Cortex Xsiam

Cortex XSIAM is a unified security operations platform that automates threat detection, investigation, and response across diverse enterprise environments.

Cortex XSIAM is Palo Alto Networks’ next-generation security operations platform, unifying SIEM, SOAR, XDR, and threat intelligence for comprehensive detection, investigation, and response. This connector enables Swimlane Turbine users to automate a wide range of security operations tasks in Cortex XSIAM, including alert and incident management, endpoint isolation, IOC handling, XQL querying, and case management—all without writing code. By integrating Cortex XSIAM with Swimlane Turbine, security teams can orchestrate complex workflows, accelerate threat response, and centralize security data and actions across their environment. This seamless automation reduces manual effort, improves incident response times, and enhances overall SOC efficiency.

Using the Cortex XSIAM APIs, you can integrate Cortex XSIAM with third-party apps or services to ingest alerts and to leverage alert stitching and investigation capabilities. The APIs allows you to manage incidents in a ticketing or automation system of your choice by reviewing and editing the incident's details, status, and assignee.

Prerequisites

To use the Cortex XSIAM connector, ensure you have the following prerequisites:

API Key Authentication for Cortex XSIAM, requiring:

URL: The base URL of your Cortex XSIAM instance.

API Key: A valid API key generated within Cortex XSIAM for programmatic access.

API Key ID: The unique identifier associated with your API key.

Capabilities

This connector provides the following capabilities:

Get Alerts

Get Incidents

Update Alerts

Update Incidents

Get XQL Query Quota

Get Datasets (POST /public_api/v1/xql/get_datasets)

List Datasets (GET /public_api/v1/xql/datasets)

Start XQL Query

Get Query Results

Notes

Link to docs

Additional Documentation

Cortex Xsiam Connector Documentation

Cortex Xsiam API Documentation

Configurations

Cortex XSIAM API Key Authentication

Authenticates using an API Key and API Key ID for Cortex XSIAM.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
Authorization	The API Key is your unique identifier. Depending on your desired security level, you can generate two types of API keys, Advanced or Standard, from your Cortex XDR app.	string	Required
x-xdr-auth-id	The API Key ID is your unique token used to authenticate the API Key.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Block List Files

Add specified files to the block list in Cortex XSIAM if they are not already present in the allow or block lists, using the provided request data.

Endpoint

URL: /public_api/v1/hash_exceptions/blocklist

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.hash_list	array	Required	A list of hashed files you want to add to a block list. Hash must be a valid SHA256.
request_data.comment	string	Optional	Additional information regarding the action.
request_data.incident_id	integer	Optional	The case ID related to the hash. When included in the request, the Block List action appears in the Cortex XSIAM Case View Timeline tab.

Input Example

{"json_body":{"request_data":{"hash_list":["a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3e4f5a0b1"],"comment":"Malicious file detected","incident_id":12345}}}

Output Example

{"json_body":true}

Delete Indicators (IOCs)

Remove indicators of compromise (IOCs) matching specified filters in Cortex XSIAM. Requires Instance Administrator permissions and request_data input.

Endpoint

URL: /public_api/v1/indicators/delete

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.extended_view	boolean	Optional	Optional flag aligned with other indicator APIs.
request_data.filters	array	Required	Filters that select which IOCs to delete. field/operator/value must match the IOC attribute semantics (e.g. EQ/NEQ for strings and booleans; gte/lte for expiration_date epoch milliseconds).
request_data.filters.field	string	Required	IOC attribute to match: indicator, type, severity, expiration_date, default_expiration_enabled, comment, reputation, reliability, or rule_id.
request_data.filters.operator	string	Required	gte/lte for expiration_date (epoch ms). EQ/NEQ for indicator (string), type, severity, default_expiration_enabled (boolean), comment, reputation, reliability, and rule_id.
request_data.filters.value	string	Required	Scalar or array; must match field type and operator (see API docs).

Input Example

{"json_body":{"request_data":{"extended_view":false,"filters":[{"field":"rule_id","operator":"EQ","value":57}]}}}

Output

Parameter	Type	Description
objects_count	integer	Number of IOC rules affected.
objects	array	List of deleted IOC rule IDs.

Output Example

{"json_body":{"objects_count":1,"objects":[57]}}

Get Alerts

Retrieve a list of alerts from Cortex XSIAM based on specified criteria provided in the JSON body input.

Endpoint

URL: /public_api/v1/alerts/get_alerts/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.filters	array	Optional	An array of filter fields.
request_data.filters.field	string	Required	Identifies the alert field the filter is matching.
request_data.filters.operator	string	Required	Identifies the comparison operator you want to use for this filter.
request_data.filters.value	string	Required	Value that this filter must match. The contents of this field will differ depending on the alert field that you specified for this filter.
request_data.search_from	number	Optional	An integer representing the starting offset within the query result set from which you want alerts returned.
request_data.search_to	number	Optional	An integer representing the end offset within the result set after which you do not want alerts returned.
request_data.sort	object	Optional	Identifies the sort order for the result set.
request_data.sort.field	string	Optional	Identifies how to sort the result set, either according to severity or creation time.
request_data.sort.keyword	string	Required	Defines whether to sort the results in ascending (asc) or descending (desc) order.

Input Example

{"json_body":{"request_data":{"filters":[{"field":"alert_id_list","operator":"gte","value":"medium"}],"search_from":0,"search_to":100,"sort":{"field":"creation_time","keyword":"desc"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.total_count	number	Count value
reply.result_count	number	Result of the operation
reply.alerts	array	Output field: reply.alerts
reply.alerts.agent_os_sub_type	string	Type of the resource
reply.alerts.fw_app_category	object	Output field: reply.alerts.fw_app_category
reply.alerts.fw_app_id	object	Unique identifier
reply.alerts.fw_app_subcategory	object	Output field: reply.alerts.fw_app_subcategory
reply.alerts.fw_app_technology	object	Output field: reply.alerts.fw_app_technology
reply.alerts.causality_actor_process_command_line	object	Output field: reply.alerts.causality_actor_process_command_line
reply.alerts.causality_actor_process_image_md5	object	Output field: reply.alerts.causality_actor_process_image_md5
reply.alerts.causality_actor_process_image_name	object	Name of the resource
reply.alerts.causality_actor_process_image_path	object	Output field: reply.alerts.causality_actor_process_image_path
reply.alerts.causality_actor_process_image_sha256	object	Output field: reply.alerts.causality_actor_process_image_sha256
reply.alerts.causality_actor_process_signature_status	string	Status value
reply.alerts.causality_actor_process_signature_vendor	object	Output field: reply.alerts.causality_actor_process_signature_vendor
reply.alerts.causality_actor_causality_id	object	Unique identifier
reply.alerts.identity_sub_type	object	Unique identifier
reply.alerts.identity_type	object	Unique identifier
reply.alerts.operation_name	object	Name of the resource
reply.alerts.project	object	Output field: reply.alerts.project
reply.alerts.cloud_provider	object	Unique identifier
reply.alerts.referenced_resource	object	Output field: reply.alerts.referenced_resource

Output Example

{"reply":{"total_count":123,"result_count":123,"alerts":[{}]}}

Get Datasets

Retrieve all XQL datasets and their properties from Cortex XSIAM using a POST request to the public API endpoint.

Endpoint

URL: /public_api/v1/xql/get_datasets

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Empty object. This endpoint lists every dataset on the tenant.

Input Example

{"json_body":{"request_data":{}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	array	Output field: reply
reply.dataset_name	string	Response data
reply.type	string	Type of the resource
reply.default_query_target	string	Output field: reply.default_query_target

Output Example

{"reply":[{"dataset_name":"Example Name","type":"string","default_query_target":"string"}]}

Get Incidents

Retrieve a filtered list of incidents from Cortex XSIAM based on criteria such as IDs, modification date, or creation time using a JSON body for filtering.

Endpoint

URL: /public_api/v1/incidents/get_incidents

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields. An empty dictionary returns all results.
request_data.filters	array	Optional	Array of filter fields.
request_data.filters.field	string	Required	Identifies the incident field the filter is matching.
request_data.filters.operator	string	Required	Identifies the comparison operator you want to use for this filter.
request_data.filters.value	array	Required	Value that this filter must match. The contents of this field will differ depending on the incident field that you specified for this filter.
request_data.search_from	number	Optional	Integer representing the starting offset within the query result set from which you want incidents returned.
request_data.search_to	number	Optional	Integer representing the end offset within the result set after which you do not want incidents returned.
request_data.sort	object	Optional	Identifies the sort order for the result set.
request_data.sort.field	string	Required	Sort according to this field.
request_data.sort.keyword	string	Required	Sort in ascending or descending order.

Input Example

{"json_body":{"request_data":{"filters":[{"field":"incident_id_list","operator":"gte","value":["incident_id"]}],"search_from":0,"search_to":100,"sort":{"field":"creation_time","keyword":"desc"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.total_count	number	Count value
reply.result_count	number	Result of the operation
reply.incidents	array	Unique identifier
reply.incidents.incident_id	string	Unique identifier
reply.incidents.incident_name	string	Unique identifier
reply.incidents.creation_time	number	Unique identifier
reply.incidents.modification_time	number	Unique identifier
reply.incidents.detection_time	object	Unique identifier
reply.incidents.status	string	Unique identifier
reply.incidents.severity	string	Unique identifier
reply.incidents.description	string	Unique identifier
reply.incidents.assigned_user_mail	object	Unique identifier
reply.incidents.assigned_user_pretty_name	object	Unique identifier
reply.incidents.alert_count	number	Unique identifier
reply.incidents.low_severity_alert_count	number	Unique identifier
reply.incidents.med_severity_alert_count	number	Unique identifier
reply.incidents.high_severity_alert_count	number	Unique identifier
reply.incidents.critical_severity_alert_count	number	Unique identifier
reply.incidents.user_count	number	Unique identifier
reply.incidents.host_count	number	Unique identifier
reply.incidents.notes	object	Unique identifier
reply.incidents.resolve_comment	object	Unique identifier

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 25 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"reply":{"total_count":1,"result_count":1,"incidents":[],"restricted_incident_ids":[]}}}

Get Indicators (IOCs)

Retrieve a list of indicators of compromise (IOCs) from Cortex XSIAM with optional filters and extended view. Supports pagination, AND-only filters, and requires Instance Administrator permissions.

Endpoint

URL: /public_api/v1/indicators/get

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.extended_view	boolean	Optional	When true, returns extended results with all details included.
request_data.filters	array	Optional	An array of filter fields. Combined with AND (OR is not supported).
request_data.filters.field	string	Required	Field name to filter on.
request_data.filters.operator	string	Required	Comparison operator for this filter.
request_data.filters.value	array	Required	Values the filter applies to (integers or strings per field).
request_data.search_from	integer	Optional	Zero-based starting offset in the result set. Indicators indexed below this value are omitted. Defaults to zero.
request_data.search_to	integer	Optional	End offset in the result set; indicators indexed above this value are omitted. Defaults to a value greater than 100, returning indicators through the end of the list when unspecified.

Input Example

{"json_body":{"request_data":{"extended_view":false,"filters":[{"field":"rule_id","operator":"IN","value":[57]}]}}}

Output

Parameter	Type	Description
objects_count	integer	Number of indicator objects returned.
objects	array	List of IOC records.
objects.rule_id	integer	Unique identifier
objects.indicator	string	Output field: objects.indicator
objects.type	string	Type of the resource
objects.severity	string	Output field: objects.severity
objects.expiration_date	integer	Expiration as epoch or sentinel such as -1 when not applicable.
objects.comment	string	Output field: objects.comment
objects.reputation	string	May be null.
objects.reliability	string	May be null.
objects_type	string	Type of the resource

Output Example

{"json_body":{"objects_count":1,"objects":[{}],"objects_type":"indicator"}}

Get Query Results

Retrieve up to 1000 rows of results for a specified XQL execution ID in Cortex XSIAM, with options for non-blocking or blocking polling based on the pending_flag setting.

Endpoint

URL: /public_api/v1/xql/get_query_results

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.query_id	string	Required	Execution ID returned by start_xql_query.
request_data.pending_flag	boolean	Optional	true returns immediately with PENDING, SUCCESS, or FAIL. false blocks until the query reaches a terminal status.
request_data.limit	number	Optional	Maximum rows to return. Values above 1000 produce a stream id instead of inline rows.
request_data.format	string	Optional	Result format.

Input Example

{"json_body":{"request_data":{"query_id":"execution_id","pending_flag":true,"limit":1000,"format":"json"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.status	string	SUCCESS or PENDING or FAIL on Cortex; some mocks use lowercase completed or failed.
reply.number_of_results	number	Result of the operation
reply.query_cost	object	Output field: reply.query_cost
reply.remaining_quota	number	Output field: reply.remaining_quota
reply.results	object	Result of the operation
reply.results.data	array	Response data
reply.results.stream_id	string	Unique identifier
reply.err_msg	string	Output field: reply.err_msg
reply.err_extra	string	Output field: reply.err_extra

Output Example

{"reply":{"status":"active","number_of_results":123,"query_cost":{},"remaining_quota":123,"results":{"data":[],"stream_id":"string"},"err_msg":"string","err_extra":"string"}}

Get XQL Query Results

Retrieve results from a previously executed XQL query in Cortex XSIAM using the execution ID, with options for synchronous or asynchronous output in JSON or CSV format.

Endpoint

URL: /public_api/v1/xql/get_query_results

Method: POST

Input

Argument Name	Type	Required	Description
data_body	object	Optional	Data Body
headers	object	Optional	Request Headers
request_data	object	Optional	A dictionary containing the API request fields.
request_data.query_id	string	Required	String representing the unique execution ID generated by the response to Start an XQL query API. You can also enter the execution ID of a query generated in Cortex XDR and listed in the Query Center table.
request_data.pending_flag	boolean	Optional	Boolean flag for sync/async mode. If true (the default), returns immediately with PENDING, SUCCESS, or FAIL status. If false, blocks until the query completes and results are ready to be returned.
request_data.limit	integer	Optional	Maximum number of results to return. If unspecified or greater than 1000 when results exceed 1000, a stream ID is generated for the Get XQL Query Results Stream API. In multi-tenant mode, x returns x results across all tenants combined.
request_data.format	string	Optional	The type of response output.

Input Example

{"path_parameters":{},"parameters":{},"data_body":{},"headers":{},"request_data":{"query_id":"string","pending_flag":true,"limit":123,"format":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.status	string	The status of the query execution (e.g. PENDING, SUCCESS, FAIL).
reply.number_of_results	integer	The total number of results returned by the query.
reply.query_cost	object	Cost metrics per tenant for the query execution.
reply.remaining_quota	number	The remaining query quota available after this execution.
reply.results	object	Result of the operation
reply.results.data	array	Array of result records returned by the XQL query.
reply.results.data.event_id	string	Response data
reply.results.data.agent_version	string	Response data
reply.results.data._product	string	Response data
reply.results.data._time	integer	Response data
reply.results.data._vendor	string	Response data
reply.results.data.insert_timestamp	integer	Response data
reply.results.data.agent_os_type	string	Response data
reply.results.data.event_type	string	Response data
reply.results.data.event_sub_type	string	Response data

Output Example

{"reply":{"status":"active","number_of_results":123,"query_cost":{},"remaining_quota":123,"results":{"data":[]}}}

Get XQL Query Quota

Retrieve available and used Cortex XQL query quota, including the current number of concurrent API queries and maximum allowed parallel queries.

Endpoint

URL: /public_api/v1/xql/get_quota

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Empty object. This endpoint does not take query parameters.

Input Example

{"json_body":{"request_data":{}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.license_quota	number	Output field: reply.license_quota
reply.additional_purchased_quota	number	Output field: reply.additional_purchased_quota
reply.used_quota	number	Output field: reply.used_quota
reply.eval_quota	object	Output field: reply.eval_quota
reply.remaining_quota	number	Output field: reply.remaining_quota
reply.current_concurrent_active_queries_count	number	Count value
reply.max_daily_concurrent_active_query_count	number	Count value
reply.total_daily_running_queries	number	Output field: reply.total_daily_running_queries
reply.total_daily_concurrent_rejected_queries	number	Output field: reply.total_daily_concurrent_rejected_queries
reply.current_concurrent_active_queries	object	Output field: reply.current_concurrent_active_queries

Output Example

{"reply":{"license_quota":123,"additional_purchased_quota":123,"used_quota":123,"eval_quota":{},"remaining_quota":123,"current_concurrent_active_queries_count":123,"max_daily_concurrent_active_query_count":123,"total_daily_running_queries":123,"total_daily_concurrent_rejected_queries":123,"current_concurrent_active_queries":{}}}

Insert or Update Indicators

Insert new or update existing indicators of compromise (IOCs) in Cortex XSIAM using request_data; overwrites occur if rule_id matches an existing IOC for the tenant. Requires Instance Administrator permissions.

Endpoint

URL: /public_api/v1/indicators/insert

Method: POST

Input

Argument Name	Type	Required	Description
request_data	array	Optional	Array of IOC payloads to insert or update.
request_data.rule_id	integer	Optional	Tenant-specific IOC rule ID. Include when updating an existing rule; omit for new IOCs.
request_data.indicator	string	Required	Indicator value (e.g. file name, hash, domain).
request_data.type	string	Required	IOC type (e.g. FILENAME).
request_data.severity	string	Required	Severity level for the IOC.
request_data.expiration_date	integer	Required	Expiration as a Unix epoch in milliseconds.
request_data.default_expiration_enabled	boolean	Required	Whether default expiration policy applies.
request_data.comment	string	Optional	Optional notes for the IOC.
request_data.reputation	string	Optional	May be null.
request_data.reliability	string	Optional	May be null.

Input Example

{"json_body":{"request_data":[{"indicator":"virus1.exe","type":"FILENAME","severity":"SEV_040_HIGH","expiration_date":1234567891234,"default_expiration_enabled":false,"comment":"teststeststsetestste","reputation":null,"reliability":null},{"indicator":"test.exe","type":"FILENAME","severity":"SEV_030_MEDIUM","expiration_date":1234567891234,"default_expiration_enabled":true,"reputation":null,"reliability":null}]}}

Output

Parameter	Type	Description
added_objects	array	List of IOC objects that were added.
added_objects.id	integer	Unique identifier
added_objects.status	string	Status value
updated_objects	array	List of IOC objects that were updated.
updated_objects.id	integer	Unique identifier
updated_objects.status	string	Status value
errors	array	Error messages, if any.

Output Example

{"json_body":{"added_objects":[{}],"updated_objects":[{}],"errors":[]}}

Isolate Endpoints

Isolate up to 1000 endpoints by specifying endpoint IDs or filters. Requires Cortex XSIAM Premium/Enterprise, NG SIEM with endpoints, or the Cortex Cloud Runtime Security add-on.

Endpoint

URL: /public_api/v1/endpoints/isolate

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	For one endpoint send endpoint_id only (no filters). For multiple, send filters only (no endpoint_id). The API rejects both together. Max 1000 endpoints. Optional incident_id ties the action to Case View timeline.
request_data.endpoint_id	string	Optional	Single endpoint to isolate. Omit when using filters.
request_data.filters	array	Optional	Filters for multiple endpoints. Omit when using endpoint_id.
request_data.filters.field	string	Required	List the filters match.
request_data.filters.operator	string	Required	Comparison operator for this filter.
request_data.filters.value	array	Required	Endpoint IDs this filter must match.
request_data.incident_id	string	Optional	Optional case ID so the action appears on the Case View timeline.

Input Example

{"json_body":{"request_data":{"endpoint_id":"example-endpoint-id"}}}

Output

Parameter	Type	Description
reply	object	Output field: reply
reply.action_id	string	Action ID for isolating the selected endpoints.
reply.status	string	Status value
reply.endpoints_count	string	Number of endpoints included in the request.

Output Example

{"json_body":{"reply":{"action_id":"example-action-id","status":"1","endpoints_count":"673"}}}

List Datasets

Retrieve available XQL datasets from Cortex XSIAM using the GET method when the POST get_datasets endpoint is unavailable.

Endpoint

URL: /public_api/v1/xql/datasets

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	array	Output field: reply
datasets	array	Response data

Output Example

{"reply":[],"datasets":[]}

Quarantine Files

Quarantine specified files on selected endpoints in Cortex XSIAM by providing the required request data.

Endpoint

URL: /public_api/v1/endpoints/quarantine

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.filters	array	Required	An array of filter fields.
request_data.filters.field	string	Required	String that identifies a list the filters match.
request_data.filters.operator	string	Required	String that identifies the comparison operator to use for this filter.
request_data.filters.value	array	Required	Array of strings that this filter must match.
request_data.file_path	string	Required	The path of the file you want to quarantine. You must enter a proper path and not symbolic links.
request_data.file_hash	string	Required	Case ID. When included, the Quarantine File action will appear in the Cortex XSIAM Case View Timeline tab.

Input Example

{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["abc123"]}],"file_path":"/path/to/file","file_hash":"abc123hash"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.action_id	string	The ID of the quarantine action.
reply.status	string	The status of the quarantine action.
reply.endpoints_count	string	The number of endpoints targeted by the quarantine action.

Output Example

{"reply":{"action_id":"[ID value]","status":"1","endpoints_count":"673"}}

Retrieve Case Artifacts by Case ID

Retrieve all artifacts linked to a specific case in Cortex XSIAM using the provided case ID.

Endpoint

URL: /public_api/v1/case/artifacts/{{case_id}}

Method: GET

Input

Argument Name	Type	Required	Description
path_parameters.case_id	number	Required	Numeric ID of the case.

Input Example

{"path_parameters":{"case_id":56}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.TOTAL_COUNT	number	Count value
reply.FILTER_COUNT	number	Count value
reply.DATA	array	Response data
reply.DATA.case_id	number	Response data
reply.DATA.network_artifacts	object	Response data
reply.DATA.network_artifacts.DATA	array	Response data
reply.DATA.network_artifacts.TOTAL_COUNT	number	Response data
reply.DATA.file_artifacts	object	Response data
reply.DATA.file_artifacts.DATA	array	Response data
reply.DATA.file_artifacts.TOTAL_COUNT	number	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"reply":{"TOTAL_COUNT":0,"FILTER_COUNT":0,"DATA":[]}}}

Retrieve Cases based on filters

Retrieve a list of Cortex XSIAM cases that match specified filter criteria provided in the request_data parameter.

Endpoint

URL: /public_api/v1/case/search

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.filters	array	Optional	List of filters to apply when retrieving cases.
request_data.filters.field	string	Optional	Specifies the field to filter cases by.
request_data.filters.operator	string	Optional	Comparison operator to use with the filter.
request_data.filters.value	array	Optional	Value(s) for filtering the cases.
request_data.search_from	number	Optional	Starting index for pagination.
request_data.search_to	number	Optional	Ending index for pagination.
request_data.sort	object	Optional	Sort order (ascending or descending).
request_data.sort.field	string	Optional	Field to sort by.
request_data.sort.keyword	string	Optional	Sort order (ascending or descending).

Input Example

{"json_body":{"request_data":{"filters":[{"field":"case_id","operator":"in","value":[0]}],"search_from":0,"search_to":0,"sort":{"field":"case_id","keyword":"asc"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.TOTAL_COUNT	number	Count value
reply.FILTER_COUNT	number	Count value
reply.DATA	array	Response data
reply.DATA.case_id	string	Response data
reply.DATA.creation_time	string	Response data
reply.DATA.owner	string	Response data
reply.DATA.case_domain	string	Response data
reply.DATA.auto_resolve_case	boolean	Response data
reply.DATA.custom_fields	object	Response data
reply.DATA.custom_fields.priority	string	Response data
reply.DATA.custom_fields.incident_id	string	Response data
reply.DATA.status_progress	string	Response data
reply.DATA.resolve_reason	string	Response data
reply.DATA.resolve_comment	string	Response data
reply.DATA.last_modified	number	Response data
reply.DATA.score	number	Response data
reply.DATA.severity	string	Response data
reply.DATA.description	string	Response data
reply.DATA.scoring_type	string	Response data
reply.DATA.assigned_to	string	Response data
reply.DATA.assigned_to_name	string	Response data
reply.DATA.is_cloud	boolean	Response data

Output Example

{"status_code":200,"reason":"OK","json_body":{"reply":{"TOTAL_COUNT":0,"FILTER_COUNT":0,"DATA":[]}}}

Retrieve issues based on filters

Retrieve a list of issues from Cortex XSIAM that match specified filter criteria provided in the JSON body.

Endpoint

URL: /public_api/v1/issue/search

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Request data for retrieving issues based on filters.
request_data.filters	array	Optional	List of filter criteria to apply.
request_data.filters.field	string	Optional	Specifies the field to filter issues by.
request_data.filters.operator	string	Optional	Comparison operator to use with the filter.
request_data.filters.value	array	Optional	Value(s) for filtering the issues.
request_data.search_from	number	Optional	Starting index for pagination.
request_data.search_to	number	Optional	Ending index for pagination.
request_data.sort	object	Optional	Sorting criteria for the results.
request_data.sort.field	string	Optional	Field to sort the results by.
request_data.sort.keyword	string	Optional	Sort order (ascending or descending).
include_fields	array	Optional	A list of fields to include in the response.

Input Example

{"json_body":{"request_data":{"filters":[{"field":"case_id","operator":"in","value":[0]}],"search_from":0,"search_to":0,"sort":{"field":"case_id","keyword":"asc"}},"include_fields":["normalized_field","custom_fields"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.total_count	number	Count value
reply.result_count	number	Result of the operation
reply.issues	array	Output field: reply.issues
reply.issues._insert_time	string	Time value
reply.issues.owner	string	Output field: reply.issues.owner
reply.issues.external_id	string	Unique identifier
reply.issues.name	string	Name of the resource
reply.issues.description	string	Output field: reply.issues.description
reply.issues.observation_time	number	Time value
reply.issues.domain	string	Output field: reply.issues.domain
reply.issues.detection_method	string	HTTP method to use
reply.issues.detection_rule_id	string	Unique identifier
reply.issues.category	string	Output field: reply.issues.category
reply.issues.finding_ids	array	Unique identifier
reply.issues.asset_ids	array	Unique identifier
reply.issues.mitre_tactics	array	Output field: reply.issues.mitre_tactics
reply.issues.mitre_techniques	array	Output field: reply.issues.mitre_techniques
reply.issues.type	string	Type of the resource
reply.issues.remediation	string	Output field: reply.issues.remediation
reply.issues.extended_description	string	Output field: reply.issues.extended_description
reply.issues.impact	string	Output field: reply.issues.impact
reply.issues.issue_id	number	Unique identifier

Output Example

{"status_code":200,"reason":"OK","json_body":{"reply":{"total_count":0,"result_count":0,"issues":[]}}}

Scan Endpoints

Run a security scan on selected endpoints in Cortex XSIAM using specified filter criteria. Requires Premium, Enterprise, or NG SIEM with appropriate add-ons.

Endpoint

URL: /public_api/v1/endpoints/scan

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.filters	array	Required	Array of filter objects; criteria combine with AND (no OR). The HTTP API also accepts the string all for every endpoint; send that as raw JSON if your UI types this field as an array only.
request_data.filters.field	string	Required	List the filters match.
request_data.filters.operator	string	Required	Comparison operator for this filter.
request_data.filters.value	array	Required	Values this filter must match.
request_data.incident_id	string	Optional	Case ID. When included, the Scan Endpoints action appears in the Cortex XSIAM Case View Timeline tab.

Input Example

{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["abc123"]}],"incident_id":"12345"}}}

Output

Parameter	Type	Description
reply	object	Output field: reply
reply.action_id	string	ID of the action to scan selected endpoints.
reply.endpoints_count	string	Number of endpoints included in the request.

Output Example

{"json_body":{"reply":{"action_id":"example-action-id","endpoints_count":"673"}}}

Start an XQL Query

Execute an XQL query in Cortex XSIAM and receive a unique execution ID to retrieve the query results.

Endpoint

URL: /public_api/v1/xql/start_xql_query

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.query	string	Required	String of the XQL query.
request_data.tenants	array	Optional	Tenant IDs for Managed Security: one ID, multiple IDs, or [] or null (default) for local tenant.
request_data.timeframe	object	Optional	Integer in timestamp epoch milliseconds. Use an absolute timeframe with "from" and "to" keys, or a relative timeframe with the "relativeTime" key.
request_data.timeframe.from	integer	Optional	Use for an absolute timeframe. Unix timestamp in milliseconds representing the start of the period.
request_data.timeframe.to	integer	Optional	Use for an absolute timeframe. Unix timestamp in milliseconds representing the end of the period.
request_data.timeframe.relativeTime	integer	Optional	Use for a relative timeframe. Unix timestamp in milliseconds representing a duration from now (e.g. 86400000 = last 24 hours).

Input Example

{"json_body":{"request_data":{"query":"dataset=xdr_data | fields actor_process_image_name, actor_process_image_path","tenants":[],"timeframe":{"relativeTime":86400000}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	string	The unique execution ID for the XQL query, used to retrieve results.

Output Example

{"reply":"ad21c1e1492d4c_667_inv"}

Start XQL Query

Submit an XQL query for execution in Cortex XSIAM and receive a unique ID to retrieve results, supporting up to four parallel API queries.

Endpoint

URL: /public_api/v1/xql/start_xql_query

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.query	string	Required	XQL query string. Must start with dataset = unless a default query target is configured.
request_data.tenants	array	Optional	Optional tenant IDs for MSSP/local queries. Empty list or omit for the local tenant.
request_data.timeframe	object	Optional	Absolute epoch-millisecond window. from and to are UTC ms.
request_data.timeframe.from	number	Optional	Start of the query window in UTC epoch milliseconds.
request_data.timeframe.to	number	Optional	End of the query window in UTC epoch milliseconds.
request_data.timeframe.relativeTime	number	Optional	Optional relative window in milliseconds when from/to are not supplied.

Input Example

{"json_body":{"request_data":{"query":"dataset = xdr_data | limit 10","timeframe":{"from":1717200000000,"to":1717286400000}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Unisolate Endpoints

Remove isolation from one or multiple endpoints using endpoint ID or filters. Requires Cortex XSIAM Premium/Enterprise, NG SIEM with endpoints, or Cortex Cloud Runtime Security add-on.

Endpoint

URL: /public_api/v1/endpoints/unisolate

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	For one endpoint send endpoint_id only (no filters). For multiple, send filters only (no endpoint_id). The API rejects both together. Optional incident_id ties the action to Case View timeline.
request_data.endpoint_id	string	Optional	Single endpoint to unisolate. Omit when using filters.
request_data.filters	array	Optional	Filters for multiple endpoints. Omit when using endpoint_id.
request_data.filters.field	string	Required	List the filters match.
request_data.filters.operator	string	Required	Comparison operator for this filter.
request_data.filters.value	array	Required	Endpoint IDs this filter must match.
request_data.incident_id	string	Optional	Optional case ID so the action appears on the Case View timeline.

Input Example

{"json_body":{"request_data":{"endpoint_id":"example-endpoint-id"}}}

Output

Parameter	Type	Description
reply	object	Output field: reply
reply.action_id	string	ID of the action to unisolate selected endpoints.
reply.status	string	Status value
reply.endpoints_count	string	Number of endpoints included in the request.

Output Example

{"json_body":{"reply":{"action_id":"example-action-id","status":"1","endpoints_count":"673"}}}

Update Alerts

Update up to 100 alerts at once in Cortex XSIAM using a specified JSON body payload.

Endpoint

URL: /public_api/v1/alerts/update_alerts

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.alert_id_list	array	Optional	A list representing the alert IDs you want to update.
request_data.update_data	object	Optional	The data you want to update the alerts with.
request_data.update_data.severity	string	Optional	Alert severity.
request_data.update_data.status	string	Optional	Updated alert status.
request_data.update_data.comment	string	Optional	Descriptive comment explaining the changes.

Input Example

{"json_body":{"request_data":{"alert_id_list":["list of ids"],"update_data":{"severity":"medium","status":"resolved_other","comment":"This incident is resolved"}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.alerts_ids	array	Unique identifier

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 25 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":{"reply":{"alerts_ids":[]}}}

Update Existing Case

Update an existing case in Cortex XSIAM by specifying the case ID and providing the necessary request data.

Endpoint

URL: /public_api/v1/case/update/{{case_id}}

Method: POST

Input

Argument Name	Type	Required	Description
path_parameters.case_id	number	Required	Parameters for the Update Existing Case action
request_data	object	Optional	Data required to update the case.
request_data.update_data	object	Required	Fields to be updated for the case.
request_data.update_data.status_progress	string	Optional	The new status of the case.
request_data.update_data.resolve_reason	string	Optional	Reason for resolving the case.
request_data.update_data.resolve_comment	string	Optional	Comment explaining the reason for resolving the case.

Input Example

{"json_body":{"request_data":{"update_data":{"status_progress":"RESOLVED","resolve_reason":"RESOLVED_OTHER","resolve_comment":"Case has been marked as a false positive."}}},"path_parameters":{"case_id":56}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"reason":"OK","json_body":"Issues updated successfully"}

Update Incidents

Modify specific fields of an incident in Cortex XSIAM by providing the required JSON body with updated values.

Endpoint

URL: /public_api/v1/incidents/update_incident

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.incident_id	string	Required	A string representing the incident ID you want to update.
request_data.update_data	object	Required	The data to update the incident with.
request_data.update_data.assigned_user_mail	string	Optional	Updated email address of the incident assignee.
request_data.update_data.assigned_user_pretty_name	string	Optional	Updated full name of the incident assignee. To supply a new value in this field, you must also supply a value for assigned_user_mail in the same request.
request_data.update_data.manual_severity	string	Optional	Administrator-defined severity.
request_data.update_data.status	string	Optional	Updated incident status.
request_data.update_data.resolve_comment	string	Optional	Descriptive comment explaining the incident change. This can be set only for resolved incidents.
request_data.update_data.comment	object	Optional	Add a comment to the incident.
request_data.update_data.comment.comment_action	string	Required	The comment action must be 'add'.
request_data.update_data.comment.value	string	Required	The comment text.

Input Example

{"json_body":{"request_data":{"incident_id":"incident_id","update_data":{"assigned_user_mail":"[email protected]","assigned_user_pretty_name":"Hello World","manual_severity":"medium","status":"resolved_duplicate","resolve_comment":"string","comment":{"comment_action":"add","value":"string"}}}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Tue, 25 Jun 2024 20:37:23 GMT"},"reason":"OK","json_body":true}

Response Headers

Header	Description	Example
content-length	The length of the response body in bytes	140
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT