONTAINS`, `JSON_ARRAY_CONTAINED_IN`, `JSON_ARRAY_NOT_CONTAINED_IN`, `JSON_ARRAY_CONTAINS`, `JSON_ARRAY_CONTAINS_NOT`, `JSON_IS_EMPTY`, `JSON_IS_NOT_EMPTY`"}}},"OrFilter":{"required":["OR"],"type":"object","properties":{"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterCondition"}}}}}}}
```

## The GenericAssetGroupsResponse\_reply\_data object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericAssetGroupsResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean"}}}}}}
```

## The GenericAssetGroupsResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericAssetGroupsResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/GenericAssetGroupsResponse_reply_data"}}},"GenericAssetGroupsResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean"}}}}}}
```

## The CreateAssetGroupResponse\_reply\_data object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"CreateAssetGroupResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the Asset Group creation was successful"},"asset_group_id":{"type":"integer","description":"ID of the new Asset Group"}}}}}}
```

## The CreateAssetGroupResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"CreateAssetGroupResponse_reply":{"type":"object","properties":{"data":{"$ref":"#/components/schemas/CreateAssetGroupResponse_reply_data"}}},"CreateAssetGroupResponse_reply_data":{"type":"object","properties":{"success":{"type":"boolean","description":"Whether the Asset Group creation was successful"},"asset_group_id":{"type":"integer","description":"ID of the new Asset Group"}}}}}}
```

## The GenericApiResponse\_reply\_metadata object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericApiResponse_reply_metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}
```

## The GenericApiResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GenericApiResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"type":"object"}},"metadata":{"$ref":"#/components/schemas/GenericApiResponse_reply_metadata"}}},"GenericApiResponse_reply_metadata":{"type":"object","properties":{"filter_count":{"type":"integer"},"total_count":{"type":"integer"}}}}}}
```

## The GetSchemaResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetSchemaResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/SchemaField"}}}},"SchemaField":{"type":"object","properties":{"field_name":{"type":"string","description":"Data model field name"},"field_pretty_name":{"type":"string","description":"Data model pretty field name"},"data_type":{"type":"string","enum":["TEXT","ENUM","INT","JSON","BOOLEAN","TIMESTAMP","FLOAT"],"description":"Data type"}}}}}}
```

## The EnumValuesResponse\_reply object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"EnumValuesResponse_reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/EnumField"}}}},"EnumField":{"type":"object","properties":{"NAME":{"type":"string"},"PRETTY_NAME":{"type":"string"}}}}}}
```

## The GetLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetLegacyExceptionDataRequest":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters for fetching legacy exception rules.","required":["request_data"],"properties":{"request_data":{"type":"object","description":"Request body containing pagination, sorting, and filtering parameters.","properties":{"search_from":{"type":"integer","description":"Starting index for pagination (zero-based). Defines the offset from which to begin returning results.","default":0,"minimum":0},"search_to":{"type":"integer","description":"Ending index for pagination (exclusive). Defines the maximum number of results to return (search_to - search_from).","minimum":1,"default":100},"sort":{"type":"object","description":"Defines sorting criteria for query results.","required":["field","keyword"],"properties":{"field":{"type":"string","description":"Field name to sort by. For example, `id`, `rule_name`, `platform`, `modification_time`, `status`, and `user_email`."},"keyword":{"type":"string","description":"Determines the sort order.","enum":["asc","desc"]}}},"filters":{"type":"array","description":"List of filter conditions. Multiple filters are combined with AND logic.","items":{"type":"object","required":["field","operator","value"],"properties":{"field":{"type":"string","description":"The field name to filter on. For example, `id`, `rule_name`, `platform`, `status`, `created_by`, `user_email`, `module` and `profile_ids`."},"operator":{"type":"string","description":"The comparison operator. Most fields support `eq` operator. The `module` and `profile_ids` fields support `in` operator."},"value":{"description":"The value to compare against. Type should match the field type.\nCan be a string or number depending on the operator.\n**Examples:**\n* If the `field` is `status`, the `value` can be `ENABLED` or `DISABLED`\n* If the `field` is `platform`, the `value` can be a string such as `Windows`, `macOS`, or `Linux`","oneOf":[{"type":"string"},{"type":"integer"}]}}}}}}}}}}}
```

## The AddLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"AddLegacyExceptionDataRequest":{"type":"object","description":"Request body for creating a legacy exception rule.","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule.","minLength":1,"maxLength":128},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [Get Legacy Exceptions Modules](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [Get Legacy Exceptions Modules](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint.","minimum":1},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [Get Profiles](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule.","nullable":true},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}
```

## The EditLegacyExceptionDataRequest object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"EditLegacyExceptionDataRequest":{"type":"object","description":"Request body for editing or updating an existing legacy exception rule.","required":["exception_id","update_data"],"properties":{"exception_id":{"type":"string","description":"The ID of the legacy exception to edit. Corresponds to the `id` field returned by the fetch API."},"update_data":{"type":"object","required":["name","platform","module","profile_ids","status","scope","conditions"],"properties":{"name":{"type":"string","description":"Name for the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception. Must be one of the platforms supported by the chosen module (see [Get Legacy Exceptions Modules](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint response)."},"module":{"type":"integer","description":"Numeric ID of the protection module to create the exception for. Get valid module IDs from [Get Legacy Exceptions Modules](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception rule applies to. Use [Get Profiles](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-endpoints-get_profiles) endpoint to find existing profile IDs.\n- For `scope: PROFILE`: provide one or more profile IDs (e.g. `[29]`)\n- For `scope: GLOBAL`: must be an empty array `[]`","items":{"type":"integer"}},"status":{"type":"string","description":"Status of the rule.\nAllowed values: `ENABLED` or `DISABLED`."},"scope":{"type":"string","description":"Scope of the exception:\n- `PROFILE` — exception applies to specific prevention profiles listed in `profile_ids`\n- `GLOBAL` — exception applies globally; `profile_ids` must be `[]` and the module must be an **Exception**-type module"},"description":{"type":"string","description":"Optional description of the exception rule."},"conditions":{"type":"object","description":"The conditions structure depends on the chosen `module`. Use [Get Legacy Exceptions Modules](https://app.gitbook.com/s/1ZrobAtcwfCDWAJAWeuj/cortex-platform/endpoint-management#post-public_api-v1-legacy_exceptions-get_modules) endpoint to get the `conditions_definition` for each module."}}}}}}}}
```

## The GetPublicLegacyExceptionResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetPublicLegacyExceptionResponse":{"type":"object","title":"Get Legacy Exception Response","description":"A legacy exception record as returned by the fetch API.","properties":{"reply":{"type":"object","properties":{"DATA":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the legacy exception rule."},"rule_name":{"type":"string","description":"Name of the legacy exception rule."},"platform":{"type":"string","description":"Target platform for the exception rule."},"conditions":{"type":"string","description":"Human-readable string representation of the exception conditions. This is a display string only."},"module":{"type":"integer","description":"Numeric ID of the protection module this exception applies to."},"module_name":{"type":"string","description":"Name of the protection module."},"description":{"type":"string","description":"Optional description of the exception rule."},"generating_alert_id":{"description":"ID of the alert that generated this exception, if applicable.","nullable":true},"created_by":{"type":"string","description":"Name of the user or API Key that created the legacy exception rule. **Note**: API-created exception rules show as \"Public API - <key_id>\"."},"modification_time":{"type":"integer","description":"Unix timestamp in milliseconds of the last modification."},"user_email":{"type":"string","description":"Email of the user who created the exception. **Note**: API-created exceptions show `n/a`."},"status":{"type":"string","description":"Indicates the current status of the rule."},"profile_ids":{"type":"array","description":"List of prevention profile IDs this exception is scoped to. Empty array `[]` indicates a GLOBAL scope exception.","items":{"type":"integer"}},"associated_targets":{"type":"array","description":"Describes the endpoint targeting scope of the exception.","items":{"type":"string"}},"is_in_user_scope":{"type":"boolean","description":"Whether the exception is within the current user's RBAC scope."}}}},"FILTER_COUNT":{"type":"integer","description":"The number of rules returned in the current response after applying filters."},"TOTAL_COUNT":{"type":"integer","description":"The total number of rules available that match the filter criteria, regardless of pagination."}}}}}}}}
```

## The GetProfilesRequestData object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetProfilesRequestData":{"title":"GetProfilesRequestData","type":"object","description":"Parameters for the `get_profiles` call","required":["type"],"properties":{"type":{"type":"string","enum":["prevention","extension"],"description":"The category of profiles to retrieve.\n- `prevention` – standard endpoint prevention profiles managed by\n  `ProfilesService` (malware, exploit, restrictions, agent-settings,\n  exceptions, etc.)\n- `extension` – device-control and host-firewall profiles managed by\n  `DeviceControlProfilesService`\n"},"profile_ids":{"type":"array","description":"Optional list of profile IDs to filter by.\nWhen omitted or `null`, all profiles of the requested type are returned.\nWhen provided, only profiles whose `id` is in this list are returned.\nMust be a JSON array; passing a non-array value yields HTTP 400.\n","items":{"type":"integer","format":"int64","nullable":true}}}}}}}
```

## The GetProfilesResponse object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"GetProfilesResponse":{"title":"GetProfilesResponse","type":"object","description":"Successful response envelope","properties":{"reply":{"type":"array","description":"List of matching profile objects.","items":{"$ref":"#/components/schemas/ProfileObject"}}}},"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}}}}}
```

## The ProfileObject object

```json
{"openapi":"3.0.0","info":{"title":"Cortex XSIAM Platform APIs","version":"Cortex XSIAM 3.6"},"components":{"schemas":{"ProfileObject":{"title":"ProfileObject","type":"object","description":"A single endpoint security profile.\n\n**Note**: The fields `is_in_user_scope` and `at_risk` exist in the internal data model but are **always stripped** before the API response is returned and will never appear in the output.","properties":{"id":{"type":"integer","format":"int64","description":"Internal numeric profile ID"},"uuid":{"type":"string","description":"Globally unique profile identifier (UUID v4)"},"name":{"type":"string","description":"Human-readable profile name."},"type":{"type":"string","description":"Target operating system","enum":["AGENT_OS_WINDOWS","AGENT_OS_MAC","AGENT_OS_LINUX","AGENT_OS_ANDROID","AGENT_OS_IOS","AGENT_OS_CAAS_LINUX","AGENT_OS_SERVERLESS"]},"is_default":{"type":"boolean","description":"Whether this is the system-managed default profile for its type and OS"},"is_global":{"type":"boolean","description":"Whether this profile is a global (cross-tenant) profile"},"is_disabled":{"type":"boolean","description":"Whether this profile is currently disabled"},"associated_targets":{"type":"array","description":"Human-readable list of policy rule targets (endpoint groups, tags, and so on.) that reference this profile, rendered as UI-friendly strings.\n`null` when the profile is not referenced by any policy rule.\n","items":{"type":"string","nullable":true}},"usage_count":{"type":"integer","description":"Number of policy rules that reference this profile","format":"int32","nullable":true},"description":{"type":"string","description":"Optional free-text description of the profile","nullable":true},"created_by":{"type":"string","description":"Internal identifier (email or system name) of the creator","nullable":true},"created_by_pretty":{"type":"string","description":"Display name of the creator","nullable":true},"creation_time":{"type":"integer","format":"int64","description":"Profile creation timestamp in Unix epoch milliseconds","nullable":true},"modified_by":{"type":"string","description":"Internal identifier of the last modifier","nullable":true},"modified_by_pretty":{"type":"string","description":"Display name of the last modifier","nullable":true},"modification_time":{"type":"integer","format":"int64","description":"Last modification timestamp in Unix epoch milliseconds","nullable":true},"modules":{"type":"object","description":"JSON object containing the profile's security module configuration.\nThe schema varies by `type` and `platform`. Common top-level keys\nare module names (for example, `malware`, `exploit`, `agent_settings`), \neach containing mode and sub-option settings.\n","nullable":true}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/cortex-platform/models.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.