Core REST API

Use Core REST APIs.

Utilities · Cortex REST API

Details

IDCore REST API
ProviderPalo Alto Networks
CategoryUtilities
From Version5.0.0
Supported ModulesAgentix Cortex Cloud Cloud Runtime Security Cloud Posture Security XSIAM EDR

README

Configure Core REST API in Cortex

Parameter Description Required
Core Server URL For Cortex XSOAR 8 or Cortex XSIAM, use the Copy API URL button on the API Keys page. For Cortex XSOAR 6, use the server URL. True
API Key ID The API Key ID that is linked to the API Key (relevant for Cortex XSIAM and Cortex XSOAR 8.0.0 and above). True
API Key (Password) The core server API key. True
Authentication method Whether authentication should be using “Standard” API key or “Advanced” API key. True
Base marketplace url The base url for the tenant marketplace. False
Trust any certificate (not secure) Trust any certificate (not secure). False
Use system proxy settings Use system proxy settings. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

Please Note: When updating or making changes to a custom content item (integration, script, list, etc.), it may be necessary to increment the version of the item. To do so, first fetch the current version (usually via a GET command) and then increment the version by 1. Lastly, when updating an item, please use this incremented value for the version field.

core-api-post

send HTTP POST request

Base Command

core-api-post

Input

Argument Name Description Required
uri Request endpoint (e.g. /incident or /public_api/v1/incidents/update_incident). Required
body Body of HTTP POST. Optional

Context Output

There is no context output for this command.

Command Example

!core-api-post uri=/lists/save body={\"name\":\"list_name\",\"data\":\"list_data\"}

Human Readable Output

{“response”:{“commitMessage”:””,”data”:”list_data”,”definitionId”:””,”description”:””,”fromServerVersion”:””,”id”:”list_name”,”itemVersion”:””,”locked”:false,”modified”:”2022-05-29T12:20:14.988577Z”,”name”:”list_name”,”nameLocked”:false,”packID”:””,”prevName”:”list_name”,”primaryTerm”:6,”propagationLabels”:[“all”],”sequenceNumber”:907233,”shouldCommit”:false,”system”:false,”tags”:null,”toServerVersion”:””,”truncated”:false,”type”:”plain_text”,”vcShouldIgnore”:false,”vcShouldKeepItemLegacyProdMachine”:false,”version”:1}}

core-api-get

send HTTP GET requests

Base Command

core-api-get

Input

Argument Name Description Required
uri Request endpoint (e.g. /user or /public_api/v1/rbac/get_users). Required

Context Output

There is no context output for this command.

Command Example

!core-api-get uri=/user

Human Readable Output

{“response”:{“addedSharedDashboards”:[“Threat Intelligence Feeds”,”Troubleshooting Instances”],”allRoles”:[“Administrator”],”defaultAdmin”:true,”email”:”admintest@core.com”,”id”:”admin”,”image”:”8327000###user_image_admin.png”,”lastLogin”:”2022-05-29T15:13:46.224432+03:00”,”name”:”Admin Dude”,”notificationsSettings”:{“email”:{“all”:true},”pushNotifications”:{“all”:true}},”permissions”:{“core”:[“scripts.rwx”,”playbooks.rw”]},”phone”:”+650-123456”,”playgroundId”:”beda-02ab-49ef-8fc1-c43a36f”}}

core-api-put

send HTTP PUT request

Base Command

core-api-put

Input

Argument Name Description Required
uri Request endpoint (e.g. /user). Required
body Request body. Optional

core-api-delete

send HTTP DELETE request

Base Command

core-api-delete

Input

Argument Name Description Required
uri Request endpoint (e.g. /user). Required

Context Output

There is no context output for this command.

Command Example

!core-api-delete uri=/dashboards/9a6cc590-72bb-4ed5-84e9-4577c6d8cbb9

Human Readable Output

{“response”:””}

core-api-download

Download files from core server

Base Command

core-api-download

Input

Argument Name Description Required
uri Request endpoint. Required
filename File name of download. Optional
description Description of file entry. Optional

Context Output

There is no context output for this command.

Command Example

!core-api-download uri=/log/bundle

Context Example

{
    "File": {
        "EntryID": "yukswe2UVanMjyvEANmLBH@bed9ccda-02ab-49ef-8fc1-c43a",
        "Extension": "gz",
        "Info": "gz",
        "MD5": "e4e0a23740dfaa27f00b276af",
        "Name": "logs-bundle-29May2215_14IDT.tar.gz",
        "SHA1": "95e0ebd554ea107f04508d6c2d9e6361",
        "SHA256": "83032a86295279ecdf516b63eae7a7e3e5af301bf4dfed3c82faa23b58",
        "SHA512": "88a3fa0194c7dd439c749b2b0b9cbef64ce18e469d0b8b62bcf18919ffcefd1c99119c993070454d48061357ff0dd0ffe0a070936b62c7ac35035de3",
        "SSDeep": "98304:wAjPMXI9/8BoAKIxrVqJVAw6LgJEBFCH73LOOFdWgiwvSJdBo:3PmI9/8jKIxrVOELrCHwq7O",
        "Size": 4052002,
        "Type": "gzip compressed data, original size modulo 2^32 46240256"
    }
}

Human Readable Output

core-api-multipart

Send HTTP Multipart request to upload files to Core server

Base Command

core-api-multipart

Input

Argument Name Description Required
uri Request endpoint. Required
entryID File entry ID. Required
body Request body. Optional

Context Output

There is no context output for this command.

Command Example

!core-api-multipart uri=/incident/upload/204 entryID=evnKTiujxaZEkeKRxiBMig@bed9ccda-02ab-49ef-8fc1-c43a36ff38f5 body=test_bark

Human Readable Output

{“response”:{“activated”:”0001-01-01T00:00:00Z”,”attachment”:[{“description”:””,”name”:”logs-bundle-29May2214_36IDT.tar.gz”,”path”:”204_34d-836b-4b38-81eb-9b90af9c1a_logs-bundle-29May2214_36IDT.tar.gz”,”showMediaFile”:false,”type”:”application/octet-stream”}],”autime”:1653651342394000,”closed”:”0001-01-01T00:00:00Z”,”created”:”2022-05-27T13:15:51.342394+03:00”,”dueDate”:”0001-01-01T00:00:00Z”,”id”:”204”,”labels”:[{“type”:”Brand”,”value”:”Grafana”},{“type”:”Instance”,”value”:”Grafana_instance_1”}],”modified”:”2022-05-29T12:20:17.196279Z”,”name”:”Adi’s Alert”,”numericId”:204,”occurred”:”2022-05-27T02:02:30Z”,”rawName”:”Adi’s Alert”,”rawType”:”Grafana Alert”,”sequenceNumber”:545,”sourceBrand”:”Grafana”,”sourceInstance”:”Grafana_instance_1”,”type”:”Grafana Alert”,”version”:2}}

core-delete-incidents

Delete Core incidents

Base Command

core-delete-incidents

Input

Argument Name Description Required
ids IDs of the incidents to delete. Required

Context Output

There is no context output for this command.

Command Example

!core-delete-incidents ids=152

Human Readable Output

Core delete incidents

totalDeleted total notUpdated
1 143 0

core-api-install-packs

Upload packs to Core server from url or the marketplace.

Base Command

core-api-install-packs

Input

Argument Name Description Required
packs_to_install The packs to install in JSON format (e.g. [{“AutoFocus”: “2.0.8”}] ). Optional
file_url The pack zip file url. Optional
entry_id The War Room entry ID of the pack zip file. Optional
skip_verify If true will skip pack signature validation, Available from 6.5.0 server version. Optional
skip_validation If true will skip all pack validations, Available from 6.6.0 server version. Optional
timeout_in_seconds The request timeout in seconds. Default value is 180 (3 minutes). Optional

Context Output

There is no context output for this command.

Command Example

!core-api-install-packs packs_to_install=[{"AutoFocus": "2.0.8"}]

Human Readable Output

The following packs installed successfully: AutoFocus

core-api-file-upload

Upload to the incident a file that the user provided according to the entry_id or the content of the file.

Base Command

core-api-file-upload

Input

Argument Name Description Required
incident_id The incident’s ID. Required
file_name The new file’s name. Optional
file_content The new file’s content. Optional
entry_id The War Room entry ID of the pack zip file. Optional

Context Output

There is no context output for this command.

core-api-file-delete

Delete a war room (investigation) file entry.

Base Command

core-api-file-delete

Input

Argument Name Description Required
entry_id The War Room entry ID of the file. Required

Context Output

There is no context output for this command.

core-api-file-attachment-delete

Delete a file attachment from an incident — specifically from the incident’s file attachments (not from the war room).

Base Command

core-api-file-attachment-delete

Input

Argument Name Description Required
incident_id The incident’s ID. Required
file_path The file’s path. Required
field_name Name of the field (type attachment) from which to remove the attachment. Default is attachment. Optional

Command example

!core-api-file-attachment-delete file_path=1@1 incident_id=1

Human Readable Output

Attachment 1@1 deleted.

core-api-file-check

Check if the file exists in Cortex XSOAR (Context) by entry_id.

Base Command

core-api-file-check

Input

Argument Name Description Required
entry_id The War Room entry ID of the file. Required

Context Output

Path Type Description
IsFileExists unknown Dictionary with EntryID as the key and boolean if the file exists as a value.

Configuration parameters

  • url — Core Server URL (required)
  • creds_apikey — API Key ID
  • auth_method — Authentication method
  • marketplace_url — Base marketplace url
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • use_tenant — Use tenant

Commands (20)

  • core-api-delete

    send HTTP DELETE request.

  • core-api-download

    Download files from Core server.

  • core-api-file-attachment-delete

    Delete a file attachment from an incident — specifically from the incident’s file attachments.

  • core-api-file-check

    Check if the file exists in Cortex XSOAR (Context) by entry_id.

  • core-api-file-delete

    Delete a war room (investigation) file entry.

  • core-api-file-upload

    Upload to the incident a file that the user provided according to the entry_id or the content of the file.

  • core-api-get

    send HTTP GET requests.

  • core-api-install-packs

    Upload packs to the core server from the URL or marketplace.

  • core-api-multipart

    Send HTTP Multipart request to upload files to Core server.

  • core-api-post

    send HTTP POST request.

  • core-api-put

    send HTTP PUT request.

  • core-delete-incidents

    Delete Core incidents.

  • demisto-api-delete Deprecated

    Deprecated. Use core-api-delete instead.

  • demisto-api-download Deprecated

    Deprecated. Use core-api-download instead.

  • demisto-api-get Deprecated

    Deprecated. Use core-api-get instead.

  • demisto-api-install-packs Deprecated

    Deprecated. Use core-api-install-packs instead.

  • demisto-api-multipart Deprecated

    Deprecated. Use core-api-multipart instead.

  • demisto-api-post Deprecated

    Deprecated. Use core-api-post instead.

  • demisto-api-put Deprecated

    Deprecated. Use core-api-put instead.

  • demisto-delete-incidents Deprecated

    Deprecated. Use core-delete-incidents instead.

Source

CoreRESTAPI.js CoreRESTAPI.yml CoreRESTAPI_description.md
Download History Raw 
sectionorder:
- Connect
commonfields:
  id: Core REST API
  version: -1
name: Core REST API
display: Core REST API
category: Utilities
provider: Palo Alto Networks
description: Use Core REST APIs.
configuration:
- display: Core Server URL
  name: url
  defaultvalue: https://127.0.0.1
  type: 0
  required: true
  additionalinfo: For Cortex XSOAR 8 or Cortex XSIAM, use the Copy API URL button on the API Keys page. For Cortex XSOAR 6, use the server URL.
  section: Connect
- display: API Key ID
  displaypassword: API Key
  name: creds_apikey
  type: 9
  additionalinfo: Please provide API Key ID when using Cortex XSIAM or Cortex XSOAR 8.0.0 and above.
  required: false
  section: Connect
- display: Authentication method
  name: auth_method
  type: 15
  defaultvalue: Advanced
  additionalinfo: Whether authentication should be using "Standard" API key or "Advanced" API key. For XSOAR version < 8.0.0, choose "Standard".
  options:
  - Standard
  - Advanced
  required: false
  section: Connect
- display: Base marketplace url
  name: marketplace_url
  defaultvalue: https://marketplace.xsoar.paloaltonetworks.com/content/packs/
  type: 0
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use tenant
  additionalinfo: Whether API calls should be made to the current tenant instead of the main tenant.
  name: use_tenant
  type: 8
  required: false
  section: Connect
  advanced: true
script:
  script: ''
  type: javascript
  commands:
  - name: demisto-api-post
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /incident or /public_api/v1/incidents/update_incident).
    - name: body
      description: Body of HTTP POST.
    description: Deprecated. Use core-api-post instead.
    execution: true
    deprecated: true
  - name: demisto-api-get
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user or /public_api/v1/rbac/get_users).
    description: Deprecated. Use core-api-get instead.
    deprecated: true
  - name: demisto-api-put
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    - name: body
      description: Request body.
    description: Deprecated. Use core-api-put instead.
    execution: true
    deprecated: true
  - name: demisto-api-delete
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    description: Deprecated. Use core-api-delete instead.
    execution: true
    deprecated: true
  - name: demisto-api-download
    arguments:
    - name: uri
      required: true
      description: Request endpoint.
    - name: filename
      description: File name of download.
    - name: description
      description: Description of file entry.
    description: Deprecated. Use core-api-download instead.
    deprecated: true
  - name: demisto-api-multipart
    arguments:
    - name: uri
      required: true
      description: Request URI.
    - name: entryID
      required: true
      description: File entry ID.
    - name: body
      description: Request body.
    description: Deprecated. Use core-api-multipart instead.
    deprecated: true
  - name: demisto-delete-incidents
    arguments:
    - name: ids
      required: true
      description: IDs of the incidents to delete.
      isArray: true
    - name: fields
      description: 'Comma separated list of fields to return, case sensitive. Set "all" for all fields. WARNING: Setting all fields may result in big results.'
      isArray: true
      defaultValue: id,name,type,severity,status
    description: Deprecated. Use core-delete-incidents instead.
    execution: true
    deprecated: true
  - name: demisto-api-install-packs
    arguments:
    - name: packs_to_install
      description: 'The packs to install in JSON format (e.g. [{"AutoFocus": "2.0.8"}] ).'
      isArray: true
    - name: file_url
      description: 'The pack zip file url.'
    - name: entry_id
      description: 'The War Room entry ID of the pack zip file.'
    - name: skip_verify
      description: 'If true will skip pack signature validation, Available from 6.5.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: skip_validation
      description: 'If true will skip all pack validations, Available from 6.6.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Deprecated. Use core-api-install-packs instead.
    deprecated: true
  - name: core-api-post
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /incident or /public_api/v1/incidents/update_incident).
    - name: body
      description: Body of HTTP POST.
    - name: timeout
      description: Request timeout in minutes. Default is 3 minutes.
    description: send HTTP POST request.
    execution: true
  - name: core-api-get
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user or /public_api/v1/rbac/get_users).
    description: send HTTP GET requests.
  - name: core-api-put
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    - name: body
      description: Request body.
    description: send HTTP PUT request.
    execution: true
  - name: core-api-delete
    arguments:
    - name: uri
      required: true
      default: true
      description: Request endpoint (e.g. /user).
    description: send HTTP DELETE request.
    execution: true
  - name: core-api-download
    arguments:
    - name: uri
      required: true
      description: Request endpoint.
    - name: filename
      description: File name of download.
    - name: description
      description: Description of file entry.
    description: Download files from Core server.
  - name: core-api-multipart
    arguments:
    - name: uri
      required: true
      description: Request endpoint.
    - name: entryID
      required: true
      description: File entry ID.
    - name: body
      description: Request body.
    description: Send HTTP Multipart request to upload files to Core server.
  - name: core-delete-incidents
    arguments:
    - name: ids
      required: true
      description: IDs of the incidents to delete.
      isArray: true
    description: Delete Core incidents.
    execution: true
  - name: core-api-install-packs
    arguments:
    - name: packs_to_install
      description: 'The packs to install in JSON format (e.g. [{"AutoFocus": "2.0.8"}] ).'
      isArray: true
    - name: file_url
      description: 'The pack zip file url.'
    - name: entry_id
      description: 'The War Room entry ID of the pack zip file.'
    - name: skip_verify
      description: 'If true will skip pack signature validation, Available from 6.5.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: skip_validation
      description: 'If true will skip all pack validations, Available from 6.6.0 server version.'
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: timeout_in_seconds
      description: The request timeout in seconds.
      defaultValue: '180'
    description: Upload packs to the core server from the URL or marketplace.
  - name: core-api-file-upload
    arguments:
    - name: incident_id
      description: The incident's ID.
    - name: file_name
      description: "The new file's name."
    - name: file_content
      description: "The new file's content."
    - name: entry_id
      description: "The War Room entry ID of the pack zip file."
    description: Upload to the incident a file that the user provided according to the entry_id or the content of the file.
  - name: core-api-file-delete
    arguments:
    - name: entry_id
      description: "The War Room entry ID of the file."
      required: true
    description: Delete a war room (investigation) file entry.
  - name: core-api-file-attachment-delete
    arguments:
    - name: incident_id
      required: true
      description: The incident's ID.
    - name: file_path
      required: true
      description: "The file's path."
    - name: field_name
      defaultValue: 'attachment'
      description: "Name of the field (type attachment) from which to remove the attachment."
    description: Delete a file attachment from an incident — specifically from the incident’s file attachments.
  - name: core-api-file-check
    arguments:
    - name: entry_id
      description: "The War Room entry ID of the file."
      required: true
    description: Check if the file exists in Cortex XSOAR (Context) by entry_id.
    outputs:
    - description: Dictionary with EntryID as the key and boolean if the file exists as a value in Context.
      contextPath: IsFileExists
tests:
- TestDemistoRestAPI
- UploadFile Test
fromversion: 5.0.0