Palo Alto Networks Cortex XDR

Palo Alto Networks Cortex XDR is a comprehensive detection and response platform that unifies endpoint, network, and cloud data to prevent and respond to threats.

Palo Alto Networks Cortex XDR is a comprehensive security platform that integrates endpoint, network, and cloud data to detect and respond to threats. This connector allows Swimlane Turbine users to automate advanced threat response and policy management tasks, such as retrieving alerts, managing incidents, and isolating endpoints. By integrating with Cortex XDR, users can enhance their security operations with streamlined workflows and real-time threat intelligence, improving incident response times and reducing manual effort.

Prerequisites

Before you can use the Palo Alto Networks Cortex XDR connector for Turbine, you'll need access to the Cortex XDR API. This requires the following:

Cortex custom authentication using the following parameters:

URL: The endpoint URL for accessing the Cortex XDR API.

Token: A valid token for authenticating API requests.

Cortex XDR API Key ID: The unique identifier for your Cortex XDR API key.

Asset Setup

Generating an API Token

Instructions for generating an API token can be found here

Capabilities

This connector provides the following capabilities:

Blacklist Files

Get Action Status

Get Alerts

Get All Endpoints

Get Endpoint

Get Incident Additional Data

Get Incidents

Get PCAP Packet

Get Policy

Get Script Code

Get Script Metadata

Get Scripts

Get Violations

Get XQL Query

Isolate Endpoints ... and so on

Notes

Get incidents filter syntax

Official filter syntax documentation This plugin was last tested against product version: API v1

Get Alerts Usage:

for filters creation_time and server_creation_time, value should be passed as a string in the array. the first element in value array is converted into integer before making the request. Input:

{
    "field": "creation_time",
    "operator": "lte",
    "value": ["0"]
}

The above input converts to:

{
    "field": "creation_time",
    "operator": "lte",
    "value": 0
}

Configurations

PALO ALTO CORTEX XDR Authentication

Authenticates using Cortex token and x-xdr-auth-id.

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
token	API token.	string	Required
x-xdr-auth-id	Cortex XDR API Key ID.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
advanced_authentication	Advanced Authentication	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Action Status

Retrieve the status of requested actions in Palo Alto Networks Cortex XDR using a specific action ID and provided request data.

Endpoint

URL: /public_api/v1/actions/get_action_status/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.group_action_id	string	Required	Response data

Input Example

{"request_data":{"group_action_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.data	object	Response data
reply.data.<agent ID>	string	Response data

Output Example

{"reply":{"data":{"<agent ID>":"string"}}}

Get Alerts

Obtain a comprehensive list of alerts from Palo Alto Networks Cortex XDR, potentially associated with multiple events.

Endpoint

URL: /public_api/v1/alerts/get_alerts_multi_events/

Method: POST

Input

Argument Name	Type	Required	Description
parameters.return_as_turbine_schema	boolean	Optional	When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Cortex XDR API response is returned.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].
request_data	object	Optional	Response data
request_data.filters	array	Optional	Response data
request_data.filters.field	string	Optional	Response data
request_data.filters.operator	string	Optional	Response data
request_data.filters.value	number	Optional	Response data
request_data.search_from	number	Optional	Response data
request_data.search_to	number	Optional	Response data
request_data.sort	object	Optional	Response data
request_data.sort.field	string	Optional	Response data
request_data.sort.keyword	string	Optional	Response data

Input Example

{"parameters":{"return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]},"request_data":{"filters":[{"field":"string","operator":"string","value":123}],"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Alerts	array	Normalized Turbine Schema alerts (when return_as_turbine_schema is true).
total_processed	integer	Number of Turbine Schema alerts returned.
total_count	number	Count value
result_count	number	Result of the operation

Output Example

{"Alerts":[],"total_processed":123,"total_count":123,"result_count":123}

Get Alerts v2

Obtain a comprehensive list of alerts with multiple events from Palo Alto Networks Cortex XDR using the v2 API endpoint.

Endpoint

URL: /public_api/v2/alerts/get_alerts_multi_events

Method: POST

Input

Argument Name	Type	Required	Description
parameters.return_as_turbine_schema	boolean	Optional	When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Cortex XDR API response is returned.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].
request_data	object	Optional	Response data
request_data.filters	array	Optional	Response data
request_data.filters.field	string	Optional	Response data
request_data.filters.operator	string	Optional	Response data
request_data.filters.value	number	Optional	Response data
request_data.search_from	number	Optional	Response data
request_data.search_to	number	Optional	Response data
request_data.sort	object	Optional	Response data
request_data.sort.field	string	Optional	Response data
request_data.sort.keyword	string	Optional	Response data

Input Example

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Alerts	array	Normalized Turbine Schema alerts (when return_as_turbine_schema is true).
total_processed	integer	Number of Turbine Schema alerts returned.
total_count	number	Count value
result_count	number	Result of the operation
resolution_status	string	Status value
resolution_comment	string	Output field: resolution_comment

Output Example

{"Alerts":[],"total_processed":123,"total_count":123,"result_count":123,"resolution_status":"active","resolution_comment":"string"}

Allow List Files

Add files to the allow list in Palo Alto Networks Cortex XDR using the provided request data.

Endpoint

URL: /public_api/v1/hash_exceptions/allowlist

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.hash_list	array	Required	Response data
request_data.comment	string	Optional	Response data
request_data.incident_id	number	Optional	Response data

Input Example

{"json_body":{"request_data":{"hash_list":["032196FB1A---DFCF69E5D553F0","365296EB1B---FCF29E5D553E4","365296EB1B---FCF69E3D553E4","365296EB1B---FCF69E5D553D4","365296EB1B---FCF79E5D553D4"],"comment":"test","incident_id":5}}}

Output Example

{"json_body":{}}

Get Endpoint

Retrieve a list of endpoints from Palo Alto Networks Cortex XDR using specified request data.

Endpoint

URL: /public_api/v1/endpoints/get_endpoint/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.search_from	number	Optional	Response data
request_data.search_to	number	Optional	Response data
request_data.sort	object	Optional	Response data
request_data.sort.field	string	Optional	Response data
request_data.sort.keyword	string	Optional	Response data
request_data.filters	array	Optional	Response data
request_data.filters.field	string	Optional	Response data
request_data.filters.operator	string	Optional	Response data
request_data.filters.value	array	Optional	Response data

Input Example

{"request_data":{"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"},"filters":[{"field":"string","operator":"string","value":["string"]}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.total_count	number	Count value
reply.result_count	number	Result of the operation
reply.endpoints	array	Output field: reply.endpoints
reply.endpoints.endpoint_id	string	Unique identifier
reply.endpoints.endpoint_name	string	Name of the resource
reply.endpoints.endpointTags	string	Output field: reply.endpoints.endpointTags
reply.endpoints.endpoint_type	string	Type of the resource
reply.endpoints.endpoint_status	string	Status value
reply.endpoints.os_type	string	Type of the resource
reply.endpoints.os_version	string	Output field: reply.endpoints.os_version
reply.endpoints.ip	array	Output field: reply.endpoints.ip
reply.endpoints.ipv6	array	Output field: reply.endpoints.ipv6
reply.endpoints.ipv6.file_name	string	Name of the resource
reply.endpoints.ipv6.file	string	Output field: reply.endpoints.ipv6.file
reply.endpoints.public_ip	string	Output field: reply.endpoints.public_ip
reply.endpoints.users	array	Output field: reply.endpoints.users
reply.endpoints.domain	string	Output field: reply.endpoints.domain
reply.endpoints.alias	string	Output field: reply.endpoints.alias
reply.endpoints.first_seen	number	Output field: reply.endpoints.first_seen
reply.endpoints.last_seen	number	Output field: reply.endpoints.last_seen
reply.endpoints.content_version	string	Response content
reply.endpoints.installation_package	string	Output field: reply.endpoints.installation_package

Output Example

{"reply":{"total_count":123,"result_count":123,"endpoints":[{}]}}

Get All Endpoints

Retrieve a comprehensive list of all endpoints from Palo Alto Networks Cortex XDR without requiring additional parameters.

Endpoint

URL: /public_api/v1/endpoints/get_endpoints/

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	array	Output field: reply
reply.agent_id	string	Unique identifier
reply.agent_status	string	Status value
reply.host_name	string	Name of the resource
reply.agent_type	string	Type of the resource
reply.endpointTags	string	Output field: reply.endpointTags
reply.ip	string	Output field: reply.ip
reply.last_seen	number	Output field: reply.last_seen
reply.tags	object	Output field: reply.tags
reply.tags.server_tags	array	Output field: reply.tags.server_tags
reply.tags.server_tags.file_name	string	Name of the resource
reply.tags.server_tags.file	string	Output field: reply.tags.server_tags.file
reply.tags.endpoint_tags	array	Output field: reply.tags.endpoint_tags
reply.tags.endpoint_tags.file_name	string	Name of the resource
reply.tags.endpoint_tags.file	string	Output field: reply.tags.endpoint_tags.file
reply.users	string	Output field: reply.users

Output Example

{"reply":[{"agent_id":"string","agent_status":"active","host_name":"Example Name","agent_type":"string","endpointTags":"string","ip":"string","last_seen":123,"tags":{},"users":"string"}]}

Get Incident Extra Data

Retrieve additional data, alerts, and artifacts for a specified incident in Palo Alto Networks Cortex XDR using the 'request_data' parameter.

Endpoint

URL: /public_api/v1/incidents/get_incident_extra_data/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.incident_id	string	Required	Response data
request_data.alerts_limit	number	Required	Response data

Input Example

{"request_data":{"incident_id":"string","alerts_limit":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.incident	object	Unique identifier
reply.incident.incident_id	string	Unique identifier
reply.incident.incident_name	string	Unique identifier
reply.incident.creation_time	number	Unique identifier
reply.incident.modification_time	number	Unique identifier
reply.incident.detection_time	object	Unique identifier
reply.incident.status	string	Unique identifier
reply.incident.severity	string	Unique identifier
reply.incident.description	string	Unique identifier
reply.incident.assigned_user_mail	object	Unique identifier
reply.incident.assigned_user_pretty_name	object	Unique identifier
reply.incident.alert_count	number	Unique identifier
reply.incident.low_severity_alert_count	number	Unique identifier
reply.incident.med_severity_alert_count	number	Unique identifier
reply.incident.high_severity_alert_count	number	Unique identifier
reply.incident.critical_severity_alert_count	number	Unique identifier
reply.incident.user_count	number	Unique identifier
reply.incident.host_count	number	Unique identifier
reply.incident.notes	object	Unique identifier
reply.incident.resolve_comment	object	Unique identifier
reply.incident.manual_severity	object	Unique identifier
reply.incident.manual_description	object	Unique identifier

Output Example

{"reply":{"incident":{"incident_id":"string","incident_name":"Example Name","creation_time":123,"modification_time":123,"detection_time":{},"status":"active","severity":"string","description":"string","assigned_user_mail":{},"assigned_user_pretty_name":{},"alert_count":123,"low_severity_alert_count":123,"med_severity_alert_count":123,"high_severity_alert_count":123,"critical_severity_alert_count":123},"alerts":{"total_count":123,"data":[]},"network_artifacts":{"total_count":123,"data":[]},"file_...

Get Incidents

Retrieve a filtered list of incidents from Palo Alto Networks Cortex XDR using specific criteria such as IDs and timestamps. Requires request_data in JSON body.

Endpoint

URL: /public_api/v1/incidents/get_incidents/

Method: POST

Input

Argument Name	Type	Required	Description
parameters.return_as_turbine_schema	boolean	Optional	When true, incidents are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Cortex XDR API response is returned.
parameters.alert_organization	string	Optional	Optional organization name to include in the Turbine Schema alert. Used only when return_as_turbine_schema is true.
parameters.ioc_types	array	Optional	List of observable types to extract. Supported: ipv4_public, ipv4_private, ipv6_public, ipv6_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted.
parameters.domains_ignore_list	string	Optional	Comma-separated domain values to exclude from observable extraction.
parameters.ip_cidr_ignore_list	string	Optional	Comma-separated CIDR ranges to exclude from observable extraction.
parameters.regex_ignore	string	Optional	Regex pattern — any observable value matching this pattern is excluded.
parameters.ioc_ignore_paths	array	Optional	Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards () and nested paths. Example: ["processCommandLine", "context//ipAddress"].
request_data	object	Optional	Response data
request_data.filters	array	Optional	Response data
request_data.filters.field	string	Optional	Response data
request_data.filters.operator	string	Optional	Response data
request_data.filters.value	array	Optional	Response data
request_data.search_from	number	Optional	Response data
request_data.search_to	number	Optional	Response data
request_data.sort	object	Optional	Response data
request_data.sort.field	string	Optional	Response data
request_data.sort.keyword	string	Optional	Response data

Input Example

{"parameters":{"return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]},"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}],"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
Alerts	array	Normalized Turbine Schema alerts (when return_as_turbine_schema is true).
total_processed	integer	Number of Turbine Schema alerts returned.
total_count	number	Count value
result_count	number	Result of the operation

Output Example

{"Alerts":[],"total_processed":123,"total_count":123,"result_count":123}

Isolate Endpoints

Isolate up to 1000 endpoints on Palo Alto Networks Cortex XDR using the 'request_data' parameter.

Endpoint

URL: /public_api/v1/endpoints/isolate

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.filters	array	Required	Array of filtered fields for isolating a number of endpoints at once. Only required if isolating more than one endpoint.
request_data.filters.field	string	Required	Identifies a list the filters match. Filters are based on the endpoint_id_list keywords.
request_data.filters.operator	string	Required	Identifies the comparison operator you want to use for this filter. Valid keywords and values.
request_data.filters.value	array	Required	Value that this filter must match.
request_data.incident_id	string	Optional	The incident ID. When included in the request, the Isolate Endpoints action will appear in the Cortex XDR Incident ViewTimeline tab.

Input Example

{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["id1_123ab","id2_123bc"]}],"incident_id":"123a"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.action_id	string	Unique identifier
reply.status	string	Status value
reply.endpoints_count	string	Count value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"reply":{"action_id":"<action ID>","status":"1","endpoints_count":"673"}}}

Retrive PCAP Packet

Retrieve PCAP packets linked to alert IDs from Palo Alto Networks NGFW using APIs for detailed incident data. Requires request_data in JSON body.

Endpoint

URL: /public_api/v1/alerts/get_alerts_pcap/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.filters	array	Optional	Response data
request_data.filters.field	string	Optional	Response data
request_data.filters.operator	string	Optional	Response data
request_data.filters.value	array	Optional	Response data
request_data.search_from	number	Optional	Response data
request_data.search_to	number	Optional	Response data
request_data.sort	object	Optional	Response data
request_data.sort.field	string	Optional	Response data
request_data.sort.keyword	string	Optional	Response data

Input Example

{"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}],"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	array	Output field: reply
reply.id	number	Unique identifier
reply.pcap_data	string	Response data

Output Example

{"reply":[{"id":123,"pcap_data":"string"}]}

Get Policy

Retrieve the policy name for a specific endpoint in Palo Alto Networks Cortex XDR using the provided request data.

Endpoint

URL: /public_api/v1/endpoints/get_policy/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.endpoint_id	string	Required	Response data

Input Example

{"request_data":{"endpoint_id":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.policy_name	string	Name of the resource

Output Example

{"reply":{"policy_name":"Example Name"}}

Quarantine Files

Quarantine files on up to 1000 endpoints in Cortex XDR. If a file is not found, no action occurs. Verify quarantine status in the Action Center. Requires request_data in JSON body.

Endpoint

URL: /public_api/v1/endpoints/quarantine

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.filters	array	Required	Array of filter objects to select the endpoints to quarantine the file on. Filters are combined using AND. Maximum result set size is 1000.
request_data.filters.field	string	Required	Identifies the list the filter matches. Filters are based on the endpoint_id_list keyword.
request_data.filters.operator	string	Required	Identifies the comparison operator to use for this filter.
request_data.filters.value	array	Required	Value that this filter must match.
request_data.file_path	string	Required	The full path to the file to quarantine on the endpoint.
request_data.file_hash	string	Required	The hash value of the file to quarantine.

Input Example

{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["<endpoint ID>"]}],"file_path":"C:\\<file path>\\test_x64.msi","file_hash":"<hash value>"}}}

Output

Parameter	Type	Description
reply	object	Output field: reply
reply.action_id	string	ID of the action to quarantine the selected endpoints. Use this ID to track the action status in the Cortex XDR Action Center or via the Get Action Status API.
reply.status	string	Integer representing whether the action succeeded (1) or failed (0).
reply.endpoints_count	string	Number of endpoints included in the request.

Output Example

{"json_body":{"reply":{"action_id":"[ID value]","status":"1","endpoints_count":"673"}}}

Restore File

Restores a quarantined file on specified endpoints within Palo Alto Networks Cortex XDR using the provided request data.

Endpoint

URL: /public_api/v1/endpoints/restore

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.file_hash	string	Required	Response data
request_data.incident_id	number	Optional	Response data

Input Example

{"json_body":{"request_data":{"file_hash":"<hash value>","incident_id":302}}}

Output

Parameter	Type	Description
reply	object	Output field: reply
reply.action_id	string	Unique identifier
reply.status	number	Status value
reply.endpoints_count	string	Count value

Output Example

{"json_body":{"reply":{"action_id":"<action ID>","status":1,"endpoints_count":"673"}}}

Get Scripts

Retrieve all scripts from the Palo Alto Networks Cortex XDR library using specified request data.

Endpoint

URL: /public_api/v1/scripts/get_scripts/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.filters	array	Optional	Response data
request_data.filters.field	string	Optional	Response data
request_data.filters.operator	string	Optional	Response data
request_data.filters.value	array	Optional	Response data

Input Example

{"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.total_count	number	Count value
reply.result_count	number	Result of the operation
reply.scripts	array	Output field: reply.scripts
reply.scripts.script_id	string	Unique identifier
reply.scripts.name	string	Name of the resource
reply.scripts.description	string	Output field: reply.scripts.description
reply.scripts.modification_date	number	Date value
reply.scripts.created_by	string	Output field: reply.scripts.created_by
reply.scripts.is_high_risk	boolean	Output field: reply.scripts.is_high_risk
reply.scripts.windows_supported	boolean	Output field: reply.scripts.windows_supported
reply.scripts.linux_supported	boolean	Output field: reply.scripts.linux_supported
reply.scripts.macos_supported	boolean	Output field: reply.scripts.macos_supported
reply.scripts.script_uid	string	Unique identifier

Output Example

{"reply":{"total_count":123,"result_count":123,"scripts":[{}]}}

Get Script Code

Retrieve the source code of a specified script from the Palo Alto Networks Cortex XDR library using request data.

Endpoint

URL: /public_api/v1/scripts/get_script_code/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.script_uid	string	Required	Response data

Input Example

{"request_data":{"script_uid":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	string	Output field: reply

Output Example

{"reply":"string"}

Get Script Metadata

Retrieve script definitions from the Palo Alto Networks Cortex XDR library using specified request data.

Endpoint

URL: /public_api/v1/scripts/get_script_metadata/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.script_uid	string	Optional	Response data

Input Example

{"request_data":{"script_uid":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.script_id	string	Unique identifier
reply.name	string	Name of the resource
reply.description	string	Output field: reply.description
reply.modification_date	number	Date value
reply.created_by	string	Output field: reply.created_by
reply.is_high_risk	boolean	Output field: reply.is_high_risk
reply.windows_supported	boolean	Output field: reply.windows_supported
reply.linux_supported	boolean	Output field: reply.linux_supported
reply.macos_supported	boolean	Output field: reply.macos_supported
reply.script_uid	string	Unique identifier
reply.entry_point	string	Output field: reply.entry_point
reply.script_input	array	Input data for the action
reply.script_input.name	string	Input data for the action
reply.script_input.type	string	Input data for the action
reply.script_input.friendly_name	string	Input data for the action
reply.script_output_type	string	Type of the resource
reply.script_output_dictionary_definitions	array	Output field: reply.script_output_dictionary_definitions
reply.script_output_dictionary_definitions.friendly_name	string	Name of the resource
reply.script_output_dictionary_definitions.name	string	Name of the resource
reply.script_output_dictionary_definitions.type	string	Type of the resource

Output Example

{"reply":{"script_id":"string","name":"Example Name","description":"string","modification_date":123,"created_by":"string","is_high_risk":true,"windows_supported":true,"linux_supported":true,"macos_supported":true,"script_uid":"string","entry_point":"string","script_input":[{}],"script_output_type":"string","script_output_dictionary_definitions":[{}]}}

Unisolate Endpoints

Reverses isolation for up to 1000 endpoints in Palo Alto Networks Cortex XDR using specified request data.

Endpoint

URL: /public_api/v1/endpoints/unisolate

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.filters	array	Required	An array of filter fields for unisolating a number of endpoints at once. This field is only required if unisolating more than one endpoint.
request_data.filters.field	string	Required	String that identifies a list the filters match. Filters are based on the endpoint_id_list keywords
request_data.filters.operator	string	Required	String that identifies the comparison operator you want to use for this filter. Valid keywords and values.
request_data.filters.value	array	Required	Value that this filter must match. Valid keywords.
request_data.incident_id	string	Optional	Response data

Input Example

{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"IN","value":["id1_123ab","id2_123bc"]}],"incident_id":"123a"}}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.action_id	string	Unique identifier
reply.status	string	Status value
reply.endpoints_count	string	Count value

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"reply":{"action_id":"<action ID>","status":"1","endpoints_count":"673"}}}

Update Incident

Update specific incident fields in Palo Alto Networks Cortex XDR, ignoring missing fields. Use empty strings to unassign users or remove manual severity.

Endpoint

URL: /public_api/v1/incidents/update_incident

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	A dictionary containing the API request fields.
request_data.incident_id	string	Required	A string representing the incident ID you want to update.
request_data.update_data	object	Optional	The data to update the incident with. You can also include custom incident fields as additional properties. Custom field names must be lowercase with no white spaces (e.g. "Single Select" becomes "singleselect").
request_data.update_data.assigned_user_mail	string	Optional	Email address of the user to assign the incident to. Must belong to a user that exists in the same Cortex XDR tenant. Pass an empty string to unassign the incident.
request_data.update_data.manual_severity	string	Optional	Manually set severity for the incident. Valid values are informational, low, medium, high, critical. Pass an empty string to remove a manually set severity.
request_data.update_data.status	string	Optional	The status of the incident.
request_data.update_data.resolve_comment	string	Optional	A comment explaining why the incident was resolved.
request_data.update_data.comment	object	Optional	Add a comment to the incident.
request_data.update_data.comment.comment_action	string	Optional	The comment action. Must be 'add'.
request_data.update_data.comment.value	string	Optional	The comment text.
request_data.update_data.notes	string	Optional	Notes to add to the incident.

Input Example

{"json_body":{"request_data":{"incident_id":"2927","update_data":{"assigned_user_mail":"[email protected]","manual_severity":"low","status":"resolved_other","resolve_comment":"This incident is resolved"}}}}

Output Example

{"json_body":false}

Get Violations

Retrieve up to 100 device control violations from Palo Alto Networks Cortex XDR using specified request data filters.

Endpoint

URL: /public_api/v1/device_control/get_violations/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.filters	array	Optional	Response data
request_data.filters.field	string	Optional	Response data
request_data.filters.operator	string	Optional	Response data
request_data.filters.value	array	Optional	Response data
request_data.search_to	number	Optional	Response data

Input Example

{"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}],"search_to":123}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.total_count	number	Count value
reply.result_count	number	Result of the operation
reply.violations	array	Output field: reply.violations
reply.violations.hostname	string	Name of the resource
reply.violations.username	string	Name of the resource
reply.violations.ip	string	Output field: reply.violations.ip
reply.violations.timestamp	number	Output field: reply.violations.timestamp
reply.violations.violation_id	number	Unique identifier
reply.violations.type	string	Type of the resource
reply.violations.vendor_id	string	Unique identifier
reply.violations.vendor	string	Output field: reply.violations.vendor
reply.violations.product_id	string	Unique identifier
reply.violations.product	string	Output field: reply.violations.product
reply.violations.serial	string	Output field: reply.violations.serial
reply.violations.endpoint_id	string	Unique identifier

Output Example

{"reply":{"total_count":123,"result_count":123,"violations":[{}]}}

Get XQL Query Results

Retrieve results of a prior XQL query in Palo Alto Networks Cortex XDR using the specified query ID and request data.

Endpoint

URL: /public_api/v1/xql/get_query_results/

Method: POST

Input

Argument Name	Type	Required	Description
request_data	object	Optional	Response data
request_data.query_id	string	Optional	Response data
request_data.pending_flag	boolean	Optional	Response data
request_data.limit	number	Optional	Response data
request_data.format	string	Optional	Response data

Input Example

{"request_data":{"query_id":"string","pending_flag":true,"limit":123,"format":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
reply	object	Output field: reply
reply.status	string	Status value
reply.number_of_results	number	Result of the operation
reply.query_cost	object	Output field: reply.query_cost
reply.query_cost.tenant_id_1	number	Unique identifier
reply.remaining_quota	number	Output field: reply.remaining_quota
reply.results	object	Result of the operation
reply.results.data	array	Response data
reply.results.data.event_id	string	Response data
reply.results.data._vendor	string	Response data
reply.results.data._product	string	Response data
reply.results.data.insert_timestamp	number	Response data
reply.results.data._time	number	Response data
reply.results.data.event_type	string	Response data
reply.results.data.event_sub_type	string	Response data

Output Example

{"reply":{"status":"active","number_of_results":123,"query_cost":{"tenant_id_1":123},"remaining_quota":123,"results":{"data":[]}}}

Response Headers

Header	Description	Example
cache-control	Directives for caching mechanisms
Connection	HTTP response header: Connection
content-encoding	HTTP response header: content-encoding
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT
RateLimit-Limit	HTTP response header: RateLimit-Limit
RateLimit-Remaining	HTTP response header: RateLimit-Remaining
RateLimit-Reset	HTTP response header: RateLimit-Reset
Strict-Transport-Security	HTTP response header: Strict-Transport-Security
Transfer-Encoding	HTTP response header: Transfer-Encoding
vary	HTTP response header: vary
X-Content-Type-Options	HTTP response header: X-Content-Type-Options
X-Frame-Options	HTTP response header: X-Frame-Options
X-RateLimit-Limit-1800	HTTP response header: X-RateLimit-Limit-1800
X-RateLimit-Limit-minute	HTTP response header: X-RateLimit-Limit-minute
X-RateLimit-Limit-second	HTTP response header: X-RateLimit-Limit-second
X-RateLimit-Remaining-1800	HTTP response header: X-RateLimit-Remaining-1800
X-RateLimit-Remaining-minute	HTTP response header: X-RateLimit-Remaining-minute
X-RateLimit-Remaining-second	HTTP response header: X-RateLimit-Remaining-second
X-XSS-Protection	HTTP response header: X-XSS-Protection