--- title: Palo Alto Networks Cortex XDR slug: connectors/palo-alto-networks-cortex-xdr docTags: createdAt: 2026-06-09T16:29:53.239Z --- Palo Alto Networks Cortex XDR is a comprehensive detection and response platform that unifies endpoint, network, and cloud data to prevent and respond to threats. Palo Alto Networks Cortex XDR is a comprehensive security platform that integrates endpoint, network, and cloud data to detect and respond to threats. This connector allows Swimlane Turbine users to automate advanced threat response and policy management tasks, such as retrieving alerts, managing incidents, and isolating endpoints. By integrating with Cortex XDR, users can enhance their security operations with streamlined workflows and real-time threat intelligence, improving incident response times and reducing manual effort. ## Prerequisites Before you can use the Palo Alto Networks Cortex XDR connector for Turbine, you'll need access to the Cortex XDR API. This requires the following: - Cortex custom authentication using the following parameters: - URL: The endpoint URL for accessing the Cortex XDR API. - Token: A valid token for authenticating API requests. - Cortex XDR API Key ID: The unique identifier for your Cortex XDR API key. ## Asset Setup ### Generating an API Token - Instructions for generating an API token can be found [here](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.html) ## Capabilities This connector provides the following capabilities: - Blacklist Files - Get Action Status - Get Alerts - Get All Endpoints - Get Endpoint - Get Incident Additional Data - Get Incidents - Get PCAP Packet - Get Policy - Get Script Code - Get Script Metadata - Get Scripts - Get Violations - Get XQL Query - Isolate Endpoints *... and so on* ## Notes ## Get incidents filter syntax [Official filter syntax documentation](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-incidents) This plugin was last tested against product version: API v1 ## Get Alerts Usage: for filters `creation_time` and `server_creation_time`, value should be passed as a string in the array. the first element in value array is converted into integer before making the request. *Input:* ```javascript { "field": "creation_time", "operator": "lte", "value": ["0"] } ``` The above input converts to: ```javascript { "field": "creation_time", "operator": "lte", "value": 0 } ``` # Configurations ## PALO ALTO CORTEX XDR Authentication Authenticates using Cortex token and x-xdr-auth-id. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------------------ | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | API token. | string | Required | | x-xdr-auth-id | Cortex XDR API Key ID. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | advanced\_authentication | Advanced Authentication | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Action Status Retrieve the status of requested actions in Palo Alto Networks Cortex XDR using a specific action ID and provided request data. ### Endpoint - **URL:** `/public_api/v1/actions/get_action_status/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.group_action_id` | string | Required | Response data | ### Input Example `{"request_data":{"group_action_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.data` | object | Response data | | `reply.data.` | string | Response data | ### Output Example `{"reply":{"data":{"":"string"}}}` ## Get Alerts Obtain a comprehensive list of alerts from Palo Alto Networks Cortex XDR, potentially associated with multiple events. ### Endpoint - **URL:** `/public_api/v1/alerts/get_alerts_multi_events/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Cortex XDR API response is returned. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | | `request_data` | object | Optional | Response data | | `request_data.filters` | array | Optional | Response data | | `request_data.filters.field` | string | Optional | Response data | | `request_data.filters.operator` | string | Optional | Response data | | `request_data.filters.value` | number | Optional | Response data | | `request_data.search_from` | number | Optional | Response data | | `request_data.search_to` | number | Optional | Response data | | `request_data.sort` | object | Optional | Response data | | `request_data.sort.field` | string | Optional | Response data | | `request_data.sort.keyword` | string | Optional | Response data | ### Input Example `{"parameters":{"return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]},"request_data":{"filters":[{"field":"string","operator":"string","value":123}],"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | ---------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Alerts` | array | Normalized Turbine Schema alerts (when return\_as\_turbine\_schema is true). | | `total_processed` | integer | Number of Turbine Schema alerts returned. | | `total_count` | number | Count value | | `result_count` | number | Result of the operation | ### Output Example `{"Alerts":[],"total_processed":123,"total_count":123,"result_count":123}` ## Get Alerts v2 Obtain a comprehensive list of alerts with multiple events from Palo Alto Networks Cortex XDR using the v2 API endpoint. ### Endpoint - **URL:** `/public_api/v2/alerts/get_alerts_multi_events` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, alerts are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Cortex XDR API response is returned. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | | `request_data` | object | Optional | Response data | | `request_data.filters` | array | Optional | Response data | | `request_data.filters.field` | string | Optional | Response data | | `request_data.filters.operator` | string | Optional | Response data | | `request_data.filters.value` | number | Optional | Response data | | `request_data.search_from` | number | Optional | Response data | | `request_data.search_to` | number | Optional | Response data | | `request_data.sort` | object | Optional | Response data | | `request_data.sort.field` | string | Optional | Response data | | `request_data.sort.keyword` | string | Optional | Response data | ### Input Example `{"parameters":{"return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]},"request_data":{"filters":[{"field":"string","operator":"string","value":123}],"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | ---------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Alerts` | array | Normalized Turbine Schema alerts (when return\_as\_turbine\_schema is true). | | `total_processed` | integer | Number of Turbine Schema alerts returned. | | `total_count` | number | Count value | | `result_count` | number | Result of the operation | | `resolution_status` | string | Status value | | `resolution_comment` | string | Output field: resolution\_comment | ### Output Example `{"Alerts":[],"total_processed":123,"total_count":123,"result_count":123,"resolution_status":"active","resolution_comment":"string"}` ## Allow List Files Add files to the allow list in Palo Alto Networks Cortex XDR using the provided request data. ### Endpoint - **URL:** `/public_api/v1/hash_exceptions/allowlist` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.hash_list` | array | Required | Response data | | `request_data.comment` | string | Optional | Response data | | `request_data.incident_id` | number | Optional | Response data | ### Input Example `{"json_body":{"request_data":{"hash_list":["032196FB1A---DFCF69E5D553F0","365296EB1B---FCF29E5D553E4","365296EB1B---FCF69E3D553E4","365296EB1B---FCF69E5D553D4","365296EB1B---FCF79E5D553D4"],"comment":"test","incident_id":5}}}` ### Output Example `{"json_body":{}}` ## Get Endpoint Retrieve a list of endpoints from Palo Alto Networks Cortex XDR using specified request data. ### Endpoint - **URL:** `/public_api/v1/endpoints/get_endpoint/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.search_from` | number | Optional | Response data | | `request_data.search_to` | number | Optional | Response data | | `request_data.sort` | object | Optional | Response data | | `request_data.sort.field` | string | Optional | Response data | | `request_data.sort.keyword` | string | Optional | Response data | | `request_data.filters` | array | Optional | Response data | | `request_data.filters.field` | string | Optional | Response data | | `request_data.filters.operator` | string | Optional | Response data | | `request_data.filters.value` | array | Optional | Response data | ### Input Example `{"request_data":{"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"},"filters":[{"field":"string","operator":"string","value":["string"]}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | --------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.total_count` | number | Count value | | `reply.result_count` | number | Result of the operation | | `reply.endpoints` | array | Output field: reply.endpoints | | `reply.endpoints.endpoint_id` | string | Unique identifier | | `reply.endpoints.endpoint_name` | string | Name of the resource | | `reply.endpoints.endpointTags` | string | Output field: reply.endpoints.endpointTags | | `reply.endpoints.endpoint_type` | string | Type of the resource | | `reply.endpoints.endpoint_status` | string | Status value | | `reply.endpoints.os_type` | string | Type of the resource | | `reply.endpoints.os_version` | string | Output field: reply.endpoints.os\_version | | `reply.endpoints.ip` | array | Output field: reply.endpoints.ip | | `reply.endpoints.ipv6` | array | Output field: reply.endpoints.ipv6 | | `reply.endpoints.ipv6.file_name` | string | Name of the resource | | `reply.endpoints.ipv6.file` | string | Output field: reply.endpoints.ipv6.file | | `reply.endpoints.public_ip` | string | Output field: reply.endpoints.public\_ip | | `reply.endpoints.users` | array | Output field: reply.endpoints.users | | `reply.endpoints.domain` | string | Output field: reply.endpoints.domain | | `reply.endpoints.alias` | string | Output field: reply.endpoints.alias | | `reply.endpoints.first_seen` | number | Output field: reply.endpoints.first\_seen | | `reply.endpoints.last_seen` | number | Output field: reply.endpoints.last\_seen | | `reply.endpoints.content_version` | string | Response content | | `reply.endpoints.installation_package` | string | Output field: reply.endpoints.installation\_package | ### Output Example `{"reply":{"total_count":123,"result_count":123,"endpoints":[{}]}}` ## Get All Endpoints Retrieve a comprehensive list of all endpoints from Palo Alto Networks Cortex XDR without requiring additional parameters. ### Endpoint - **URL:** `/public_api/v1/endpoints/get_endpoints/` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | array | Output field: reply | | `reply.agent_id` | string | Unique identifier | | `reply.agent_status` | string | Status value | | `reply.host_name` | string | Name of the resource | | `reply.agent_type` | string | Type of the resource | | `reply.endpointTags` | string | Output field: reply.endpointTags | | `reply.ip` | string | Output field: reply.ip | | `reply.last_seen` | number | Output field: reply.last\_seen | | `reply.tags` | object | Output field: reply.tags | | `reply.tags.server_tags` | array | Output field: reply.tags.server\_tags | | `reply.tags.server_tags.file_name` | string | Name of the resource | | `reply.tags.server_tags.file` | string | Output field: reply.tags.server\_tags.file | | `reply.tags.endpoint_tags` | array | Output field: reply.tags.endpoint\_tags | | `reply.tags.endpoint_tags.file_name` | string | Name of the resource | | `reply.tags.endpoint_tags.file` | string | Output field: reply.tags.endpoint\_tags.file | | `reply.users` | string | Output field: reply.users | ### Output Example `{"reply":[{"agent_id":"string","agent_status":"active","host_name":"Example Name","agent_type":"string","endpointTags":"string","ip":"string","last_seen":123,"tags":{},"users":"string"}]}` ## Get Incident Extra Data Retrieve additional data, alerts, and artifacts for a specified incident in Palo Alto Networks Cortex XDR using the 'request\_data' parameter. ### Endpoint - **URL:** `/public_api/v1/incidents/get_incident_extra_data/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.incident_id` | string | Required | Response data | | `request_data.alerts_limit` | number | Required | Response data | ### Input Example `{"request_data":{"incident_id":"string","alerts_limit":123}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.incident` | object | Unique identifier | | `reply.incident.incident_id` | string | Unique identifier | | `reply.incident.incident_name` | string | Unique identifier | | `reply.incident.creation_time` | number | Unique identifier | | `reply.incident.modification_time` | number | Unique identifier | | `reply.incident.detection_time` | object | Unique identifier | | `reply.incident.status` | string | Unique identifier | | `reply.incident.severity` | string | Unique identifier | | `reply.incident.description` | string | Unique identifier | | `reply.incident.assigned_user_mail` | object | Unique identifier | | `reply.incident.assigned_user_pretty_name` | object | Unique identifier | | `reply.incident.alert_count` | number | Unique identifier | | `reply.incident.low_severity_alert_count` | number | Unique identifier | | `reply.incident.med_severity_alert_count` | number | Unique identifier | | `reply.incident.high_severity_alert_count` | number | Unique identifier | | `reply.incident.critical_severity_alert_count` | number | Unique identifier | | `reply.incident.user_count` | number | Unique identifier | | `reply.incident.host_count` | number | Unique identifier | | `reply.incident.notes` | object | Unique identifier | | `reply.incident.resolve_comment` | object | Unique identifier | | `reply.incident.manual_severity` | object | Unique identifier | | `reply.incident.manual_description` | object | Unique identifier | ### Output Example `{"reply":{"incident":{"incident_id":"string","incident_name":"Example Name","creation_time":123,"modification_time":123,"detection_time":{},"status":"active","severity":"string","description":"string","assigned_user_mail":{},"assigned_user_pretty_name":{},"alert_count":123,"low_severity_alert_count":123,"med_severity_alert_count":123,"high_severity_alert_count":123,"critical_severity_alert_count":123},"alerts":{"total_count":123,"data":[]},"network_artifacts":{"total_count":123,"data":[]},"file_...` ## Get Incidents Retrieve a filtered list of incidents from Palo Alto Networks Cortex XDR using specific criteria such as IDs and timestamps. Requires request\_data in JSON body. ### Endpoint - **URL:** `/public_api/v1/incidents/get_incidents/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.return_as_turbine_schema` | boolean | Optional | When true, incidents are mapped to normalized Turbine Schema alert objects and returned in the Alerts field. When false, the raw Cortex XDR API response is returned. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | | `request_data` | object | Optional | Response data | | `request_data.filters` | array | Optional | Response data | | `request_data.filters.field` | string | Optional | Response data | | `request_data.filters.operator` | string | Optional | Response data | | `request_data.filters.value` | array | Optional | Response data | | `request_data.search_from` | number | Optional | Response data | | `request_data.search_to` | number | Optional | Response data | | `request_data.sort` | object | Optional | Response data | | `request_data.sort.field` | string | Optional | Response data | | `request_data.sort.keyword` | string | Optional | Response data | ### Input Example `{"parameters":{"return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]},"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}],"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | ---------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Alerts` | array | Normalized Turbine Schema alerts (when return\_as\_turbine\_schema is true). | | `total_processed` | integer | Number of Turbine Schema alerts returned. | | `total_count` | number | Count value | | `result_count` | number | Result of the operation | ### Output Example `{"Alerts":[],"total_processed":123,"total_count":123,"result_count":123}` ## Isolate Endpoints Isolate up to 1000 endpoints on Palo Alto Networks Cortex XDR using the 'request\_data' parameter. ### Endpoint - **URL:** `/public_api/v1/endpoints/isolate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------ | | `request_data` | object | Optional | A dictionary containing the API request fields. | | `request_data.filters` | array | Required | Array of filtered fields for isolating a number of endpoints at once. Only required if isolating more than one endpoint. | | `request_data.filters.field` | string | Required | Identifies a list the filters match. Filters are based on the endpoint\_id\_list keywords. | | `request_data.filters.operator` | string | Required | Identifies the comparison operator you want to use for this filter. Valid keywords and values. | | `request_data.filters.value` | array | Required | Value that this filter must match. | | `request_data.incident_id` | string | Optional | The incident ID. When included in the request, the Isolate Endpoints action will appear in the Cortex XDR Incident ViewTimeline tab. | ### Input Example `{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["id1_123ab","id2_123bc"]}],"incident_id":"123a"}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.action_id` | string | Unique identifier | | `reply.status` | string | Status value | | `reply.endpoints_count` | string | Count value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"reply":{"action_id":"","status":"1","endpoints_count":"673"}}}` ## Retrive PCAP Packet Retrieve PCAP packets linked to alert IDs from Palo Alto Networks NGFW using APIs for detailed incident data. Requires request\_data in JSON body. ### Endpoint - **URL:** `/public_api/v1/alerts/get_alerts_pcap/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.filters` | array | Optional | Response data | | `request_data.filters.field` | string | Optional | Response data | | `request_data.filters.operator` | string | Optional | Response data | | `request_data.filters.value` | array | Optional | Response data | | `request_data.search_from` | number | Optional | Response data | | `request_data.search_to` | number | Optional | Response data | | `request_data.sort` | object | Optional | Response data | | `request_data.sort.field` | string | Optional | Response data | | `request_data.sort.keyword` | string | Optional | Response data | ### Input Example `{"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}],"search_from":123,"search_to":123,"sort":{"field":"string","keyword":"string"}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | array | Output field: reply | | `reply.id` | number | Unique identifier | | `reply.pcap_data` | string | Response data | ### Output Example `{"reply":[{"id":123,"pcap_data":"string"}]}` ## Get Policy Retrieve the policy name for a specific endpoint in Palo Alto Networks Cortex XDR using the provided request data. ### Endpoint - **URL:** `/public_api/v1/endpoints/get_policy/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.endpoint_id` | string | Required | Response data | ### Input Example `{"request_data":{"endpoint_id":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.policy_name` | string | Name of the resource | ### Output Example `{"reply":{"policy_name":"Example Name"}}` ## Quarantine Files Quarantine files on up to 1000 endpoints in Cortex XDR. If a file is not found, no action occurs. Verify quarantine status in the Action Center. Requires request\_data in JSON body. ### Endpoint - **URL:** `/public_api/v1/endpoints/quarantine` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | `request_data` | object | Optional | A dictionary containing the API request fields. | | `request_data.filters` | array | Required | Array of filter objects to select the endpoints to quarantine the file on. Filters are combined using AND. Maximum result set size is 1000. | | `request_data.filters.field` | string | Required | Identifies the list the filter matches. Filters are based on the endpoint\_id\_list keyword. | | `request_data.filters.operator` | string | Required | Identifies the comparison operator to use for this filter. | | `request_data.filters.value` | array | Required | Value that this filter must match. | | `request_data.file_path` | string | Required | The full path to the file to quarantine on the endpoint. | | `request_data.file_hash` | string | Required | The hash value of the file to quarantine. | ### Input Example `{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":[""]}],"file_path":"C:\\\\test_x64.msi","file_hash":""}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `reply` | object | Output field: reply | | `reply.action_id` | string | ID of the action to quarantine the selected endpoints. Use this ID to track the action status in the Cortex XDR Action Center or via the Get Action Status API. | | `reply.status` | string | Integer representing whether the action succeeded (1) or failed (0). | | `reply.endpoints_count` | string | Number of endpoints included in the request. | ### Output Example `{"json_body":{"reply":{"action_id":"[ID value]","status":"1","endpoints_count":"673"}}}` ## Restore File Restores a quarantined file on specified endpoints within Palo Alto Networks Cortex XDR using the provided request data. ### Endpoint - **URL:** `/public_api/v1/endpoints/restore` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.file_hash` | string | Required | Response data | | `request_data.incident_id` | number | Optional | Response data | ### Input Example `{"json_body":{"request_data":{"file_hash":"","incident_id":302}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ------------------- | | `reply` | object | Output field: reply | | `reply.action_id` | string | Unique identifier | | `reply.status` | number | Status value | | `reply.endpoints_count` | string | Count value | ### Output Example `{"json_body":{"reply":{"action_id":"","status":1,"endpoints_count":"673"}}}` ## Get Scripts Retrieve all scripts from the Palo Alto Networks Cortex XDR library using specified request data. ### Endpoint - **URL:** `/public_api/v1/scripts/get_scripts/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.filters` | array | Optional | Response data | | `request_data.filters.field` | string | Optional | Response data | | `request_data.filters.operator` | string | Optional | Response data | | `request_data.filters.value` | array | Optional | Response data | ### Input Example `{"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.total_count` | number | Count value | | `reply.result_count` | number | Result of the operation | | `reply.scripts` | array | Output field: reply.scripts | | `reply.scripts.script_id` | string | Unique identifier | | `reply.scripts.name` | string | Name of the resource | | `reply.scripts.description` | string | Output field: reply.scripts.description | | `reply.scripts.modification_date` | number | Date value | | `reply.scripts.created_by` | string | Output field: reply.scripts.created\_by | | `reply.scripts.is_high_risk` | boolean | Output field: reply.scripts.is\_high\_risk | | `reply.scripts.windows_supported` | boolean | Output field: reply.scripts.windows\_supported | | `reply.scripts.linux_supported` | boolean | Output field: reply.scripts.linux\_supported | | `reply.scripts.macos_supported` | boolean | Output field: reply.scripts.macos\_supported | | `reply.scripts.script_uid` | string | Unique identifier | ### Output Example `{"reply":{"total_count":123,"result_count":123,"scripts":[{}]}}` ## Get Script Code Retrieve the source code of a specified script from the Palo Alto Networks Cortex XDR library using request data. ### Endpoint - **URL:** `/public_api/v1/scripts/get_script_code/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.script_uid` | string | Required | Response data | ### Input Example `{"request_data":{"script_uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | string | Output field: reply | ### Output Example `{"reply":"string"}` ## Get Script Metadata Retrieve script definitions from the Palo Alto Networks Cortex XDR library using specified request data. ### Endpoint - **URL:** `/public_api/v1/scripts/get_script_metadata/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.script_uid` | string | Optional | Response data | ### Input Example `{"request_data":{"script_uid":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------------------------- | -------- | ----------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.script_id` | string | Unique identifier | | `reply.name` | string | Name of the resource | | `reply.description` | string | Output field: reply.description | | `reply.modification_date` | number | Date value | | `reply.created_by` | string | Output field: reply.created\_by | | `reply.is_high_risk` | boolean | Output field: reply.is\_high\_risk | | `reply.windows_supported` | boolean | Output field: reply.windows\_supported | | `reply.linux_supported` | boolean | Output field: reply.linux\_supported | | `reply.macos_supported` | boolean | Output field: reply.macos\_supported | | `reply.script_uid` | string | Unique identifier | | `reply.entry_point` | string | Output field: reply.entry\_point | | `reply.script_input` | array | Input data for the action | | `reply.script_input.name` | string | Input data for the action | | `reply.script_input.type` | string | Input data for the action | | `reply.script_input.friendly_name` | string | Input data for the action | | `reply.script_output_type` | string | Type of the resource | | `reply.script_output_dictionary_definitions` | array | Output field: reply.script\_output\_dictionary\_definitions | | `reply.script_output_dictionary_definitions.friendly_name` | string | Name of the resource | | `reply.script_output_dictionary_definitions.name` | string | Name of the resource | | `reply.script_output_dictionary_definitions.type` | string | Type of the resource | ### Output Example `{"reply":{"script_id":"string","name":"Example Name","description":"string","modification_date":123,"created_by":"string","is_high_risk":true,"windows_supported":true,"linux_supported":true,"macos_supported":true,"script_uid":"string","entry_point":"string","script_input":[{}],"script_output_type":"string","script_output_dictionary_definitions":[{}]}}` ## Unisolate Endpoints Reverses isolation for up to 1000 endpoints in Palo Alto Networks Cortex XDR using specified request data. ### Endpoint - **URL:** `/public_api/v1/endpoints/unisolate` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | `request_data` | object | Optional | A dictionary containing the API request fields. | | `request_data.filters` | array | Required | An array of filter fields for unisolating a number of endpoints at once. This field is only required if unisolating more than one endpoint. | | `request_data.filters.field` | string | Required | String that identifies a list the filters match. Filters are based on the endpoint\_id\_list keywords | | `request_data.filters.operator` | string | Required | String that identifies the comparison operator you want to use for this filter. Valid keywords and values. | | `request_data.filters.value` | array | Required | Value that this filter must match. Valid keywords. | | `request_data.incident_id` | string | Optional | Response data | ### Input Example `{"json_body":{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"IN","value":["id1_123ab","id2_123bc"]}],"incident_id":"123a"}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.action_id` | string | Unique identifier | | `reply.status` | string | Status value | | `reply.endpoints_count` | string | Count value | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"reply":{"action_id":"","status":"1","endpoints_count":"673"}}}` ## Update Incident Update specific incident fields in Palo Alto Networks Cortex XDR, ignoring missing fields. Use empty strings to unassign users or remove manual severity. ### Endpoint - **URL:** `/public_api/v1/incidents/update_incident` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `request_data` | object | Optional | A dictionary containing the API request fields. | | `request_data.incident_id` | string | Required | A string representing the incident ID you want to update. | | `request_data.update_data` | object | Optional | The data to update the incident with. You can also include custom incident fields as additional properties. Custom field names must be lowercase with no white spaces (e.g. "Single Select" becomes "singleselect"). | | `request_data.update_data.assigned_user_mail` | string | Optional | Email address of the user to assign the incident to. Must belong to a user that exists in the same Cortex XDR tenant. Pass an empty string to unassign the incident. | | `request_data.update_data.manual_severity` | string | Optional | Manually set severity for the incident. Valid values are informational, low, medium, high, critical. Pass an empty string to remove a manually set severity. | | `request_data.update_data.status` | string | Optional | The status of the incident. | | `request_data.update_data.resolve_comment` | string | Optional | A comment explaining why the incident was resolved. | | `request_data.update_data.comment` | object | Optional | Add a comment to the incident. | | `request_data.update_data.comment.comment_action` | string | Optional | The comment action. Must be 'add'. | | `request_data.update_data.comment.value` | string | Optional | The comment text. | | `request_data.update_data.notes` | string | Optional | Notes to add to the incident. | ### Input Example `{"json_body":{"request_data":{"incident_id":"2927","update_data":{"assigned_user_mail":"username@test.com","manual_severity":"low","status":"resolved_other","resolve_comment":"This incident is resolved"}}}}` ### Output Example `{"json_body":false}` ## Get Violations Retrieve up to 100 device control violations from Palo Alto Networks Cortex XDR using specified request data filters. ### Endpoint - **URL:** `/public_api/v1/device_control/get_violations/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.filters` | array | Optional | Response data | | `request_data.filters.field` | string | Optional | Response data | | `request_data.filters.operator` | string | Optional | Response data | | `request_data.filters.value` | array | Optional | Response data | | `request_data.search_to` | number | Optional | Response data | ### Input Example `{"request_data":{"filters":[{"field":"string","operator":"string","value":["string"]}],"search_to":123}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.total_count` | number | Count value | | `reply.result_count` | number | Result of the operation | | `reply.violations` | array | Output field: reply.violations | | `reply.violations.hostname` | string | Name of the resource | | `reply.violations.username` | string | Name of the resource | | `reply.violations.ip` | string | Output field: reply.violations.ip | | `reply.violations.timestamp` | number | Output field: reply.violations.timestamp | | `reply.violations.violation_id` | number | Unique identifier | | `reply.violations.type` | string | Type of the resource | | `reply.violations.vendor_id` | string | Unique identifier | | `reply.violations.vendor` | string | Output field: reply.violations.vendor | | `reply.violations.product_id` | string | Unique identifier | | `reply.violations.product` | string | Output field: reply.violations.product | | `reply.violations.serial` | string | Output field: reply.violations.serial | | `reply.violations.endpoint_id` | string | Unique identifier | ### Output Example `{"reply":{"total_count":123,"result_count":123,"violations":[{}]}}` ## Get XQL Query Results Retrieve results of a prior XQL query in Palo Alto Networks Cortex XDR using the specified query ID and request data. ### Endpoint - **URL:** `/public_api/v1/xql/get_query_results/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------- | | `request_data` | object | Optional | Response data | | `request_data.query_id` | string | Optional | Response data | | `request_data.pending_flag` | boolean | Optional | Response data | | `request_data.limit` | number | Optional | Response data | | `request_data.format` | string | Optional | Response data | ### Input Example `{"request_data":{"query_id":"string","pending_flag":true,"limit":123,"format":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `reply` | object | Output field: reply | | `reply.status` | string | Status value | | `reply.number_of_results` | number | Result of the operation | | `reply.query_cost` | object | Output field: reply.query\_cost | | `reply.query_cost.tenant_id_1` | number | Unique identifier | | `reply.remaining_quota` | number | Output field: reply.remaining\_quota | | `reply.results` | object | Result of the operation | | `reply.results.data` | array | Response data | | `reply.results.data.event_id` | string | Response data | | `reply.results.data._vendor` | string | Response data | | `reply.results.data._product` | string | Response data | | `reply.results.data.insert_timestamp` | number | Response data | | `reply.results.data._time` | number | Response data | | `reply.results.data.event_type` | string | Response data | | `reply.results.data.event_sub_type` | string | Response data | ### Output Example `{"reply":{"status":"active","number_of_results":123,"query_cost":{"tenant_id_1":123},"remaining_quota":123,"results":{"data":[]}}}` # Response Headers | **Header** | **Description** | **Example** | | ---------------------------- | ----------------------------------------------------- | ----------------------------- | | cache-control | Directives for caching mechanisms | | | Connection | HTTP response header: Connection | | | content-encoding | HTTP response header: content-encoding | | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT | | RateLimit-Limit | HTTP response header: RateLimit-Limit | | | RateLimit-Remaining | HTTP response header: RateLimit-Remaining | | | RateLimit-Reset | HTTP response header: RateLimit-Reset | | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | | | Transfer-Encoding | HTTP response header: Transfer-Encoding | | | vary | HTTP response header: vary | | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | | | X-Frame-Options | HTTP response header: X-Frame-Options | | | X-RateLimit-Limit-1800 | HTTP response header: X-RateLimit-Limit-1800 | | | X-RateLimit-Limit-minute | HTTP response header: X-RateLimit-Limit-minute | | | X-RateLimit-Limit-second | HTTP response header: X-RateLimit-Limit-second | | | X-RateLimit-Remaining-1800 | HTTP response header: X-RateLimit-Remaining-1800 | | | X-RateLimit-Remaining-minute | HTTP response header: X-RateLimit-Remaining-minute | | | X-RateLimit-Remaining-second | HTTP response header: X-RateLimit-Remaining-second | | | X-XSS-Protection | HTTP response header: X-XSS-Protection | |