> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/vulnerability-findings.md).

# Vulnerability Findings

vulnerability finding records (paginated or by ID)

## List vulnerability findings (paginated)

> Returns paginated vulnerability findings — one record per CVE/asset pair.\
> Use \`next\_page\_token\` from the response to fetch subsequent pages.\
> \
> \*\*Filterable fields:\*\* \`ASSET\_NAME\`, \`ASSET\_GROUP\_IDS\`, \`ASSET\_CATEGORY\`,\
> \`CVE\_ID\`, \`CVSS\_SEVERITY\`, \`PLATFORM\_ID\`, \`FIX\_AVAILABLE\`, \`PACKAGE\_IN\_USE\`,\
> \`HAS\_KEV\`, \`EXPLOIT\_LEVEL\`, \`EPSS\_SCORE\`, \`INTERNET\_EXPOSED\`,\
> \`FIRST\_OBSERVED\`, \`LAST\_OBSERVED\`.\
> \
> \*\*Sortable fields:\*\* \`EPSS\_SCORE\`, \`CVSS\_SCORE\`, \`CORTEX\_VULNERABILITY\_RISK\_SCORE\`.\
> \
> \*\*Filter value reference:\*\*\
> \
> When filtering on \`CVSS\_SEVERITY\` or \`EXPLOIT\_LEVEL\` with \`SEARCH\_TYPE\` \`EQ\`, use the following \`SEARCH\_VALUE\` values:\
> \
> \- \`CVSS\_SEVERITY\`: \`SEV\_070\_CRITICAL\`, \`SEV\_060\_HIGH\`, \`SEV\_050\_MEDIUM\`, \`SEV\_040\_LOW\`\
> \- \`EXPLOIT\_LEVEL\`: \`WEAPONIZED\`, \`POC\`, \`NONE\`\
> \
> Note: Response payloads return normalized severity strings (for example, \`HIGH\` or \`LOW\`) that are not valid filter inputs. Always use the \`SEV\_0xx\_\*\` values above when filtering by \`CVSS\_SEVERITY\`.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management

```json
{"openapi":"3.1.0","info":{"title":"Vulnerability Management APIs","version":"Cortex XSIAM 3.5"},"tags":[{"name":"Vulnerability Findings","description":"vulnerability finding records (paginated or by ID)"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/vulnerability-management/v1/vulnerability-finding/search":{"post":{"operationId":"getVulnerabilityFindings","summary":"List vulnerability findings (paginated)","description":"Returns paginated vulnerability findings — one record per CVE/asset pair.\nUse `next_page_token` from the response to fetch subsequent pages.\n\n**Filterable fields:** `ASSET_NAME`, `ASSET_GROUP_IDS`, `ASSET_CATEGORY`,\n`CVE_ID`, `CVSS_SEVERITY`, `PLATFORM_ID`, `FIX_AVAILABLE`, `PACKAGE_IN_USE`,\n`HAS_KEV`, `EXPLOIT_LEVEL`, `EPSS_SCORE`, `INTERNET_EXPOSED`,\n`FIRST_OBSERVED`, `LAST_OBSERVED`.\n\n**Sortable fields:** `EPSS_SCORE`, `CVSS_SCORE`, `CORTEX_VULNERABILITY_RISK_SCORE`.\n\n**Filter value reference:**\n\nWhen filtering on `CVSS_SEVERITY` or `EXPLOIT_LEVEL` with `SEARCH_TYPE` `EQ`, use the following `SEARCH_VALUE` values:\n\n- `CVSS_SEVERITY`: `SEV_070_CRITICAL`, `SEV_060_HIGH`, `SEV_050_MEDIUM`, `SEV_040_LOW`\n- `EXPLOIT_LEVEL`: `WEAPONIZED`, `POC`, `NONE`\n\nNote: Response payloads return normalized severity strings (for example, `HIGH` or `LOW`) that are not valid filter inputs. Always use the `SEV_0xx_*` values above when filtering by `CVSS_SEVERITY`.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","tags":["Vulnerability Findings"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetVulnerabilityFindingsRequest"}}}},"responses":{"200":{"description":"Successful response with vulnerability findings.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetVulnerabilityFindingsResponse"}}}},"400":{"description":"Invalid filter parameters or expired page token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingsErrorResponse"}}}},"429":{"description":"Rate limit exceeded.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingsErrorResponse"}}}}}}}},"components":{"schemas":{"GetVulnerabilityFindingsRequest":{"type":"object","description":"Request body for paginated vulnerability findings search.","properties":{"filter":{"allOf":[{"$ref":"#/components/schemas/FilterBlock"}],"description":"Optional filter block. Filterable fields: `ASSET_NAME`, `ASSET_GROUP_IDS`, `ASSET_CATEGORY`, `CVE_ID`, `CVSS_SEVERITY`, `PLATFORM_ID`, `FIX_AVAILABLE`, `PACKAGE_IN_USE`, `HAS_KEV`, `EXPLOIT_LEVEL`, `EPSS_SCORE`, `INTERNET_EXPOSED`, `FIRST_OBSERVED`, `LAST_OBSERVED`."},"sort":{"type":"array","items":{"$ref":"#/components/schemas/FindingsSortObject"},"description":"Optional sort criteria. Sortable fields: `EPSS_SCORE`, `CVSS_SCORE`, `CORTEX_VULNERABILITY_RISK_SCORE`."},"next_page_token":{"type":"string","description":"Opaque token returned by a previous response to fetch the next page. Omit on the first request."}}},"FilterBlock":{"type":"object","description":"Logical filter block. Supports AND / OR connectors with a list of `FilterTriplet` objects.","properties":{"AND":{"type":"array","items":{"$ref":"#/components/schemas/FilterTriplet"}},"OR":{"type":"array","items":{"$ref":"#/components/schemas/FilterTriplet"}}}},"FilterTriplet":{"type":"object","description":"A single filter condition consisting of a field name, comparison operator, and value.","required":["SEARCH_FIELD","SEARCH_TYPE","SEARCH_VALUE"],"properties":{"SEARCH_FIELD":{"type":"string","description":"Field name to filter on."},"SEARCH_TYPE":{"type":"string","description":"Comparison operator.","enum":["EQ","NEQ","GTE","LTE","CONTAINS","NOT_CONTAINS","IN","NOT_IN","RELATIVE_TIMESTAMP"]},"SEARCH_VALUE":{"description":"Value to compare against. Type depends on the field.","oneOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"type":"array","items":{"type":"string"}}]}}},"FindingsSortObject":{"type":"object","description":"Sort criterion for vulnerability findings.","required":["FIELD","ORDER"],"properties":{"FIELD":{"type":"string","description":"Field to sort by. Allowed values: `EPSS_SCORE`, `CVSS_SCORE`, `CORTEX_VULNERABILITY_RISK_SCORE`."},"ORDER":{"type":"string","enum":["ASC","DESC"]}}},"GetVulnerabilityFindingsResponse":{"type":"object","description":"Paginated response containing vulnerability findings.","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/VulnerabilityFinding"}},"filter_count":{"type":"integer","description":"Total number of findings matching the applied filter."},"total_count":{"type":"integer","description":"Total number of findings across all filters."},"next_page_token":{"type":"string","description":"Present only when additional pages exist. Pass this value as `next_page_token` in the next request."}}}}},"VulnerabilityFinding":{"type":"object","description":"A single vulnerability finding record representing one CVE on one asset. Only publicly allowed fields are returned.","properties":{"platform_id":{"type":"string","description":"Unique platform identifier for this finding."},"asset_id":{"type":"string","description":"Unique asset identifier (SHA-256 hash)."},"asset_name":{"type":"string","description":"Name of the affected asset."},"asset_type":{"type":"string","description":"Type of the asset (e.g. SERVICE, HOST)."},"asset_type_class":{"type":"string","description":"High-level classification of the asset type."},"asset_category":{"type":"string","description":"Category of the asset (e.g. Cloud, Service, Endpoint)."},"asset_group_ids":{"type":"array","items":{"type":"string"},"description":"Asset group identifiers the asset belongs to."},"type_id":{"type":"string","description":"Internal numeric type identifier for the asset."},"cve_id":{"type":"string","description":"CVE identifier."},"cve_description":{"type":"string","description":"Full description of the CVE vulnerability."},"cve_publish_date":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the CVE was published."},"published_date":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the finding was published."},"cvss_score":{"type":"number","format":"float","description":"CVSS base score (0–10)."},"cvss_severity":{"type":"string","description":"CVSS severity rating.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFORMATIONAL","UNKNOWN"]},"epss_score":{"type":"number","format":"float","description":"EPSS probability score (0–1)."},"cortex_vulnerability_risk_score":{"type":"number","format":"float","nullable":true,"description":"Cortex-computed composite risk score for this finding. Null if not yet calculated."},"cve_risk_factors":{"type":"array","items":{"type":"string"},"description":"List of risk factor labels associated with the CVE."},"has_kev":{"type":"boolean","description":"Whether the CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog."},"exploitable":{"type":"boolean","description":"Whether the vulnerability is considered exploitable."},"exploit_level":{"type":"string","description":"Exploit maturity level.","enum":["WEAPONIZED","POC","NO_KNOWN_EXPLOIT","NONE","UNKNOWN"]},"fix_available":{"type":"boolean","description":"Whether a fix is available for this finding."},"fix_versions":{"type":"array","items":{"type":"string"},"description":"List of versions that contain a fix for this CVE."},"fix_date":{"type":"integer","format":"int64","nullable":true,"description":"Unix timestamp (milliseconds) when a fix became available. Null if no fix date is known."},"affected_software":{"type":"string","nullable":true,"description":"Name of the affected software component. Null if not applicable."},"internet_exposed":{"type":"boolean","description":"Whether the asset is exposed to the internet."},"ipv4_addresses":{"type":"array","items":{"type":"string"},"description":"IPv4 addresses associated with the asset."},"ipv6_addresses":{"type":"array","items":{"type":"string"},"description":"IPv6 addresses associated with the asset."},"operating_system":{"type":"string","nullable":true,"description":"Operating system of the asset. Null if not detected."},"os_family":{"type":"string","nullable":true,"description":"OS family of the asset (e.g. Windows, Linux). Null if not detected."},"location":{"type":"string","nullable":true,"description":"Geographic or logical location of the asset. Null if not available."},"provider":{"type":"string","description":"Infrastructure provider for the asset (e.g. ON_PREM, AWS, GCP, AZURE)."},"finding_sources":{"type":"array","items":{"type":"string"},"description":"List of sources that detected this finding."},"source_tags":{"type":"array","items":{"type":"string"},"description":"Tags applied by the detection source."},"has_issue":{"type":"boolean","description":"Whether an issue has been raised for this finding."},"issue_id":{"type":"string","nullable":true,"description":"Identifier of the associated issue, if any."},"remediation":{"type":"string","nullable":true,"description":"Remediation guidance for this finding. Null if not available."},"package_in_use":{"type":"boolean","nullable":true,"description":"Whether the affected package is actively in use on the asset. Null if not applicable."},"package_version":{"type":"string","nullable":true,"description":"Version of the affected package. Null if not applicable."},"package_type":{"type":"string","nullable":true,"description":"Type of the affected package (e.g. npm, pip, deb). Null if not applicable."},"package_purl":{"type":"string","nullable":true,"description":"Package URL (PURL) for the affected package. Null if not applicable."},"package_licenses":{"type":"array","items":{"type":"string"},"description":"Licenses associated with the affected package."},"package_author":{"type":"string","nullable":true,"description":"Author of the affected package. Null if not applicable."},"package_symbols":{"type":"array","items":{"type":"string"},"description":"Symbols exported by the affected package."},"package_file_creation_time":{"type":"integer","format":"int64","nullable":true,"description":"Unix timestamp (milliseconds) when the package file was created. Null if not applicable."},"origin_package_name":{"type":"string","nullable":true,"description":"Name of the originating package. Null if not applicable."},"file_path":{"type":"string","nullable":true,"description":"File path of the affected package on the asset. Null if not applicable."},"application_version":{"type":"string","nullable":true,"description":"Version of the affected application. Null if not applicable."},"image":{"type":"string","nullable":true,"description":"Container image identifier. Null if not a container finding."},"image_name":{"type":"string","nullable":true,"description":"Container image name. Null if not a container finding."},"layer_id":{"type":"string","nullable":true,"description":"Container image layer identifier. Null if not a container finding."},"derived_from_base_image":{"type":"boolean","nullable":true,"description":"Whether the finding originates from a base image layer. Null if not applicable."},"is_derived":{"type":"boolean","description":"Whether this finding is derived from another finding."},"is_root":{"type":"boolean","nullable":true,"description":"Whether this is a root-level finding. Null if not applicable."},"volume_asset_id":{"type":"string","nullable":true,"description":"Asset ID of the associated volume. Null if not applicable."},"volume_path":{"type":"string","nullable":true,"description":"Path within the volume. Null if not applicable."},"partition_id":{"type":"string","nullable":true,"description":"Partition identifier. Null if not applicable."},"partition_id_type":{"type":"string","nullable":true,"description":"Type of the partition identifier. Null if not applicable."},"disk_name":{"type":"string","nullable":true,"description":"Disk name associated with the finding. Null if not applicable."},"first_observed":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the finding was first observed."},"last_observed":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the finding was last observed."}}},"FindingsErrorResponse":{"type":"object","description":"Standard error response for vulnerability findings endpoints.","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}}}
```

## Get a single vulnerability finding by platform ID

> Returns the vulnerability finding record for the given \`platform\_id\`.\
> Returns HTTP 404 when no matching finding exists.\
> \
> \*\*Required license:\*\* Cortex Cloud Runtime Security or Cortex Cloud Posture Management

```json
{"openapi":"3.1.0","info":{"title":"Vulnerability Management APIs","version":"Cortex XSIAM 3.5"},"tags":[{"name":"Vulnerability Findings","description":"vulnerability finding records (paginated or by ID)"}],"servers":[{"url":"https://api-yourfqdn","description":""}],"paths":{"/vulnerability-management/v1/vulnerability-finding/{platform_id}":{"post":{"operationId":"getVulnerabilityFindingById","summary":"Get a single vulnerability finding by platform ID","description":"Returns the vulnerability finding record for the given `platform_id`.\nReturns HTTP 404 when no matching finding exists.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management","tags":["Vulnerability Findings"],"parameters":[{"$ref":"#/components/parameters/PlatformId"}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","description":"Empty body — no request parameters required."}}}},"responses":{"200":{"description":"Vulnerability finding record.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetVulnerabilityFindingByIdResponse"}}}},"400":{"description":"Missing or invalid platform_id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingsErrorResponse"}}}},"404":{"description":"No finding found for the given platform_id.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/FindingsErrorResponse"}}}}}}}},"components":{"parameters":{"PlatformId":{"name":"platform_id","in":"path","required":true,"description":"Unique platform identifier for a vulnerability finding.","schema":{"type":"string"}}},"schemas":{"GetVulnerabilityFindingByIdResponse":{"type":"object","description":"Response containing a single vulnerability finding by platform ID.","properties":{"reply":{"type":"object","properties":{"data":{"type":"array","minItems":1,"maxItems":1,"items":{"$ref":"#/components/schemas/VulnerabilityFinding"}}}}}},"VulnerabilityFinding":{"type":"object","description":"A single vulnerability finding record representing one CVE on one asset. Only publicly allowed fields are returned.","properties":{"platform_id":{"type":"string","description":"Unique platform identifier for this finding."},"asset_id":{"type":"string","description":"Unique asset identifier (SHA-256 hash)."},"asset_name":{"type":"string","description":"Name of the affected asset."},"asset_type":{"type":"string","description":"Type of the asset (e.g. SERVICE, HOST)."},"asset_type_class":{"type":"string","description":"High-level classification of the asset type."},"asset_category":{"type":"string","description":"Category of the asset (e.g. Cloud, Service, Endpoint)."},"asset_group_ids":{"type":"array","items":{"type":"string"},"description":"Asset group identifiers the asset belongs to."},"type_id":{"type":"string","description":"Internal numeric type identifier for the asset."},"cve_id":{"type":"string","description":"CVE identifier."},"cve_description":{"type":"string","description":"Full description of the CVE vulnerability."},"cve_publish_date":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the CVE was published."},"published_date":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the finding was published."},"cvss_score":{"type":"number","format":"float","description":"CVSS base score (0–10)."},"cvss_severity":{"type":"string","description":"CVSS severity rating.","enum":["CRITICAL","HIGH","MEDIUM","LOW","INFORMATIONAL","UNKNOWN"]},"epss_score":{"type":"number","format":"float","description":"EPSS probability score (0–1)."},"cortex_vulnerability_risk_score":{"type":"number","format":"float","nullable":true,"description":"Cortex-computed composite risk score for this finding. Null if not yet calculated."},"cve_risk_factors":{"type":"array","items":{"type":"string"},"description":"List of risk factor labels associated with the CVE."},"has_kev":{"type":"boolean","description":"Whether the CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog."},"exploitable":{"type":"boolean","description":"Whether the vulnerability is considered exploitable."},"exploit_level":{"type":"string","description":"Exploit maturity level.","enum":["WEAPONIZED","POC","NO_KNOWN_EXPLOIT","NONE","UNKNOWN"]},"fix_available":{"type":"boolean","description":"Whether a fix is available for this finding."},"fix_versions":{"type":"array","items":{"type":"string"},"description":"List of versions that contain a fix for this CVE."},"fix_date":{"type":"integer","format":"int64","nullable":true,"description":"Unix timestamp (milliseconds) when a fix became available. Null if no fix date is known."},"affected_software":{"type":"string","nullable":true,"description":"Name of the affected software component. Null if not applicable."},"internet_exposed":{"type":"boolean","description":"Whether the asset is exposed to the internet."},"ipv4_addresses":{"type":"array","items":{"type":"string"},"description":"IPv4 addresses associated with the asset."},"ipv6_addresses":{"type":"array","items":{"type":"string"},"description":"IPv6 addresses associated with the asset."},"operating_system":{"type":"string","nullable":true,"description":"Operating system of the asset. Null if not detected."},"os_family":{"type":"string","nullable":true,"description":"OS family of the asset (e.g. Windows, Linux). Null if not detected."},"location":{"type":"string","nullable":true,"description":"Geographic or logical location of the asset. Null if not available."},"provider":{"type":"string","description":"Infrastructure provider for the asset (e.g. ON_PREM, AWS, GCP, AZURE)."},"finding_sources":{"type":"array","items":{"type":"string"},"description":"List of sources that detected this finding."},"source_tags":{"type":"array","items":{"type":"string"},"description":"Tags applied by the detection source."},"has_issue":{"type":"boolean","description":"Whether an issue has been raised for this finding."},"issue_id":{"type":"string","nullable":true,"description":"Identifier of the associated issue, if any."},"remediation":{"type":"string","nullable":true,"description":"Remediation guidance for this finding. Null if not available."},"package_in_use":{"type":"boolean","nullable":true,"description":"Whether the affected package is actively in use on the asset. Null if not applicable."},"package_version":{"type":"string","nullable":true,"description":"Version of the affected package. Null if not applicable."},"package_type":{"type":"string","nullable":true,"description":"Type of the affected package (e.g. npm, pip, deb). Null if not applicable."},"package_purl":{"type":"string","nullable":true,"description":"Package URL (PURL) for the affected package. Null if not applicable."},"package_licenses":{"type":"array","items":{"type":"string"},"description":"Licenses associated with the affected package."},"package_author":{"type":"string","nullable":true,"description":"Author of the affected package. Null if not applicable."},"package_symbols":{"type":"array","items":{"type":"string"},"description":"Symbols exported by the affected package."},"package_file_creation_time":{"type":"integer","format":"int64","nullable":true,"description":"Unix timestamp (milliseconds) when the package file was created. Null if not applicable."},"origin_package_name":{"type":"string","nullable":true,"description":"Name of the originating package. Null if not applicable."},"file_path":{"type":"string","nullable":true,"description":"File path of the affected package on the asset. Null if not applicable."},"application_version":{"type":"string","nullable":true,"description":"Version of the affected application. Null if not applicable."},"image":{"type":"string","nullable":true,"description":"Container image identifier. Null if not a container finding."},"image_name":{"type":"string","nullable":true,"description":"Container image name. Null if not a container finding."},"layer_id":{"type":"string","nullable":true,"description":"Container image layer identifier. Null if not a container finding."},"derived_from_base_image":{"type":"boolean","nullable":true,"description":"Whether the finding originates from a base image layer. Null if not applicable."},"is_derived":{"type":"boolean","description":"Whether this finding is derived from another finding."},"is_root":{"type":"boolean","nullable":true,"description":"Whether this is a root-level finding. Null if not applicable."},"volume_asset_id":{"type":"string","nullable":true,"description":"Asset ID of the associated volume. Null if not applicable."},"volume_path":{"type":"string","nullable":true,"description":"Path within the volume. Null if not applicable."},"partition_id":{"type":"string","nullable":true,"description":"Partition identifier. Null if not applicable."},"partition_id_type":{"type":"string","nullable":true,"description":"Type of the partition identifier. Null if not applicable."},"disk_name":{"type":"string","nullable":true,"description":"Disk name associated with the finding. Null if not applicable."},"first_observed":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the finding was first observed."},"last_observed":{"type":"integer","format":"int64","description":"Unix timestamp (milliseconds) when the finding was last observed."}}},"FindingsErrorResponse":{"type":"object","description":"Standard error response for vulnerability findings endpoints.","properties":{"reply":{"type":"object","properties":{"err_code":{"type":"integer"},"err_msg":{"type":"string"},"err_extra":{"type":"string"}}}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-api/vulnerability-management/vulnerability-findings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.