--- title: Cisco XDR slug: connectors/cisco-xdr docTags: createdAt: 2026-06-09T16:30:29.175Z --- Cisco XDR is a security solution that provides extended detection and response capabilities across diverse IT environments. Cisco XDR is a comprehensive extended detection and response platform that enhances threat detection and response capabilities across various security layers. By integrating with Swimlane Turbine, users can automate the search and retrieval of event data from Cisco XDR, leveraging advanced query capabilities to filter and sort events efficiently. This integration empowers security teams to streamline their workflows, improve incident response times, and enhance overall security posture by automating complex data retrieval processes. ## Limitations None to date. ## Supported Versions Cisco XDR supports latest available version. ## Configuration ### Prerequisites Before you can use the Cisco XDR connector for Turbine, you'll need access to the Cisco XDR API. This requires the following: - HTTP Basic authentication using the following parameters: - URL: The endpoint URL for accessing Cisco XDR services. - XDR Client ID: A unique identifier for your client application. - XDR Client Secret: A secret key associated with your client ID for authentication purposes. ## Authentication Methods ### Basic Authentication **Setup Instructions:** 1. Choose Administration > API Clients in the navigation menu and click Generate API Client. 2. Enter a Client Name and optionally, choose a Client Preset from the drop-down list. 3. If you did not choose a Client Preset, check the check boxes for the scopes for which you want to grant privileges to the client. You can also click Select All to grant all scopes to the client. 4. Optionally, enter a description in the Description field and click Add New Client. 5. The Client Id and Client Secret are generated and are displayed in the Add New Client dialog box. **Troubleshoot Tips:** The API Client is tied to your user identity. If your user identity loses privileges, then your API Client will also lose those privileges. All actions taken by the API Client will be done in your name, and recorded as your actions. If your access to the application is revoked, then your API Client will no longer be valid. ## Capabilities - Search Events CTIA - Search Events ### Search Events CTIA Search Events CTIA leverages the Cisco Threat Intelligence API (CTIA), an API designed to interact with Cisco’s broader threat intelligence services. Allowing users to query threat intelligence data directly from Cisco, specifically focusing on events associated with known threats or indicators of compromise (IOCs). Example URL may be started wtith : [https://private.intel.](https://private.intel.\{\{xdr_api_domain}}) ### Search Events The Search Events Action allows Cisco XDR users to search for specific events within the Cisco ecosystem, such as Cisco Secure Endpoint, Cisco Umbrella, and other integrated security tools. This action usually Helps in identifying and filtering security events based on predefined criteria, like event types, sources, or timestamps. Example URL may be started with : [https://visibility.](https://visibility.\{\{xdr_api_domain}}) ## Additional Documentation - [Cisco XDR Connector Documentation](https://docs.swimlane.com/connectors/cisco-xdr) - [Cisco XDR API Documentation](https://developer.cisco.com/docs/xdr/) # Configurations ## CISCO XDR HTTP Basic Authentication Authenticates using Client ID and Client Secret. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | username | CISCO XDR Client ID | string | Required | | password | Client Secret of Cisco XDR | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Search Events Perform a search for iroh-events within Cisco XDR using criteria from the provided data body. ### Endpoint - **URL:** `iroh/iroh-event/event/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------------------------------- | | `data_body` | object | Required | Response data | | `data_body.GenericSearch` | string | Required | Filter on event data | | `parameters.from` | string | Optional | Parameters for the Search Events action | | `parameters.to` | string | Optional | Parameters for the Search Events action | | `parameters.offset` | integer | Optional | Parameters for the Search Events action | | `parameters.limit` | integer | Optional | Parameters for the Search Events action | | `parameters.search_after` | string | Optional | Parameters for the Search Events action | | `parameters.sort_by` | string | Optional | Parameters for the Search Events action | | `parameters.sort_order` | string | Optional | Parameters for the Search Events action | | `parameters.fields` | array | Optional | Parameters for the Search Events action | ### Input Example `{"parameters":{"from":"2023-01-01T00:00:00Z","to":"2023-12-31T23:59:59Z"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.created_at` | string | Response data | | `data.data` | string | Response data | | `data.issuer` | string | Response data | | `data.id` | string | Response data | | `data.acknowledged_at` | string | Response data | | `data.emiter` | object | Response data | | `data.emiter.user_id` | string | Response data | | `data.emiter.org_id` | string | Response data | | `data.emiter.client_id` | string | Response data | | `data.sign` | object | Response data | | `data.sign.value` | string | Response data | | `data.sign.alg` | string | Response data | | `data.sign.kid` | string | Response data | | `paging` | object | Output field: paging | | `paging.total-hits` | number | Output field: paging.total-hits | | `paging.previous` | object | Output field: paging.previous | | `paging.previous.limit` | number | Output field: paging.previous.limit | | `paging.previous.search_after` | array | Output field: paging.previous.search\_after | | `paging.previous.offset` | number | Output field: paging.previous.offset | | `paging.next` | object | Output field: paging.next | | `paging.next.limit` | number | Output field: paging.next.limit | | `paging.next.search_after` | array | Output field: paging.next.search\_after | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Nov 2024 20:37:23 GMT"},"reason":"OK","json_body":{"data":[{}],"paging":{"total-hits":0,"previous":{},"next":{},"sort":[]}}}` ## Search Event CTIA Retrieve event entities from Cisco XDR using Elasticsearch query syntax and field-based filters. ### Endpoint - **URL:** `/ctia/event/search` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.sort_order` | string | Optional | Sort direction | | `parameters.from` | string | Optional | Parameters for the Search Event CTIA action | | `parameters.sort_by` | string | Optional | Sort result on fields. The following fields are supported:- id, language, revision, schema\_version, source, source\_uri, timestamp, title, tlp. Fields can be combined with ',' and sort order can be specified by '\:asc' and '\:desc'. For example:-id //sort by id ascending | | `parameters.query` | string | Optional | Parameters for the Search Event CTIA action | | `parameters.to` | string | Optional | Parameters for the Search Event CTIA action | | `parameters.tlp` | string | Optional | Parameters for the Search Event CTIA action | | `parameters.fields` | array | Optional | Parameters for the Search Event CTIA action | | `parameters.search_after` | array | Optional | Pagination stateless cursor | | `parameters.language` | string | Optional | Parameters for the Search Event CTIA action | | `parameters.id` | string | Optional | Parameters for the Search Event CTIA action | | `parameters.limit` | integer | Optional | Pagination Limit | | `parameters.offset` | integer | Optional | Pagination Offset | | `parameters.simple_query` | string | Optional | Query String with simple query format | | `parameters.revision` | integer | Optional | Parameters for the Search Event CTIA action | ### Input Example `{"parameters":{"sort_order":"asc","from":"2023-01-01T00:00:00Z","sort_by":"id:desc","query":"event_type:malware","to":"2023-12-31T23:59:59Z"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 5 Nov 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | -------------- | ----------------------------------------------------- | ---------------------------- | | content-length | The length of the response body in bytes | 140 | | content-type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Tue, 5 Nov 2024 20:37:23 GMT |