Cortex Core - Platform

This integration uses the Cortex API to access all the core services and capabilities of the Cortex platform.

Endpoint · Core

Details

ID	`Cortex Core - Platform`
Provider	Palo Alto Networks
Category	Endpoint
From Version	6.2.0
Docker Image	`demisto/google-cloud-storage:1.0.0.10120494`
Supported Modules	Exposure Management Cortex Cloud Cloud Runtime Security Agentix Cloud Posture Security XSIAM EDR

README

This integration uses the Cortex API to access all the core services and capabilities of the Cortex platform.

Configure Cortex Platform Core in Cortex

Parameter	Description	Required
HTTP Timeout	The timeout of the HTTP requests sent to Cortex API (in seconds).	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

core-get-asset-details

Get asset information.

Base Command

core-get-asset-details

Input

Argument Name	Description	Required
asset_id	Asset unique identifier.	Required

Context Output

Path	Type	Description
Core.CoreAsset	unknown	Asset additional information.
Core.CoreAsset.xdm__asset__provider	unknown	The cloud provider or source responsible for the asset.
Core.CoreAsset.xdm__asset__realm	unknown	The realm or logical grouping of the asset.
Core.CoreAsset.xdm__asset__last_observed	unknown	The timestamp when the asset was last observed, in ISO 8601 format.
Core.CoreAsset.xdm__asset__type__id	unknown	The unique identifier for the asset type.
Core.CoreAsset.xdm__asset__first_observed	unknown	The timestamp when the asset was first observed, in ISO 8601 format.
Core.CoreAsset.asset_hierarchy	unknown	The hierarchy or structure representing the asset.
Core.CoreAsset.xdm__asset__type__category	unknown	The asset category type.
Core.CoreAsset.xdm__asset__cloud__region	unknown	The cloud region where the asset resides.
Core.CoreAsset.xdm__asset__module_unstructured_fields	unknown	The unstructured fields or metadata associated with the asset module.
Core.CoreAsset.xdm__asset__source	unknown	The originating source of the asset’s information.
Core.CoreAsset.xdm__asset__id	unknown	The source unique identifier for the asset.
Core.CoreAsset.xdm__asset__type__class	unknown	The classification or type class of the asset.
Core.CoreAsset.xdm__asset__type__name	unknown	The specific name of the asset type.
Core.CoreAsset.xdm__asset__strong_id	unknown	The strong or immutable identifier for the asset.
Core.CoreAsset.xdm__asset__name	unknown	The name of the asset.
Core.CoreAsset.xdm__asset__raw_fields	unknown	The raw fields or unprocessed data related to the asset.
Core.CoreAsset.xdm__asset__normalized_fields	unknown	The normalized fields associated with the asset.
Core.CoreAsset.all_sources	unknown	A list of all sources providing information about the asset.

Command Example

!core-get-asset-details asset_id=123

Context Example

{
    "Core.CoreAsset": [
        {
            "asset_hierarchy": ["123"],
            "xdm__asset__type__category": "Policy",
            "xdm__asset__cloud__region": "Global",
            "xdm__asset__module_unstructured_fields": {},
            "xdm__asset__source": "XSIAM",
            "xdm__asset__id": "123",
            "xdm__asset__type__class": "Identity",
            "xdm__asset__normalized_fields": {},
            "xdm__asset__first_observed": 100000000,
            "xdm__asset__last_observed": 100000000,
            "xdm__asset__name": "Fake Name",
            "xdm__asset__type__name": "IAM",
            "xdm__asset__strong_id": "FAKE ID"
        }
    ]
}

Human Readable Output

asset_hierarchy xdm__asset__type__category xdm__asset__cloud__region xdm__asset__module_unstructured_fields xdm__asset__source xdm__asset__id xdm__asset__type__class xdm__asset__normalized_fields xdm__asset__first_observed xdm__asset__last_observed xdm__asset__name xdm__asset__type__name xdm__asset__strong_id

123 Policy Global XSIAM 123 Identity 100000000 100000000 Fake Name IAM FAKE ID

asset_hierarchy	xdm__asset__type__category	xdm__asset__cloud__region	xdm__asset__module_unstructured_fields	xdm__asset__source	xdm__asset__id	xdm__asset__type__class	xdm__asset__normalized_fields	xdm__asset__first_observed	xdm__asset__last_observed	xdm__asset__name	xdm__asset__type__name	xdm__asset__strong_id
123	Policy	Global		XSIAM	123	Identity		100000000	100000000	Fake Name	IAM	FAKE ID

core-get-issues

Returns a list of issues and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object.
Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

Base Command

core-get-issues

Input

Argument Name	Description	Required
issue_id	The unique ID of the issue. Accepts a comma-separated list.	Optional
severity	The severity of the issue. Accepts a comma-separated list. Possible values are: low, medium, high, critical.	Optional
custom_filter	A custom filter. When using this argument, other filter arguments are not relevant. example: `{<br/> "OR": [<br/> {<br/> "SEARCH_FIELD": "actor_process_command_line",<br/> "SEARCH_TYPE": "EQ",<br/> "SEARCH_VALUE": "path_to_file"<br/> }<br/> ]<br/> }`.	Optional
Identity_type	Account type. Accepts a comma-separated list. Possible values are: ANONYMOUS, APPLICATION, COMPUTE, FEDERATED_IDENTITY, SERVICE, SERVICE_ACCOUNT, TEMPORARY_CREDENTIALS, TOKEN, UNKNOWN, USER.	Optional
agent_id	A unique identifier per agent. Accepts a comma-separated list.	Optional
action_external_hostname	The hostname to connect to. In case of a proxy connection, this value will differ from action_remote_ip. Accepts a comma-separated list.	Optional
rule_id	A string identifying the user rule. Accepts a comma-separated list.	Optional
rule_name	The name of the user rule. Accepts a comma-separated list.	Optional
issue_name	The issue name. Accepts a comma-separated list.	Optional
issue_source	The issue source. Accepts a comma-separated list. Possible values are: XDR Agent, XDR Analytics, XDR Analytics BIOC, PAN NGFW, XDR BIOC, XDR IOC, Threat Intelligence, XDR Managed Threat Hunting, Correlation, Prisma Cloud, Prisma Cloud Compute, ASM, IoT Security, Custom Alert, Health, SaaS Attachments, Attack Path, Cloud Network Analyzer, IaC Scanner, CAS Secret Scanner, CI/CD Risks, CLI Scanner, CIEM Scanner, API Traffic Monitor, API Posture Scanner, Agentless Disk Scanner, Kubernetes Scanner, Compute Policy, CSPM Scanner, CAS CVE Scanner, CAS License Scanner, Secrets Scanner, SAST Scanner, Data Policy, Attack Surface Test, Package Operational Risk, Vulnerability Policy, AI Security Posture.	Optional
time_frame	This argument is deprecated. Use start_time instead. Supports relative or custom time options. If you choose custom, use the start_time and end_time arguments. Possible values are: 60 minutes, 3 hours, 12 hours, 24 hours, 2 days, 7 days, 14 days, 30 days, custom.	Optional
user_name	The name assigned to the user_id during agent runtime. Accepts a comma-separated list.	Optional
actor_process_image_name	The file name of the binary file. Accepts a comma-separated list.	Optional
causality_actor_process_image_command_line	SHA256 Causality Graph Object command line. Accepts a comma-separated list.	Optional
actor_process_image_command_line	Command line used by the process image initiated by the causality actor. Accepts a comma-separated list.	Optional
action_process_image_command_line	SHA256 The command line of the process created. Accepts a comma-separated list.	Optional
actor_process_image_sha256	SHA256 hash of the binary file. Accepts a comma-separated list.	Optional
causality_actor_process_image_sha256	SHA256 hash of the binary file. Accepts a comma-separated list.	Optional
action_process_image_sha256	SHA256 of the binary file. Accepts a comma-separated list.	Optional
action_file_image_sha256	SHA256 of the file related to the event. Accepts a comma-separated list.	Optional
action_registry_name	The name of the registry. Accepts a comma-separated list.	Optional
action_registry_key_data	The key data of the registry. Accepts a comma-separated list.	Optional
host_ip	The host IP address. Accepts a comma-separated list.	Optional
action_local_ip	The local IP address for the connection. Accepts a comma-separated list.	Optional
action_remote_ip	Remote IP address for the connection. Accepts a comma-separated list.	Optional
issue_action_status	Issue action status. Possible values are: detected, detected (allowed the session), detected (download), detected (forward), detected (post detected), detected (prompt allow), detected (raised an alert), detected (reported), detected (on write), detected (scanned), detected (sinkhole), detected (syncookie sent), detected (wildfire upload failure), detected (wildfire upload success), detected (wildfire upload skip), detected (xdr managed threat hunting), prevented (block), prevented (blocked), prevented (block-override), prevented (blocked the url), prevented (blocked the ip), prevented (continue), prevented (denied the session), prevented (dropped all packets), prevented (dropped the session), prevented (dropped the session and sent a tcp reset), prevented (dropped the packet), prevented (override), prevented (override-lockout), prevented (post detected), prevented (prompt block), prevented (random-drop), prevented (silently dropped the session with an icmp unreachable message to the host or application), prevented (terminated the session and sent a tcp reset to both sides of the connection), prevented (terminated the session and sent a tcp reset to the client), prevented (terminated the session and sent a tcp reset to the server), prevented (on write).	Optional
action_local_port	The local port for the connection. Accepts a comma-separated list.	Optional
action_remote_port	The remote port for the connection. Accepts a comma-separated list.	Optional
dst_action_external_hostname	The hostname to connect to. In case of a proxy connection, this value will differ from action_remote_ip. Accepts a comma-separated list.	Optional
sort_field	The field by which to sort the results. Default is source_insert_ts.	Optional
sort_order	The order in which to sort the results. Possible values are: DESC, ASC.	Optional
offset	This argument is deprecated. Use page instead. The first page number to retrieve issues from. Default is 0.	Optional
limit	This argument is deprecated. Use page_size instead. The last page number to retrieve issues from. Default is 50.	Optional
page	The page number for the issues to return for pagination. Default is 0.	Optional
page_size	The number of issues to return per page. Default is 50.	Optional
start_time	Relevant when the time_frame argument is set to custom. Supports epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss).	Optional
end_time	Relevant when the time_frame argument is set to custom. Supports epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss).	Optional
starred	Whether the issue is starred. Possible values are: true, false.	Optional
mitre_technique_id_and_name	The MITRE attack technique. Accepts a comma-separated list.	Optional
issue_category	The category of the issue. Accepts a comma-separated list.	Optional
issue_domain	The domain of the issue. Accepts a comma-separated list. Possible values are: Health, Hunting, IT, Posture, Security.	Optional
issue_description	The description of the issue. Accepts a comma-separated list.	Optional
os_actor_process_image_sha256	The SHA256 hash of the OS actor process image. Accepts a comma-separated list.	Optional
action_file_macro_sha256	The SHA256 hash of the action file macro. Accepts a comma-separated list.	Optional
status	The status progress. Accepts a comma-separated list. Possible values are: New, In Progress, Resolved.	Optional
not_status	Not status progress. Accepts a comma-separated list. Possible values are: New, In Progress, Resolved.	Optional
asset_ids	The assets IDs related to the issue. Accepts a comma-separated list.	Optional
assignee	The assignee of the issue. Accepts a comma-separated list. Use “unassigned” for unassigned issues or “assigned” for all assigned issues. .	Optional
output_keys	A comma separated list of outputs to include in the context.	Optional

Context Output

Path	Type	Description
Core.Issue.internal_id	String	The unique ID of the issue.
Core.Issue.Identity_type	String	The identity type of the account.
Core.Issue.source_insert_ts	Number	The detection timestamp.
Core.Issue.issue_name	String	The name of the issue.
Core.Issue.issue_category	String	The category of the issue.
Core.Issue.issue_description	String	The issue description.
Core.Issue.agent_id	List	The agent IDs associated with the issue.
Core.Issue.asset_ids	List	The asset IDs related to the issue.
Core.Issue.severity	String	The severity of the issue.
Core.Issue.issue_domain	String	The domain of the issue.
Core.Issue.case_ids	List	The case IDs associated with the issue.
Core.Issue.issue_source	String	The source of the issue.
Core.Issue.starred	Boolean	Whether the issue is starred.
Core.Issue.status.progress	String	The progress status of the issue.
Core.Issue.assigned_to_pretty	String	The pretty name of the user assigned to the issue.
Core.Issue.assigned_to	String	The user assigned to the issue.
Core.Issue.agent_ip_addresses	String	The host IP address.
Core.Issue.agent_hostname	String	The hostname.
Core.Issue.mitre_tactic_id_and_name	String	The MITRE attack tactic.
Core.Issue.mitre_technique_id_and_name	String	The MITRE attack technique.
Core.Issue.issue_action_status	String	The issue action status.
Core.Issue.issue_action_status_readable	String	The issue action status in readable format.
Core.Issue.action_file_macro_sha256	String	File Macro SHA256 hash of the action file macro.
Core.Issue.action_process_image_sha256	String	Action process image SHA256 hash.
Core.Issue.causality_actor_process_image_sha256	String	Causality actor process image SHA256 hash.
Core.Issue.os_actor_process_image_sha256	String	OS Parent SHA256 hash of the OS actor process image.
Core.Issue.actor_process_image_sha256	String	Actor process image SHA256 hash.
Core.IssueMetadata.returned_count	Number	The actual number of issues that match all filter criteria and returned in this specific response.
Core.IssueMetadata.filtered_count	Number	The total number of issues in the system that match all filter criteria.

core-get-case-extra-data

Get extra data fields of a specific case including issues and key artifacts.

Base Command

core-get-case-extra-data

Input

Argument Name	Description	Required
case_id	A comma seperated list of case IDs.	Required
issues_limit	Maximum number of issues to return per case. The default and maximum is 1000. Default is 1000.	Optional

Context Output

Path	Type	Description
Core.CaseExtraData.case.case_id	String	The unique identifier for the case.
Core.CaseExtraData.case.case_name	String	The name assigned to the case.
Core.CaseExtraData.case.creation_time	Number	The timestamp (in epoch format) when the case was created.
Core.CaseExtraData.case.modification_time	Number	The timestamp (in epoch format) when the case was last modified.
Core.CaseExtraData.case.detection_time	String	The timestamp when the activity related to the case was first detected.
Core.CaseExtraData.case.status	String	The current status of the case (e.g., ‘new’, ‘under_investigation’, ‘closed’).
Core.CaseExtraData.case.severity	String	The severity level of the case (e.g., ‘low’, ‘medium’, ‘high’, ‘critical’).
Core.CaseExtraData.case.description	String	A detailed textual description of the case.
Core.CaseExtraData.case.assigned_user_mail	String	The email address of the user assigned to the case.
Core.CaseExtraData.case.assigned_user_pretty_name	String	The display name of the user assigned to the case.
Core.CaseExtraData.case.issue_count	Number	The total number of issues associated with the case.
Core.CaseExtraData.case.low_severity_issue_count	Number	The total number of low-severity issues within the case.
Core.CaseExtraData.case.med_severity_issue_count	Number	The total number of medium-severity issues within the case.
Core.CaseExtraData.case.high_severity_issue_count	Number	The total number of high-severity issues within the case.
Core.CaseExtraData.case.critical_severity_issue_count	Number	The total number of critical-severity issues within the case.
Core.CaseExtraData.case.user_count	Number	The number of unique users involved in the case.
Core.CaseExtraData.case.host_count	Number	The number of unique hosts involved in the case.
Core.CaseExtraData.case.notes	Array	A collection of notes or comments added to the case by analysts.
Core.CaseExtraData.case.resolve_comment	String	The comment entered by a user when resolving the case.
Core.CaseExtraData.case.manual_severity	String	The severity level manually set by a user, which may override the calculated severity for the case.
Core.CaseExtraData.case.manual_description	String	A description of the case that was manually entered by a user.
Core.CaseExtraData.case.xdr_url	String	The direct URL to view the case in the XDR platform.
Core.CaseExtraData.case.starred	Boolean	A flag indicating whether the case has been starred or marked as a favorite.
Core.CaseExtraData.case.hosts	Array	A comma-separated list of hostnames involved in the case.
Core.CaseExtraData.case.case_sources	String	The products or sources that contributed issues to this case (e.g., ‘XDR Agent’, ‘Firewall’).
Core.CaseExtraData.case.rule_based_score	Number	The case’s risk score as calculated by automated detection rules.
Core.CaseExtraData.case.manual_score	Number	A risk score manually assigned to the case by a user.
Core.CaseExtraData.case.wildfire_hits	Number	The number of times a file associated with this case was identified as malicious by WildFire.
Core.CaseExtraData.case.issues_grouping_status	String	The current status of the issue grouping or clustering process for this case.
Core.CaseExtraData.case.mitre_techniques_ids_and_names	String	A list of MITRE ATT&CK technique IDs and names observed in the case.
Core.CaseExtraData.case.mitre_tactics_ids_and_names	String	A list of MITRE ATT&CK tactic IDs and names observed in the case.
Core.CaseExtraData.case.issue_categories	String	A comma-separated list of categories for the issues included in the case.
Core.CaseExtraData.issues.total_count	Number	The total number of individual issues that are part of the case.
Core.CaseExtraData.issues.data.external_id	String	The unique external identifier for an individual issue.
Core.CaseExtraData.issues.data.severity	String	The severity of the individual issue.
Core.CaseExtraData.issues.data.matching_status	String	The correlation status for the issue.
Core.CaseExtraData.issues.data.end_match_attempt_ts	Date	The timestamp of the last attempt to match the issue with others.
Core.CaseExtraData.issues.data.local_insert_ts	Date	The timestamp when the issue was first recorded in the system.
Core.CaseExtraData.issues.data.bioc_indicator	String	The specific Behavioral Indicator of Compromise (BIOC) that triggered the issue.
Core.CaseExtraData.issues.data.matching_service_rule_id	String	The ID of the matching service rule that identified the issue.
Core.CaseExtraData.issues.data.attempt_counter	Number	The number of times a matching attempt has been made for this issue.
Core.CaseExtraData.issues.data.bioc_category_enum_key	String	The key representing the category of the Behavioral Indicator of Compromise (BIOC).
Core.CaseExtraData.issues.data.case_id	Number	The ID of the case to which this issue belongs.
Core.CaseExtraData.issues.data.is_whitelisted	Boolean	A flag indicating whether this issue has been whitelisted or suppressed.
Core.CaseExtraData.issues.data.starred	Boolean	A flag indicating whether this individual issue has been starred.
Core.CaseExtraData.issues.data.deduplicate_tokens	String	Tokens used to identify and deduplicate similar issues.
Core.CaseExtraData.issues.data.filter_rule_id	String	The ID of any filter rule that was applied to this issue.
Core.CaseExtraData.issues.data.mitre_technique_id_and_name	String	The specific MITRE ATT&CK technique ID and name associated with the issue.
Core.CaseExtraData.issues.data.mitre_tactic_id_and_name	String	The specific MITRE ATT&CK tactic ID and name associated with the issue.
Core.CaseExtraData.issues.data.agent_version	String	The version of the agent installed on the endpoint related to the issue.
Core.CaseExtraData.issues.data.agent_device_domain	String	The domain of the endpoint device.
Core.CaseExtraData.issues.data.agent_fqdn	String	The fully qualified domain name (FQDN) of the agent’s host.
Core.CaseExtraData.issues.data.agent_os_type	String	The operating system type of the endpoint (e.g., ‘Windows’, ‘Linux’).
Core.CaseExtraData.issues.data.agent_os_sub_type	String	The specific version or distribution of the agent’s operating system.
Core.CaseExtraData.issues.data.agent_data_collection_status	String	The status of the agent’s data collection process.
Core.CaseExtraData.issues.data.mac	String	The primary MAC address of the endpoint.
Core.CaseExtraData.issues.data.mac_addresses	Array	A list of all MAC addresses associated with the endpoint.
Core.CaseExtraData.issues.data.agent_is_vdi	Boolean	A flag indicating whether the agent is installed on a Virtual Desktop Infrastructure (VDI) instance.
Core.CaseExtraData.issues.data.agent_install_type	String	The installation type of the agent.
Core.CaseExtraData.issues.data.agent_host_boot_time	Date	The last boot time of the host where the agent is installed.
Core.CaseExtraData.issues.data.event_sub_type	String	A more specific classification of the event type.
Core.CaseExtraData.issues.data.module_id	String	The identifier of the agent module that generated the event.
Core.CaseExtraData.issues.data.association_strength	Number	A score indicating the strength of the event’s association to the case.
Core.CaseExtraData.issues.data.dst_association_strength	Number	The association strength related to the destination entity in the event.
Core.CaseExtraData.issues.data.story_id	String	An identifier that groups a sequence of related events into a “story”.
Core.CaseExtraData.issues.data.event_id	String	The unique identifier for the event.
Core.CaseExtraData.issues.data.event_type	String	The primary type of the event (e.g., ‘Process Execution’, ‘Network Connection’).
Core.CaseExtraData.issues.data.events_length	Number	The number of raw events that were aggregated to create this issue.
Core.CaseExtraData.issues.data.event_timestamp	Date	The timestamp when the original event occurred.
Core.CaseExtraData.issues.data.actor_process_instance_id	String	The unique instance ID of the primary actor process.
Core.CaseExtraData.issues.data.actor_process_image_path	String	The full file path of the actor process’s executable.
Core.CaseExtraData.issues.data.actor_process_image_name	String	The filename of the actor process’s executable.
Core.CaseExtraData.issues.data.actor_process_command_line	String	The command line used to launch the actor process.
Core.CaseExtraData.issues.data.actor_process_signature_status	String	The digital signature status of the actor process executable (e.g., ‘Signed’, ‘Unsigned’).
Core.CaseExtraData.issues.data.actor_process_signature_vendor	String	The vendor name from the digital signature of the actor process.
Core.CaseExtraData.issues.data.actor_process_image_sha256	String	The SHA256 hash of the actor process executable.
Core.CaseExtraData.issues.data.actor_process_image_md5	String	The MD5 hash of the actor process executable.
Core.CaseExtraData.issues.data.actor_process_causality_id	String	The causality ID of the actor process, which links it to its parent process.
Core.CaseExtraData.issues.data.actor_causality_id	String	The causality ID of the primary actor in the event.
Core.CaseExtraData.issues.data.actor_process_os_pid	String	The operating system’s Process ID (PID) of the actor process.
Core.CaseExtraData.issues.data.actor_thread_thread_id	String	The ID of the specific thread within the actor process that initiated the action.
Core.CaseExtraData.issues.data.causality_actor_process_image_name	String	The image name of the process that initiated the actor process (the grandparent).
Core.CaseExtraData.issues.data.causality_actor_process_command_line	String	The command line of the causality actor process.
Core.CaseExtraData.issues.data.causality_actor_process_image_path	String	The file path of the causality actor process’s executable.
Core.CaseExtraData.issues.data.causality_actor_process_signature_vendor	String	The signature vendor of the causality actor process.
Core.CaseExtraData.issues.data.causality_actor_process_signature_status	String	The signature status of the causality actor process.
Core.CaseExtraData.issues.data.causality_actor_causality_id	String	The causality ID of the causality actor process.
Core.CaseExtraData.issues.data.causality_actor_process_execution_time	Date	The execution timestamp of the causality actor process.
Core.CaseExtraData.issues.data.causality_actor_process_image_md5	String	The MD5 hash of the causality actor process’s executable.
Core.CaseExtraData.issues.data.causality_actor_process_image_sha256	String	The SHA256 hash of the causality actor process’s executable.
Core.CaseExtraData.issues.data.action_file_path	String	The file path of the file that was the target of an action.
Core.CaseExtraData.issues.data.action_file_name	String	The name of the file that was the target of an action.
Core.CaseExtraData.issues.data.action_file_md5	String	The MD5 hash of the file that was the target of an action.
Core.CaseExtraData.issues.data.action_file_sha256	String	The SHA256 hash of the file that was the target of an action.
Core.CaseExtraData.issues.data.action_file_macro_sha256	String	The SHA256 hash of a macro embedded within the target file.
Core.CaseExtraData.issues.data.action_registry_data	String	The data written to or read from a registry value during the action.
Core.CaseExtraData.issues.data.action_registry_key_name	String	The name of the registry key involved in the action.
Core.CaseExtraData.issues.data.action_registry_value_name	String	The name of the registry value involved in the action.
Core.CaseExtraData.issues.data.action_registry_full_key	String	The full path of the registry key involved in the action.
Core.CaseExtraData.issues.data.action_local_ip	String	The local IP address involved in a network action.
Core.CaseExtraData.issues.data.action_local_port	String	The local port number involved in a network action.
Core.CaseExtraData.issues.data.action_remote_ip	String	The remote IP address involved in a network action.
Core.CaseExtraData.issues.data.action_remote_port	String	The remote port number involved in a network action.
Core.CaseExtraData.issues.data.action_external_hostname	String	The external hostname or domain associated with the network action.
Core.CaseExtraData.issues.data.action_country	String	The country associated with the remote IP address in the network action.
Core.CaseExtraData.issues.data.action_process_instance_id	String	The instance ID of the process that was the target of an action.
Core.CaseExtraData.issues.data.action_process_causality_id	String	The causality ID of the target process.
Core.CaseExtraData.issues.data.action_process_image_name	String	The executable name of the target process.
Core.CaseExtraData.issues.data.action_process_image_sha256	String	The SHA256 hash of the target process’s executable.
Core.CaseExtraData.issues.data.action_process_image_command_line	String	The command line of the target process.
Core.CaseExtraData.issues.data.action_process_signature_status	String	The signature status of the target process.
Core.CaseExtraData.issues.data.action_process_signature_vendor	String	The signature vendor of the target process.
Core.CaseExtraData.issues.data.os_actor_effective_username	String	The effective username of the OS-level actor responsible for the event.
Core.CaseExtraData.issues.data.os_actor_process_instance_id	String	The instance ID of the OS actor process.
Core.CaseExtraData.issues.data.os_actor_process_image_path	String	The file path of the OS actor process’s executable.
Core.CaseExtraData.issues.data.os_actor_process_image_name	String	The image name of the OS actor process.
Core.CaseExtraData.issues.data.os_actor_process_command_line	String	The command line of the OS actor process.
Core.CaseExtraData.issues.data.os_actor_process_signature_status	String	The signature status of the OS actor process.
Core.CaseExtraData.issues.data.os_actor_process_signature_vendor	String	The signature vendor of the OS actor process.
Core.CaseExtraData.issues.data.os_actor_process_image_sha256	String	The SHA256 hash of the OS actor process’s executable.
Core.CaseExtraData.issues.data.os_actor_process_causality_id	String	The causality ID of the OS actor process.
Core.CaseExtraData.issues.data.os_actor_causality_id	String	The causality ID of the OS actor.
Core.CaseExtraData.issues.data.os_actor_process_os_pid	String	The operating system PID of the OS actor process.
Core.CaseExtraData.issues.data.os_actor_thread_thread_id	String	The thread ID of the OS actor.
Core.CaseExtraData.issues.data.fw_app_id	String	The firewall application ID for the traffic.
Core.CaseExtraData.issues.data.fw_interface_from	String	The firewall interface from which the traffic originated.
Core.CaseExtraData.issues.data.fw_interface_to	String	The firewall interface to which the traffic was destined.
Core.CaseExtraData.issues.data.fw_rule	String	The name of the firewall rule that matched the traffic.
Core.CaseExtraData.issues.data.fw_rule_id	String	The unique ID of the firewall rule that matched the traffic.
Core.CaseExtraData.issues.data.fw_device_name	String	The name of the firewall device that logged the event.
Core.CaseExtraData.issues.data.fw_serial_number	String	The serial number of the firewall device.
Core.CaseExtraData.issues.data.fw_url_domain	String	The domain visited, as logged by the firewall.
Core.CaseExtraData.issues.data.fw_email_subject	String	The subject line of an email, as logged by the firewall.
Core.CaseExtraData.issues.data.fw_email_sender	String	The sender of an email, as logged by the firewall.
Core.CaseExtraData.issues.data.fw_email_recipient	String	The recipient of an email, as logged by the firewall.
Core.CaseExtraData.issues.data.fw_app_subcategory	String	The application subcategory as identified by the firewall.
Core.CaseExtraData.issues.data.fw_app_category	String	The application category as identified by the firewall.
Core.CaseExtraData.issues.data.fw_app_technology	String	The application technology as identified by the firewall.
Core.CaseExtraData.issues.data.fw_vsys	String	The virtual system on the firewall that processed the traffic.
Core.CaseExtraData.issues.data.fw_xff	String	The X-Forwarded-For (XFF) header value from the traffic.
Core.CaseExtraData.issues.data.fw_misc	String	Miscellaneous firewall log data.
Core.CaseExtraData.issues.data.fw_is_phishing	Boolean	A flag indicating if the firewall identified the event as phishing.
Core.CaseExtraData.issues.data.dst_agent_id	String	The agent ID of the destination endpoint in a lateral movement event.
Core.CaseExtraData.issues.data.dst_causality_actor_process_execution_time	Date	The execution time of the causality actor process on the destination endpoint.
Core.CaseExtraData.issues.data.dns_query_name	String	The domain name in a DNS query event.
Core.CaseExtraData.issues.data.dst_action_external_hostname	String	The external hostname of the destination.
Core.CaseExtraData.issues.data.dst_action_country	String	The country of the destination.
Core.CaseExtraData.issues.data.dst_action_external_port	String	The external port of the destination.
Core.CaseExtraData.issues.data.issue_id	String	The unique identifier for the issue.
Core.CaseExtraData.issues.data.detection_timestamp	Number	The timestamp when the issue was first detected.
Core.CaseExtraData.issues.data.name	String	The name or title of the issue.
Core.CaseExtraData.issues.data.category	String	The category of the issue.
Core.CaseExtraData.issues.data.endpoint_id	String	The unique ID of the endpoint where the issue occurred.
Core.CaseExtraData.issues.data.description	String	A detailed description of the issue.
Core.CaseExtraData.issues.data.host_ip	String	The IP address of the host related to the issue.
Core.CaseExtraData.issues.data.host_name	String	The hostname of the endpoint related to the issue.
Core.CaseExtraData.issues.data.source	String	The source of the issue (e.g., ‘XDR’).
Core.CaseExtraData.issues.data.action	String	The action taken in response to the event (e.g., ‘detected’, ‘prevented’).
Core.CaseExtraData.issues.data.action_pretty	String	A user-friendly representation of the action taken.
Core.CaseExtraData.issues.data.user_name	String	The name of the user associated with the issue.
Core.CaseExtraData.issues.data.contains_featured_host	Boolean	A flag indicating if the issue involves a host marked as featured or critical.
Core.CaseExtraData.issues.data.contains_featured_user	Boolean	A flag indicating if the issue involves a user marked as featured or critical.
Core.CaseExtraData.issues.data.contains_featured_ip_address	Boolean	A flag indicating if the issue involves an IP address marked as featured or critical.
Core.CaseExtraData.issues.data.tags	String	Any tags that have been applied to the issue.
Core.CaseExtraData.issues.data.original_tags	String	The original set of tags applied to the issue before any modifications.
Core.CaseExtraData.network_artifacts.total_count	Number	The total number of network artifacts associated with the case.
Core.CaseExtraData.network_artifacts.data.type	String	The type of network artifact (e.g., ‘IP Address’, ‘Domain’).
Core.CaseExtraData.network_artifacts.data.issue_count	Number	The number of issues in the case that involve this network artifact.
Core.CaseExtraData.network_artifacts.data.is_manual	Boolean	A flag indicating if the network artifact was added manually by a user.
Core.CaseExtraData.network_artifacts.data.network_domain	String	The domain name of the network artifact.
Core.CaseExtraData.network_artifacts.data.network_remote_ip	String	The remote IP address of the network artifact.
Core.CaseExtraData.network_artifacts.data.network_remote_port	String	The remote port number of the network artifact.
Core.CaseExtraData.network_artifacts.data.network_country	String	The country associated with the network artifact’s IP address.
Core.CaseExtraData.file_artifacts.total_count	Number	The total number of file artifacts associated with the case.
Core.CaseExtraData.file_artifacts.data.issue_count	Number	The number of issues in the case that involve this file artifact.
Core.CaseExtraData.file_artifacts.data.file_name	String	The name of the file artifact.
Core.CaseExtraData.file_artifacts.data.File_sha256	String	The SHA256 hash of the file artifact.
Core.CaseExtraData.file_artifacts.data.file_signature_status	String	The digital signature status of the file artifact.
Core.CaseExtraData.file_artifacts.data.file_wildfire_verdict	String	The verdict from WildFire for this file (e.g., ‘malicious’, ‘benign’).
Core.CaseExtraData.file_artifacts.data.is_malicous	Boolean	A flag indicating whether the file artifact is considered malicious.
Core.CaseExtraData.file_artifacts.data.is_manual	Boolean	A flag indicating if the file artifact was added manually by a user.
Core.CaseExtraData.file_artifacts.data.is_process	Boolean	A flag indicating if the file artifact is a process executable.
Core.CaseExtraData.file_artifacts.data.low_confidence	Boolean	A flag indicating if the verdict on the file artifact has low confidence.
Core.CaseExtraData.file_artifacts.data.type	String	The type of the file artifact.

core-get-cases

Get case information based on the specified filters.

Base Command

core-get-cases

Input

Argument Name	Description	Required
case_id_list	A comma-separated list of case IDs to filter by.	Optional
sort_by_creation_time	Sorts returned cases by the date/time that the case was created (“asc” - ascending, “desc” - descending). Possible values are: ASC, DESC.	Optional
sort_by_modification_time	Sorts returned cases by the date/time that the case was modified (“asc” - ascending, “desc” - descending). Possible values are: ASC, DESC.	Optional
page	Page number (for pagination). The default is 0 (the first page). Default is 0.	Optional
limit	Maximum number of cases to return per page. The default and maximum value is 100. Default is 100.	Optional
case_domain	A comma-separated list of domains to filter cases by. Possible values are: DOMAIN_SECURITY, DOMAIN_POSTURE, DOMAIN_IT, DOMAIN_HEALTH, DOMAIN_HUNTING.	Optional
status	A comma-separated list of case statuses to filter cases by. . Possible values are: new, in_progress, resolved.	Optional
not_status	A comma-separated list of statuses to exclude. Possible values are: new, in_progress, resolved.	Optional
severity	A comma-separated list of severity levels to filter cases by. . Possible values are: low, medium, high, critical.	Optional
asset_ids	A comma-separated list of Asset IDs associated with the case by which to filter the cases.	Optional
asset_groups	A comma-separated list of Asset Group IDs, where the case is filtered by the assets contained within those groups.	Optional
hosts	A comma-separated list of hosts to filter cases by.	Optional
assignee	A comma-separated list of assignee names or emails to filter cases by. Note: all values must be either names or emails - mixing both in the same request is not supported. Use the special values: “assigned” - to get all cases with assignees, “unassigned” - to get cases with no assignees.	Optional
starred	Filter cases by whether they are starred or not. Possible values are: true, false.	Optional
case_name	A comma-separated list of names to filter cases by.	Optional
case_description	A comma-separated list of descriptions to filter cases by.	Optional
lte_creation_time	A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or before the specified datetime will be retrieved.	Optional
gte_creation_time	A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or after the specified datetime will be retrieved.	Optional
since_creation_time	Filters for returned cases that were created on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on.	Optional
lte_modification_time	Filters for returned cases that were created on or before the specified datetime with the format 2019-12-31T23:59:00.	Optional
gte_modification_time	Filters for returned cases that were modified on or after the specified datetime with the format 2019-12-31T23:59:00.	Optional
since_modification_time	Filters for returned cases that were modified on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on.	Optional
get_enriched_case_data	Whether to include enriched case data in the response (detection_time, notes, xdr_url, manual_description, starred_manually). Only supported for up to 10 cases. When more than 10 cases are returned, the command automatically falls back to standard case data. Possible values are: true, false. Default is false.	Optional
tags	A comma-separated list of tags to filter cases by.	Optional

Context Output

Path	Type	Description
Core.Case.case_id	String	Unique ID assigned to each returned case.
Core.Case.case_name	String	Name of the case.
Core.Case.creation_time	Number	Timestamp when the case was created.
Core.Case.modification_time	Number	Timestamp when the case was last modified.
Core.Case.status	String	Current status of the case.
Core.Case.severity	String	Severity level of the case.
Core.Case.description	String	Description of the case.
Core.Case.assigned_user_mail	String	Email address of the assigned user. May be null.
Core.Case.assigned_user_pretty_name	String	Full name of the assigned user. May be null.
Core.Case.issue_count	Number	Total number of issues in the case.
Core.Case.low_severity_issue_count	Number	Number of issues with low severity.
Core.Case.med_severity_issue_count	Number	Number of issues with medium severity.
Core.Case.high_severity_issue_count	Number	Number of issues with high severity.
Core.Case.critical_severity_issue_count	Number	Number of issues with critical severity.
Core.Case.user_count	Number	Number of users involved in the case.
Core.Case.host_count	Number	Number of hosts involved in the case.
Core.Case.resolve_comment	String	Comments added when resolving the case. May be null.
Core.Case.resolve_reason	String	The reason for resolving the case (e.g. known_issue, duplicate, false_positive, other, true_positive, security_testing). May be null.
Core.Case.resolved_timestamp	Number	Timestamp when the case was resolved.
Core.Case.manual_severity	Number	Severity manually assigned by the user. May be null.
Core.Case.starred	Boolean	Indicates whether the case is starred.
Core.Case.hosts	Array	List of hosts involved in the case.
Core.Case.users	Array	List of users involved in the case.
Core.Case.case_sources	Array	Sources of the case.
Core.Case.manual_score	Number	Manually assigned score. May be null.
Core.Case.rule_based_score	Number	Score based on rules.
Core.Case.wildfire_hits	Number	Number of WildFire hits.
Core.Case.issues_grouping_status	String	Status of issue grouping.
Core.Case.mitre_tactics_ids_and_names	Array	List of MITRE ATT&CK tactic IDs and names associated with the case.
Core.Case.mitre_techniques_ids_and_names	Array	List of MITRE ATT&CK technique IDs and names associated with the case.
Core.Case.issue_categories	Array	Categories of issues associated with the case.
Core.Case.original_tags	Array	Original tags assigned to the case.
Core.Case.tags	Array	Current tags assigned to the case.
Core.Case.case_domain	String	Domain associated with the case.
Core.Case.custom_fields	Unknown	Custom fields for the case with standardized lowercase, whitespace-free names.
Core.Case.CaseExtraData.issue_ids	Array	List of issue IDs associated with the case.
Core.Case.CaseExtraData.file_artifacts	Array	File artifacts associated with the case.
Core.Case.CaseExtraData.network_artifacts	Array	Network artifacts associated with the case.
Core.Case.CaseExtraData.starred_manually	Boolean	True if the case was starred manually; false if starred by rules.
Core.Case.CaseExtraData.xdr_url	String	URL to view the case in Cortex XDR.
Core.Case.CaseExtraData.manual_description	String	Description manually provided by the user.
Core.Case.CaseExtraData.notes	String	The notes related to the case.
Core.Case.CaseExtraData.detection_time	Date	The timestamp when the first issue was detected in the case.
Core.CasesMetadata.returned_count	Number	The actual number of cases that match all filter criteria and returned in this specific response.
Core.CasesMetadata.filtered_count	Number	The total number of cases in the system that match all filter criteria.

core-update-case

Updates the properties of a case.

Base Command

core-update-case

Input

Argument Name	Description	Required
case_id	A comma-separated list of case IDs to update.	Required
case_name	The new name for the case.	Optional
description	The new description for the case.	Optional
assignee	The email address of the new assignee. Use “unassigned” to remove an existing assignee.	Optional
status	The new status for the case. Possible values are: new, in_progress, resolved.	Optional
notes	Additional notes for the case.	Optional
starred	Whether the case should be starred. Possible values are: true, false.	Optional
user_defined_severity	The user-defined severity for the case. Possible values are: low, medium, high, critical.	Optional
resolve_reason	The reason for resolving the case. Only relevant when status is set to resolved. Possible values are: known_issue, duplicate, false_positive, true_positive, security_testing, other.	Optional
resolved_comment	Comment when resolving the case. Only relevant when status is set to resolved.	Optional
resolve_all_alerts	Whether to resolve all alerts associated with the case. Only relevant when status is set to resolved. Possible values are: true, false.	Optional
custom_fields	A JSON encoded string representing custom field name-value pairs to update. (e.g., `{"field1": "value1", "multiselect_field": ["a", "b"]}`).	Optional

Context Output

Path	Type	Description
Core.Case.modifiedBy	String	User who last modified the case.
Core.Case.notes	String	Notes associated with the case.
Core.Case.userSeverity	String	User-defined severity for the case.
Core.Case.name.isUser	Boolean	Whether the case name is user-defined.
Core.Case.name.value	String	The name of the case.
Core.Case.creationTime	Number	The creation time of the case in milliseconds.
Core.Case.lastUpdateTime	Number	The last update time of the case in milliseconds.
Core.Case.topCounters.HOSTS	Number	Number of hosts in the case.
Core.Case.topCounters.MAL_ARTIFACTS	Number	Number of malicious artifacts in the case.
Core.Case.topCounters.USERS	Number	Number of users in the case.
Core.Case.assigned.mail	String	Email address of the assigned user.
Core.Case.assigned.pretty	String	Display name of the assigned user.
Core.Case.internalStatus	String	Internal status of the case.
Core.Case.status.resolveComment	String	Comment when resolving the case.
Core.Case.status.resolve_reason	String	Reason for resolving the case.
Core.Case.status.value	String	Status value of the case.
Core.Case.severityCounters.SEV_020_LOW	Number	Number of low severity alerts in the case.
Core.Case.severityCounters.SEV_030_MEDIUM	Number	Number of medium severity alerts in the case.
Core.Case.severityCounters.SEV_040_HIGH	Number	Number of high severity alerts in the case.
Core.Case.severityCounters.SEV_050_CRITICAL	Number	Number of critical severity alerts in the case.
Core.Case.caseDomain	String	Domain of the case.
Core.Case.groupingStatus.pretty	String	Pretty display of grouping status.
Core.Case.groupingStatus.raw	String	Raw grouping status value.
Core.Case.groupingStatus.reason	String	Reason for the grouping status.
Core.Case.tags.tag_id	String	Tag ID associated with the case.
Core.Case.tags.tag_name	String	Tag name associated with the case.

core-search-asset-groups

Retrieve asset groups from the Cortex platform with optional filtering.

Base Command

core-search-asset-groups

Input

name	JSON list of asset groups to search for. (e.g. `["group1", "group2"]`).	Optional
type	Filter asset groups by type.	Optional
description	JSON list of descriptions to search for. (e.g. `["description1", "description2"]`).	Optional
limit	The maximum number of groups to return.	Optional
id	Comma separated list of ids to search for.	Optional

Context Output

Core.AssetGroups.name	String	The name of the asset group.
Core.AssetGroups.filter	String	The filter criteria for the asset group.
Core.AssetGroups.membership_predicate	String	The predicate used to create the asset group.
Core.AssetGroups.type	String	The type of the asset group.
Core.AssetGroups.description	String	The description of the asset group.
Core.AssetGroups.modified_by	String	The user who modified the asset group.
Core.AssetGroups.modified_by_pretty	String	The formatted name of the user who created the asset group.
Core.AssetGroups.created_by	String	The user who created the asset group.
Core.AssetGroups.created_by_pretty	String	The formatted name of the user who created the asset group.

core-get-vulnerabilities

Retrieves vulnerabilities based on specified filters.

Base Command

core-get-vulnerabilities

Input

Argument Name	Description	Required
limit	The maximum number of vulnerabilities to return. Default is 50.	Optional
sort_field	The field by which to sort the results. Possible values are: PLATFORM_SEVERITY, CVSS_SCORE, EPSS_SCORE, CORTEX_VULNERABILITY_RISK_SCORE, LAST_OBSERVED. Default is LAST_OBSERVED.	Optional
sort_order	The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC.	Optional
cve_id	The CVE ID. Accepts a comma-separated list.	Optional
issue_id	The issue ID. Accepts a comma-separated list.	Optional
cvss_score_gte	The minimum CVSS score.	Optional
epss_score_gte	The minimum EPSS score.	Optional
internet_exposed	Filter by internet exposed assets. Possible values are: true, false.	Optional
exploitable	Filter by exploitable vulnerabilities. Possible values are: true, false.	Optional
has_kev	Filter by vulnerabilities that have a Known Exploited Vulnerability (KEV). Possible values are: true, false.	Optional
affected_software	Filter by affected software. Accepts a comma-separated list.	Optional
on_demand_fields	A comma-separated list of additional fields to retrieve.	Optional
start_time	The start time for filtering according to case creation time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025.	Optional
end_time	The end time for filtering according to case creation time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025.	Optional
severity	The severity of the vulnerability issue. Possible values are: info, low, medium, high, critical.	Optional
assignee	The email of the user assigned to the vulnerability. Accepts a comma-separated list. Use ‘unassigned’ for unassigned vulnerabilities or ‘assigned’ for all assigned vulnerabilities.	Optional
finding_sources	The finding sources of the vulnerability. Accepts a comma-separated list. Possible values are: CORTEX_AGENT, CORTEX_AGENTLESS_SCANNER, CORTEX_ATTACK_SURFACE_MANAGEMENT, CORTEX_ATTACK_SURFACE_TESTING, CORTEX_CLI_SCANNER, CORTEX_CONTAINER_REGISTRY_SCANNER, CORTEX_NETWORK_SCANNER, CORTEX_SERVERLESS_FUNCTION_SCANNER, QUALYS, TENABLE.	Optional
cvrs_gte	The minimum risk score assigned to the vulnerability (range 0-100).	Optional
compensating_controls_effective_coverage	The assessed effectiveness and coverage of detected compensating controls. Possible values are: EFFECTIVE, EFFECTIVE_REQUIRES_CONFIGURATION_UPDATE, EFFECTIVE_REQUIRES_CONTENT_UPDATE, EXPLOIT_CONFIRMED, EXPLOIT_UNREACHABLE, NOT_INSTALLED, NO_CONTROLS_FOUND, UNKNOWN_COVERAGE.	Optional

Context Output

Path	Type	Description
Core.VulnerabilityIssue.ISSUE_ID	String	The unique identifier for the vulnerability issue.
Core.VulnerabilityIssue.CVE_ID	String	The CVE identifier for the vulnerability.
Core.VulnerabilityIssue.CVE_DESCRIPTION	String	The description of the CVE.
Core.VulnerabilityIssue.ASSET_NAME	String	The name of the affected asset.
Core.VulnerabilityIssue.PLATFORM_SEVERITY	String	The severity of the vulnerability as determined by the platform.
Core.VulnerabilityIssue.EPSS_SCORE	Number	The Exploit Prediction Scoring System (EPSS) score.
Core.VulnerabilityIssue.CVSS_SCORE	Number	The Common Vulnerability Scoring System (CVSS) score.
Core.VulnerabilityIssue.ASSIGNED_TO	String	The email of the user assigned to the vulnerability.
Core.VulnerabilityIssue.ASSIGNED_TO_PRETTY	String	The full name of the user assigned to the vulnerability.
Core.VulnerabilityIssue.AFFECTED_SOFTWARE	Unknown	The software affected by the vulnerability.
Core.VulnerabilityIssue.FIX_AVAILABLE	Boolean	Indicates if a fix is available for the vulnerability.
Core.VulnerabilityIssue.INTERNET_EXPOSED	Boolean	Indicates if the asset is exposed to the internet.
Core.VulnerabilityIssue.HAS_KEV	Boolean	Indicates if the vulnerability is a Known Exploited Vulnerability (KEV).
Core.VulnerabilityIssue.EXPLOITABLE	Boolean	Indicates if the vulnerability is exploitable.
Core.VulnerabilityIssue.ASSET_IDS	String	The unique identifier for the asset.
Core.VulnerabilityIssue.FINDING_SOURCES	String	The finding sources that originally generated the security finding of the vulnerability.
Core.VulnerabilityIssue.COMPENSATING_CONTROLS_DETECTED_COVERAGE	String	The coverage status of detected compensating controls, mirroring the input parameter enum values.
Core.VulnerabilityIssue.CORTEX_VULNERABILITY_RISK_SCORE	Number	The risk score assigned to the vulnerability.
Core.VulnerabilityIssue.FIX_VERSIONS	Array	The package versions that contain a fix for the vulnerability.
Core.VulnerabilityIssue.ASSET_TYPES	Array	The types of assets affected by the vulnerability.
Core.VulnerabilityIssue.COMPENSATING_CONTROLS_DETECTED_CONTROLS	Array	The compensating controls that were detected for the vulnerability.
Core.VulnerabilityIssue.EXPLOIT_LEVEL	String	The exploitability level or status of the vulnerability.
Core.VulnerabilityIssue.ISSUE_NAME	String	The name of the vulnerability issue.
Core.VulnerabilityIssue.PACKAGE_IN_USE	Boolean	Indicates whether the vulnerable package is actively used in the environment.
Core.VulnerabilityIssue.PROVIDERS	Array	The providers or sources of the vulnerability information.
Core.VulnerabilityIssue.OS_FAMILY	String	The operating system family of the affected asset.
Core.VulnerabilityIssue.IMAGE	String	Information related to the affected container or system image.

core-search-assets

Retrieves asset from the Cortex platform using optional filter criteria.

Base Command

core-search-assets

Input

Argument Name	Description	Required
page_size	The number of assets to return per page. Default is 100. Maximum is 5000.	Optional
page_number	The page number for the assets to return for pagination. Default is 0.	Optional
asset_names	Comma-separated list of asset names to search for. (e.g., “asset_name1,asset_name2”).	Optional
asset_types	Comma-separated list of asset types to search for. (e.g., “asset_type1,asset_type2”).	Optional
asset_tags	A JSON encoded string representing a list of tag:value pairs to search for. (e.g., `[{"tag1": "value1"}, {"tag2": "value2"}]`). .	Optional
asset_ids	Comma-separated list of asset IDs to search for. (e.g., “asset_id1,asset_id2”).	Optional
asset_providers	Comma-separated list of asset providers to search for. (e.g., “provider1,provider2”).	Optional
asset_realms	Comma-separated list of asset realms to search for. (e.g., “realm1,realm2”).	Optional
asset_groups	A JSON encoded string representing a list of asset groups to search for. (e.g., `["group1", "group2"]`). .	Optional
asset_categories	A Comma-separated list of asset categories to search for. (e.g., “category1,category2”).	Optional
asset_classes	A comma-separated list of asset classes to search for. Possible values are: AI, API, Application, Code, Compute, Data, Device, External Surface, Identity, Management, Network, Organization, Other, Security Services.	Optional
software_package_versions	A comma-separated list of software package versions to search for. (e.g., “0.23.0,5.2.0”).	Optional
kubernetes_cluster_versions	A comma-separated list of Kubernetes cluster versions to search for. (e.g., “1.22,1.3”).	Optional

Context Output

Path	Type	Description
Core.Asset.external_provider_id	unknown	The external provider ID of the asset.
Core.Asset.first_observed	unknown	The first time the asset was observed.
Core.Asset.tags	unknown	The tags of the asset.
Core.Asset.realm	unknown	The realm of the asset.
Core.Asset.type.id	unknown	The ID of the asset type.
Core.Asset.related_issues.critical_issues	unknown	Critical issues related to the asset.
Core.Asset.id	unknown	The ID of the asset.
Core.Asset.last_observed	unknown	The last time the asset was observed.
Core.Asset.type.category	unknown	The category of the asset type.
Core.Asset.related_cases.critical_cases	unknown	Critical cases related to the asset.
Core.Asset.group_ids	unknown	The group IDs of the asset.
Core.Asset.type.class	unknown	The class of the asset type.
Core.Asset.related_issues.issues_breakdown	unknown	The related issues breakdown of the asset.
Core.Asset.type.name	unknown	The type of the asset.
Core.Asset.name	unknown	The name of the asset.
Core.Asset.strong_id	unknown	The strong ID of the asset.
Core.Asset.cloud.region	unknown	The cloud region of the asset.
Core.Asset.related_cases.cases_breakdown	unknown	The related cases breakdown of the asset.
Core.Asset.provider	unknown	The asset provider.
Core.Asset.kubernetes.cluster.version	unknown	The Kubernetes cluster version of the asset.
Core.Asset.software_package.version	unknown	The software package version of the asset.

core-get-issue-recommendations

Get comprehensive recommendations for an issue, including remediation steps, playbook suggestions, and recommended actions.

Base Command

core-get-issue-recommendations

Input

Argument Name	Description	Required
issue_ids	Comma-separated list of IDs of the issues to get recommendations for (maximum 10 per request).	Required

Context Output

Path	Type	Description
Core.IssueRecommendations.issue_id	String	The unique identifier for the issue.
Core.IssueRecommendations.issue_name	String	The name of the issue.
Core.IssueRecommendations.severity	String	The severity of the issue.
Core.IssueRecommendations.description	String	Description of the issue.
Core.IssueRecommendations.remediation	String	Remediation steps and recommendations for the issue.
Core.IssueRecommendations.playbook_suggestions.playbook_id	String	The ID of the suggested playbook.
Core.IssueRecommendations.playbook_suggestions.suggestion_rule_id	String	The ID of the suggestion rule that generated this recommendation.
Core.IssueRecommendations.playbook_suggestions.name	String	The name of the suggested playbook.
Core.IssueRecommendations.playbook_suggestions.comment	String	An explanation of the suggested playbook.
Core.IssueRecommendations.quick_action_suggestions.name	String	The name of the suggested quick action.
Core.IssueRecommendations.quick_action_suggestions.suggestion_rule_id	String	The ID of the suggestion quick action rule that generated this recommendation.
Core.IssueRecommendations.quick_action_suggestions.brand	String	The brand of the quick action.
Core.IssueRecommendations.quick_action_suggestions.category	String	The category of the quick action.
Core.IssueRecommendations.quick_action_suggestions.description	String	An explanation of the quick action.
Core.IssueRecommendations.quick_action_suggestions.pretty_name	String	The display name of the quick action.
Core.IssueRecommendations.quick_action_suggestions.arguments.name	String	The argument name.
Core.IssueRecommendations.quick_action_suggestions.arguments.prettyName	String	The argument display name.
Core.IssueRecommendations.quick_action_suggestions.arguments.prettyPredefined	String	The argument predefined display value.
Core.IssueRecommendations.quick_action_suggestions.arguments.description	String	The argument description.
Core.IssueRecommendations.quick_action_suggestions.arguments.required	String	Whether the argument is required.
Core.IssueRecommendations.existing_code_block	String	Original vulnerable code.
Core.IssueRecommendations.suggested_code_block	String	Code block fix suggestion.
Core.IssueRecommendations.network_reachability	Json	The Network reachability information for the issue.

core-enable-scanners

Enable or disable scanners with the specified configuration.

Base Command

core-enable-scanners

Input

Argument Name	Description	Required
asset_ids	List of repository asset IDs to configure scanners for.	Required
enable_scanners	List of scanners to enable. Possible values are: SECRETS, IAC, SCA.	Optional
disable_scanners	List of scanners to disable. Possible values are: SECRETS, IAC, SCA.	Optional
secret_validation	Enable live validation of discovered secrets. Possible values are: true, false.	Optional
pr_scanning	Enable scanning on pull requests. This argument only relevant when SECRETS scanner is enabled. Possible values are: true, false.	Optional
block_on_error	Block deployment on scanner errors. Possible values are: true, false.	Optional
tag_resource_blocks	Enable tagging of resource blocks. Possible values are: true, false.	Optional
tag_module_blocks	Enable tagging of module blocks. Possible values are: true, false.	Optional
exclude_paths	List of file paths to exclude from scanning.	Optional

core-get-asset-coverage-histogram

Calculates the distribution of values (counts and percentages) for specified categorical fields.

Base Command

core-get-asset-coverage-histogram

Input

Argument Name	Description	Required
asset_id	The unique ID of the asset. Accepts a comma-separated list.	Optional
asset_name	The name of the asset. Accepts a comma-separated list.	Optional
business_application_names	Business application names. Accepts a comma-separated list.	Optional
status_coverage	The status coverage. Accepts a comma-separated list. Possible values are: FULLY SCANNED, NOT SCANNED, PARTIALLY SCANNED.	Optional
is_scanned_by_vulnerabilities	Is scanned by vulnerabilities. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_code_weakness	Is scanned by code weakness. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_secrets	Is scanned by secrets. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_iac	Is scanned by IaC. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_malware	Is scanned by malware. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_cicd	Is scanned by CICD. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
last_scan_status	The last scan status. Accepts a comma-separated list. Possible values are: NOT_SCANNED_YET, ERROR, COMPLETED.	Optional
asset_type	The asset type. Accepts a comma-separated list. Possible values are: CICD PIPELINE, CONTAINER IMAGE REPOSITORY, REPOSITORY.	Optional
asset_provider	The asset provider. Accepts a comma-separated list. Possible values are: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_PIPELINES, AZURE_REPOS, BITBUCKET, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITLAB, GITLAB_CI, HCP_TFC_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI.	Optional
vendor_name	The vendor name. Accepts a comma-separated list. Possible values are: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_REPOS, BITBUCKET, BITBUCKET_DATACENTER, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITHUB_ENTERPRISE, GITLAB, GITLAB_SELF_MANAGED, HCP_TFC_RUN_TASKS, HCP_TFE_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI.	Optional
max_values_per_column	The maximum number of distinct values to return for each column. Default is 100.	Optional
columns	A list of fields for which to generate histograms. Possible values are: asset_name, business_application_names, status_coverage, is_scanned_by_vulnerabilities, is_scanned_by_code_weakness, is_scanned_by_secrets, is_scanned_by_iac, is_scanned_by_malware, is_scanned_by_cicd, last_scan_status, asset_type, asset_provider, vendor_name.	Required

Context Output

Path	Type	Description
Core.Coverage.Histogram.column_name	String	The column over which the histogram is generated.
Core.Coverage.Histogram.data.value	String	The distinct value.
Core.Coverage.Histogram.data.count	Number	The number of records with this value after filtering.
Core.Coverage.Histogram.data.percentage	Number	The percentage of filtered records with this value.
Core.Coverage.Histogram.data.pretty_name	String	A user-friendly label for the value.

core-get-asset-coverage

Retrieves a list of assets (e.g., Repositories, CI/CD Pipelines, Container Image Repositories) along with their scan coverage status.

Base Command

core-get-asset-coverage

Input

Argument Name	Description	Required
asset_id	The unique ID of the asset. Accepts a comma-separated list.	Optional
asset_name	The name of the asset. Accepts a comma-separated list.	Optional
business_application_names	Business application names. Accepts a comma-separated list.	Optional
status_coverage	The status coverage. Accepts a comma-separated list. Possible values are: FULLY SCANNED, NOT SCANNED, PARTIALLY SCANNED.	Optional
is_scanned_by_vulnerabilities	Is scanned by vulnerabilities. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_code_weakness	Is scanned by code weakness. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_secrets	Is scanned by secrets. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_iac	Is scanned by IaC. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_malware	Is scanned by malware. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
is_scanned_by_cicd	Is scanned by CICD. Accepts a comma-separated list. Possible values are: DISABLED, ENABLED, IRRELEVANT.	Optional
last_scan_status	The last scan status. Accepts a comma-separated list. Possible values are: NOT_SCANNED_YET, ERROR, COMPLETED.	Optional
asset_type	The asset type. Accepts a comma-separated list. Possible values are: CICD PIPELINE, CONTAINER IMAGE REPOSITORY, REPOSITORY.	Optional
asset_provider	The asset provider. Accepts a comma-separated list. Possible values are: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_PIPELINES, AZURE_REPOS, BITBUCKET, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITLAB, GITLAB_CI, HCP_TFC_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI.	Optional
vendor_name	The vendor name. Accepts a comma-separated list. Possible values are: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_REPOS, BITBUCKET, BITBUCKET_DATACENTER, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITHUB_ENTERPRISE, GITLAB, GITLAB_SELF_MANAGED, HCP_TFC_RUN_TASKS, HCP_TFE_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI.	Optional
limit	The maximum number of assets to return. Default is 100.	Optional
sort_field	The field by which to sort the results. Possible values are: asset_id, asset_name, business_application_names, status_coverage, is_scanned_by_vulnerabilities, is_scanned_by_code_weakness, is_scanned_by_secrets, is_scanned_by_iac, is_scanned_by_malware, is_scanned_by_cicd, last_scan_status, asset_type, asset_provider, vendor_name.	Optional
sort_order	The order in which to sort the results. Possible values are: DESC, ASC.	Optional

Context Output

Path	Type	Description
Core.Coverage.Asset.asset_id	String	The unique ID of the asset. Each asset is assigned a unique identifier in the system.
Core.Coverage.Asset.asset_name	String	The name of the asset. Typically corresponds to the repository, container image, or pipeline name.
Core.Coverage.Asset.asset_provider	String	The vendor or source platform of the asset. Indicates where the asset originates from. Possible values: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_REPOS, BITBUCKET, BITBUCKET_DATACENTER, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITHUB_ENTERPRISE, GITLAB, GITLAB_SELF_MANAGED, HCP_TFC_RUN_TASKS, HCP_TFE_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI.
Core.Coverage.Asset.asset_type	String	The type or category of the asset. Determines the nature of the resource being scanned. Possible values: CICD PIPELINE, CONTAINER IMAGE REPOSITORY, REPOSITORY.
Core.Coverage.Asset.business_application_names	Array	A list of business applications associated with the asset. These applications help map the asset to business context or ownership.
Core.Coverage.Asset.is_scanned_by_cicd	String	Indicates whether the asset is scanned within CI/CD pipelines. Possible values: ENABLED, DISABLED, IRRELEVANT.
Core.Coverage.Asset.is_scanned_by_code_weakness	String	Indicates whether code weakness scanning is performed on the asset. Possible values: ENABLED, DISABLED, IRRELEVANT.
Core.Coverage.Asset.is_scanned_by_iac	String	Indicates whether infrastructure-as-code (IaC) scanning is enabled for the asset. Possible values: ENABLED, DISABLED, IRRELEVANT.
Core.Coverage.Asset.is_scanned_by_malware	String	Indicates whether malware scanning is enabled for the asset. Possible values: ENABLED, DISABLED, IRRELEVANT.
Core.Coverage.Asset.is_scanned_by_secrets	String	Indicates whether the asset is scanned for hardcoded secrets or credentials. Possible values: ENABLED, DISABLED, IRRELEVANT.
Core.Coverage.Asset.is_scanned_by_semgrep	Boolean	Boolean flag indicating whether the asset is analyzed using Semgrep for code issues or misconfigurations. Possible values: true, false.
Core.Coverage.Asset.is_scanned_by_sonarqube	Boolean	Boolean flag indicating whether the asset is analyzed using SonarQube for code quality and security issues. Possible values: true, false.
Core.Coverage.Asset.is_scanned_by_veracode	Boolean	Boolean flag indicating whether the asset is scanned using Veracode for security vulnerabilities. Possible values: true, false.
Core.Coverage.Asset.is_scanned_by_vulnerabilities	String	Indicates whether vulnerability scanning is enabled for the asset. Possible values: ENABLED, DISABLED, IRRELEVANT.
Core.Coverage.Asset.last_scan_status	String	The status of the most recent scan performed on the asset. Possible values: NOT_SCANNED_YET, ERROR, COMPLETED.
Core.Coverage.Asset.scanners_data	Array	An array containing detailed information from the scanners that evaluated the asset, including scan results, timestamps, and metadata.
Core.Coverage.Asset.status_coverage	String	The overall scan coverage of the asset. Possible values: FULLY SCANNED, PARTIALLY SCANNED, NOT SCANNED.
Core.Coverage.Asset.unified_provider	String	The unified provider name associated with the asset. Standardized across different vendor integrations. Possible values: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_PIPELINES, AZURE_REPOS, BITBUCKET, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITLAB, GITLAB_CI, HCP_TFC_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI.

core-create-appsec-policy

Creates a new AppSec policy in Cortex Platform with defined conditions, scope, and triggers for application security governance.

Base Command

core-create-appsec-policy

Input

Argument Name	Description	Required
policy_name	A unique name for the AppSec policy. Must be descriptive and follow organizational naming conventions.	Required
description	A detailed explanation of the policy’s objective, use case, and expected outcomes.	Optional
asset_group_names	Comma-separated list of Asset Group names to apply the policy to. Asset groups will be automatically resolved to their corresponding IDs.	Optional
conditions_finding_type	Filter by specific finding types to target policy enforcement. Supported values: Vulnerabilities, IaC Misconfiguration, Licenses, Operational Risk, Secrets, Code Weaknesses, CI/CD Risks.	Optional
conditions_severity	Filter findings by severity level to prioritize policy actions. Supported values: CRITICAL, HIGH, MEDIUM, LOW.	Optional
conditions_respect_developer_suppression	Controls whether a developer’s manual suppression should be honored. Set to ‘true’ to respect developer suppression (evaluate only non-suppressed findings). Set to ‘false’ to ignore suppression and always evaluate the finding. Possible values are: true, false.	Optional
conditions_backlog_status	Filter findings based on their backlog workflow status (NEW or BACKLOG). Possible values are: NEW, BACKLOG.	Optional
conditions_package_name	Target specific software packages by name for license or vulnerability policies.	Optional
conditions_package_version	Specify software package version constraints for precise policy targeting.	Optional
conditions_package_operational_risk	Filter packages by their operational risk assessment level. Supported values: HIGH, MEDIUM, LOW.	Optional
conditions_appsec_rule_names	Comma-separated list of AppSec rule names to include in policy evaluation. Rule names will be automatically resolved to their corresponding IDs.	Optional
conditions_cvss	CVSS base score threshold for vulnerability findings (0.0-10.0). Only vulnerabilities meeting or exceeding this score will trigger the policy.	Optional
conditions_epss	Exploit Prediction Scoring System score threshold (0-100). Targets vulnerabilities with higher exploitation probability.	Optional
conditions_has_a_fix	Filter findings based on whether a remediation fix or patch is available. Possible values are: true, false.	Optional
conditions_is_kev	Target findings listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog for prioritized remediation. Possible values are: true, false.	Optional
conditions_secret_validity	Filter exposed secrets by their validity status. Supported values: VALID (active secrets), PRIVILEGED (high-access secrets), INVALID (expired/revoked), UNAVAILABLE (status unknown).	Optional
conditions_license_type	Target specific software license types for compliance and legal risk management.	Optional
scope_category	Define asset categories to include in policy scope. Supported values: Application, Repository, CI/CD Instance, CI/CD Pipeline, VCS Collaborator, VCS Organization.	Optional
scope_business_application_names	Target specific business applications by name for focused policy enforcement.	Optional
scope_application_business_criticality	Filter applications by business criticality level. Supported values: CRITICAL, HIGH, MEDIUM, LOW.	Optional
scope_repository_name	Target specific code repositories by name for repository-focused policies.	Optional
scope_is_public_repository	Filter repositories based on their visibility (public vs private) for exposure risk management. Possible values are: true, false.	Optional
scope_has_deployed_assets	Target repositories or applications that have associated deployed infrastructure or runtime assets. Possible values are: true, false.	Optional
scope_has_internet_exposed_deployed_assets	Filter assets based on whether the deployed components are exposed to internet traffic for external attack surface management. Possible values are: true, false.	Optional
scope_has_sensitive_data_access	Target deployed assets that have access to sensitive data stores, databases, or classified information. Possible values are: true, false.	Optional
scope_has_privileged_capabilities	Filter deployed assets with elevated privileges, admin access, or high-impact system capabilities. Possible values are: true, false.	Optional
triggers_periodic_report_issue	Enables detection during scheduled scans. When a violation is found in a periodic scan, an issue will be created (“Detect”). Possible values are: true, false.	Optional
triggers_periodic_override_severity	Override the default severity level for issues created by periodic scan detections. Possible values are: Critical, High, Medium, Low.	Optional
triggers_pr_report_issue	Enables detection during pull request scans. When a violation is found in a PR, an issue is created. Required for PR-based detection. Possible values are: true, false.	Optional
triggers_pr_block_pr	Blocks merging of pull requests that contain violations detected by the policy. Possible values are: true, false.	Optional
triggers_pr_report_pr_comment	Adds an automated comment to pull requests summarizing detected violations and guidance. Possible values are: true, false.	Optional
triggers_pr_override_severity	Override the default severity level for issues created by pull request detections. Possible values are: Critical, High, Medium, Low.	Optional
triggers_cicd_report_issue	Enables detection during CI/CD pipeline scans. When a violation is found in a pipeline run, an issue is created. Possible values are: true, false.	Optional
triggers_cicd_block_cicd	Blocks or fails CI/CD pipeline runs when violations occur. Possible values are: true, false.	Optional
triggers_cicd_report_cicd	Reports violation details back to the CI/CD system (pipeline logs, dashboards, status checks). Possible values are: true, false.	Optional
triggers_cicd_override_severity	Override the default severity level for issues created by CI/CD pipeline detections. Possible values are: Critical, High, Medium, Low.	Optional

Context Output

There is no context output for this command.

core-update-issue

Updates the properties of an issue. This command does not provide an explicit indication of success.

Base Command

core-update-issue

Input

Argument Name	Description	Required
id	Issue ID to update. If empty, updates the current issue ID.	Optional
assigned_user_mail	Email address of the user to assign the issue to.	Optional
severity	Change the severity of an issue. Possible values are: low, medium, high, critical.	Optional
name	Change the issue name.	Optional
occurred	Change the occurred time of an issue. Supports different time formats, for example: 3 days ago, 2017-09-27T10:00:00+03:00.	Optional
phase	Change the phase of an issue. Possible values are: Triage, Investigation, Containment, Response.	Optional
type	Change the type of an issue.	Optional
description	Change the description of an issue.	Optional
status	Change the status of an issue. Possible values are: New, In Progress, Resolved - Known Issue, Resolved - Duplicate Issue, Resolved - False Positive, Resolved - other, Resolved - True Positive, Resolved - Security Testing, Resolved - Dismissed, Resolved - Fixed, Resolved - Risk Accepted.	Optional

Context Output

There is no context output for this command.

core-appsec-remediate-issue

Create automated pull requests to fix multiple security issues in a single bulk operation.

Base Command

core-appsec-remediate-issue

Input

Argument Name	Description	Required
issue_ids	A comma-separated list of issue IDs to fix (maximum 10 per request).	Required
title	Custom title for the pull request.	Optional

Context Output

Path	Type	Description
Core.TriggeredPRs.issueId	String	The issue identifier.
Core.TriggeredPRs.status	String	Either “triggered” or “automated_fix_not_available”.

core-get-appsec-issues

Retrieves application security issues based on specified filters.

Base Command

core-get-appsec-issues

Input

Argument Name	Description	Required
limit	The maximum number of issues to return. Default is 50.	Optional
sort_field	The field by which to sort the results. Default is severity.	Optional
sort_order	The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC.	Optional
start_time	The start time for filtering according to issue insert time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025.	Optional
end_time	The end time for filtering according to issue insert time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025.	Optional
issue_id	The issue ID. Accepts a comma-separated list.	Optional
assignee	The email of the user assigned to the issue. Accepts a comma-separated list. Use ‘unassigned’ for all unassigned issues or ‘assigned’ for all assigned issues. .	Optional
collaborator	The collaborators of the issue. Accepts a comma-separated list.	Optional
status	The issue status. Accepts a comma-separated list. Possible values are: New, In Progress, Resolved.	Optional
issue_name	The issue name. Accepts a comma-separated list.	Optional
asset_name	The name of the affected asset for the issue. Accepts a comma-separated list.	Optional
repository	The repository of the issue. Accepts a comma-separated list.	Optional
file_path	The path of the relevant file for the issue. Accepts a comma-separated list.	Optional
backlog_status	The backlog status of the issue. Accepts a comma-separated list. Possible values are: BACKLOG, NEW.	Optional
cvss_score_gte	The minimum CVSS score.	Optional
epss_score_gte	The minimum EPSS score.	Optional
has_kev	Filter by vulnerabilities that have a Known Exploited Vulnerability (KEV). Possible values are: true, false.	Optional
severity	The severity of the issue. Accepts a comma-separated list. Possible values are: info, low, medium, high, critical.	Optional
urgency	The urgency of the issue. Accepts a comma-separated list. Possible values are: N/A, NOT_URGENT, URGENT, TOP_URGENT.	Optional
automated_fix_available	Is there an available automated fix. Possible values are: true, false.	Optional
sla	SLA status of the issue. Accepts a comma-separated list. Possible values are: Approaching, On Track, Overdue.	Optional
validation	Validation status of the issue. Accepts a comma-separated list. Possible values are: INVALID, NO_VALIDATION, PRIVILEGED, UNAVAILABLE, VALID.	Optional

Context Output

Path	Type	Description
Core.AppsecIssue.internal_id	String	The unique identifier for the issue.
Core.AppsecIssue.asset_name	String	The names of the assets related to the issue.
Core.AppsecIssue.severity	String	The severity of the issue.
Core.AppsecIssue.epss_score	Number	The Exploit Prediction Scoring System (EPSS) score.
Core.AppsecIssue.cvss_score	Number	The Common Vulnerability Scoring System (CVSS) score.
Core.AppsecIssue.assignee	String	The full name of the user assigned to the issue.
Core.AppsecIssue.is_fixable	Boolean	Whether a fix is available for the issue.
Core.AppsecIssue.issue_name	String	The name of the issue.
Core.AppsecIssue.issue_source	String	The source of the issue.
Core.AppsecIssue.issue_category	String	The category of the issue.
Core.AppsecIssue.issue_domain	String	The domain of the issue.
Core.AppsecIssue.issue_description	String	The description of the issue.
Core.AppsecIssue.status	String	The status of the issue.
Core.AppsecIssue.time_added	Number	The timestamp when the issue was inserted.
Core.AppsecIssue.urgency	String	The urgency of the issue.
Core.AppsecIssue.sla_status	String	The SLA status of the issue.
Core.AppsecIssue.secret_validation	String	The secret validation status of the issue.
Core.AppsecIssue.repository_name	String	The name of the repository where the issue was found.
Core.AppsecIssue.repository_organization	String	The organization of the repository where the issue was found.
Core.AppsecIssue.file_path	String	The file path related to the issue.
Core.AppsecIssue.collaborator	String	The collaborator associated with the issue.
Core.AppsecIssue.has_kev	Boolean	Whether the issue is part of the Known Exploited Vulnerabilities catalog (KEV).
Core.AppsecIssue.backlog_status	String	The backlog status of the issue.

core-update-endpoint-version

Updates the version of the given endpoint to the target version supplied.

Base Command

core-update-endpoint-version

Input

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs.	Required
platform	The platform of the endpoints. Possible values are: windows, macos, linux.	Required
version	The target version for updating the endpoints.	Required
start_time	The start time for the update. Enter the time in a 24-hour format (HH:MM). Ensure that there are at least two hours between the start time and the end time.	Optional
end_time	The end time for the update. Enter the time in a 24-hour format (HH:MM).	Optional
days	A comma-separated list of days of the week the update may run. Possible values are: Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday.	Optional

Context Output

Path	Type	Description
Core.EndpointUpdate.endpoint_ids	String	The IDs of the endpoints on which the update run.
Core.EndpointUpdate.action_id	String	The ID of the update action. 0 means that the action failed.

core-get-endpoint-update-version

Retrieves endpoint update versions for the provided endpoint IDs.

Base Command

core-get-endpoint-update-version

Input

Argument Name	Description	Required
endpoint_ids	A comma-separated list of endpoint IDs.	Required

Context Output

Path	Type	Description
Core.EndpointUpdateVersion.total_count	String	Total number of endpoints.
Core.EndpointUpdateVersion.platform_count	String	Number of endpoints per platform.
Core.EndpointUpdateVersion.distributions.platform	String	The platform of the endpoint update.
Core.EndpointUpdateVersion.distributions.version	String	The version of the endpoint update.
Core.EndpointUpdateVersion.distributions.endpoints_with_higher_version_count	String	The number of endpoints running a version later than the specified update.
Core.EndpointUpdateVersion.distributions.endpoints_with_same_version_count	String	The number of endpoints running the same version as the specified update.
Core.EndpointUpdateVersion.distributions.endpoints_with_lower_version_count	String	The number of endpoints running a version earlier than the specified update.

<~PLATFORM>

License Requirements

The following commands require one of these licenses: Cortex XSIAM, EP / EDR - Endpoint Protection, Cortex Cloud, Cloud Posture (Security), or Cloud Runtime Security:

core-list-endpoints

The following commands require one of these licenses: Cortex XSIAM, EP / EDR - Endpoint Protection, or Cloud Runtime Security:

core-get-endpoint-support-file
core-list-scripts
core-run-script-agentix
core-get-endpoint-update-version
core-update-endpoint-version

The following commands require one of these licenses: Cloud Posture (Security) or Cloud Runtime Security:

core-add-assessment-profile
core-list-compliance-standards

</~PLATFORM>

Configuration parameters

timeout — HTTP Timeout

Commands (40)

core-add-assessment-profile
Create new assessment profile.
core-appsec-remediate-issue
Create automated pull requests to fix multiple security issues in a single bulk operation.
core-create-appsec-policy
Creates a new AppSec policy in Cortex Platform with defined conditions, scope, and triggers for application security governance.
core-create-endpoint-policy
Creates a new endpoint policy and applies it to specified endpoints. Automatically handles priority conflicts by shifting existing policies when needed.
core-create-windows-exploit-profile
Creates a new Windows exploit profile.
core-create-windows-malware-profile
Creates a new windows malware profile.
core-delete-endpoint-policy
Deletes one or more existing endpoint policies from the policy table.
core-delete-profile
Deletes the provided profiles.
core-enable-scanners
Enable or disable scanners with the specified configuration.
core-get-ai-model-activity
Retrieves AI model activity information including usage statistics and inactive status.
core-get-appsec-issues
Retrieves application security issues based on specified filters.
core-get-asset-coverage
Retrieves a list of assets (e.g., Repositories, CI/CD Pipelines, Container Image Repositories) along with their scan coverage status.
core-get-asset-coverage-histogram
Calculates the distribution of values (counts and percentages) for specified categorical fields.
core-get-asset-details
Get asset information.
core-get-case-extra-data
Get extra data fields of a specific case, including issues and key artifacts.
core-get-case-resolution-statuses
Retrieves resolution status information for a specific case.
core-get-cases
Get case information based on the specified filters.
core-get-endpoint-support-file
Retrieves endpoint support files based on specified endpoint IDs.
core-get-endpoint-update-version
Retrieves endpoint update versions for the provided endpoint IDs.
core-get-issue-recommendations
Get comprehensive recommendations for an issue, including remediation steps, playbook suggestions, and recommended actions.
core-get-issues
Returns a list of issues and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.
core-get-vulnerabilities
Retrieves vulnerabilities based on specified filters.
core-list-brokers
Retrieves information about broker VMs configured on the system.
core-list-compliance-standards
Create new assessment profile.
core-list-endpoints
Retrieves endpoints based on the provided filters.
core-list-exception-rules
Returns a list of exception rules and their metadata, which you can filter by built-in arguments. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.
core-list-findings
Retrieves findings from the Cortex platform.
core-list-scripts
Gets a list of scripts available in the scripts library.
core-list-system-users
Returns a list users and their core properties within the system. Results are limited to 50.
core-run-playbook
Runs a playbook on specific issue IDs.
core-run-script-agentix
Run a script on endpoints.
core-search-asset-groups
Searches for asset groups from the Cortex platform using one or more filter criteria.
core-search-assets
Retrieves asset from the Cortex platform using optional filter criteria.
core-send-endpoint-heartbeat
Sends endpoint heartbeat.
core-update-case
Updates the properties of a case.
core-update-endpoint-version
Updates the version of the given endpoint to the target version supplied.
core-update-issue
Updates the properties of an issue. This command does not provide an explicit indication of success.
core-update-windows-exploit-profile
Updates the specified Windows exploit profile.
core-update-windows-malware-profile
Updates the specified Windows malware profile.
core-xql-generic-query-platform
Execute an XQL query and retrieve a link to the query in the query center. If set to wait for results, the command will be executed every 10 seconds until results are retrieved or until the timeout is reached.

Source

CortexPlatformCore.py CortexPlatformCore_test.py CortexPlatformCore.yml CortexPlatformCore_description.md command_examples.txt

Download History Raw

name: Cortex Core - Platform
display: Cortex Platform - Core
category: Endpoint
provider: Palo Alto Networks
defaultEnabled: true
sectionorder:
  - Connect
  - Collect
commonfields:
  id: Cortex Core - Platform
  version: -1
configuration:
  - additionalinfo: The timeout of the HTTP requests sent to Cortex API (in seconds).
    defaultvalue: "120"
    display: HTTP Timeout
    name: timeout
    type: 0
    required: false
    section: Connect
description: This integration uses the Cortex API to access all the core services and capabilities of the Cortex platform.
script:
  commands:
    - arguments:
        - description: The unique ID of the asset. Accepts a comma-separated list.
          name: asset_id
          isArray: true
        - description: The name of the asset. Accepts a comma-separated list.
          name: asset_name
          isArray: true
        - description: Business application names. Accepts a comma-separated list.
          name: business_application_names
          isArray: true
        - auto: PREDEFINED
          description: The status coverage. Accepts a comma-separated list.
          isArray: true
          name: status_coverage
          predefined:
            - FULLY SCANNED
            - NOT SCANNED
            - PARTIALLY SCANNED
        - auto: PREDEFINED
          description: Is scanned by vulnerabilities. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_vulnerabilities
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by code weakness. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_code_weakness
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by secrets. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_secrets
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by IaC. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_iac
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by malware. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_malware
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by CICD. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_cicd
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: The last scan status. Accepts a comma-separated list.
          isArray: true
          name: last_scan_status
          predefined:
            - NOT_SCANNED_YET
            - ERROR
            - COMPLETED
        - auto: PREDEFINED
          description: The asset type. Accepts a comma-separated list.
          isArray: true
          name: asset_type
          predefined:
            - CICD PIPELINE
            - CONTAINER IMAGE REPOSITORY
            - REPOSITORY
        - auto: PREDEFINED
          description: The asset provider. Accepts a comma-separated list.
          isArray: true
          name: asset_provider
          predefined:
            - AWS
            - AWS_CODE_BUILD
            - AWS_CODE_COMMIT
            - AZURE
            - AZURE_PIPELINES
            - AZURE_REPOS
            - BITBUCKET
            - CIRCLE_CI
            - DOCKER
            - GCP
            - GITHUB
            - GITHUB_ACTIONS
            - GITLAB
            - GITLAB_CI
            - HCP_TFC_RUN_TASKS
            - JENKINS
            - JFROG_ARTIFACTORY
            - OCI
        - auto: PREDEFINED
          description: The vendor name. Accepts a comma-separated list.
          isArray: true
          name: vendor_name
          predefined:
            - AWS
            - AWS_CODE_BUILD
            - AWS_CODE_COMMIT
            - AZURE
            - AZURE_REPOS
            - BITBUCKET
            - BITBUCKET_DATACENTER
            - CIRCLE_CI
            - DOCKER
            - GCP
            - GITHUB
            - GITHUB_ACTIONS
            - GITHUB_ENTERPRISE
            - GITLAB
            - GITLAB_SELF_MANAGED
            - HCP_TFC_RUN_TASKS
            - HCP_TFE_RUN_TASKS
            - JENKINS
            - JFROG_ARTIFACTORY
            - OCI
        - name: max_values_per_column
          description: "The maximum number of distinct values to return for each column."
          defaultValue: "100"
        - name: columns
          description: A list of fields for which to generate histograms.
          isArray: true
          required: true
          predefined:
            - asset_name
            - business_application_names
            - status_coverage
            - is_scanned_by_vulnerabilities
            - is_scanned_by_code_weakness
            - is_scanned_by_secrets
            - is_scanned_by_iac
            - is_scanned_by_malware
            - is_scanned_by_cicd
            - last_scan_status
            - asset_type
            - asset_provider
            - vendor_name
      name: core-get-asset-coverage-histogram
      description: "Calculates the distribution of values (counts and percentages) for specified categorical fields."
      outputs:
        - contextPath: Core.Coverage.Histogram.column_name
          description: The column over which the histogram is generated.
          type: String
        - contextPath: Core.Coverage.Histogram.data.value
          description: The distinct value.
          type: String
        - contextPath: Core.Coverage.Histogram.data.count
          description: The number of records with this value after filtering.
          type: Number
        - contextPath: Core.Coverage.Histogram.data.percentage
          description: The percentage of filtered records with this value.
          type: Number
        - contextPath: Core.Coverage.Histogram.data.pretty_name
          description: A user-friendly label for the value.
          type: String
    - arguments:
        - description: The unique ID of the asset. Accepts a comma-separated list.
          name: asset_id
          isArray: true
        - description: The name of the asset. Accepts a comma-separated list.
          name: asset_name
          isArray: true
        - description: Business application names. Accepts a comma-separated list.
          name: business_application_names
          isArray: true
        - auto: PREDEFINED
          description: The status coverage. Accepts a comma-separated list.
          isArray: true
          name: status_coverage
          predefined:
            - FULLY SCANNED
            - NOT SCANNED
            - PARTIALLY SCANNED
        - auto: PREDEFINED
          description: Is scanned by vulnerabilities. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_vulnerabilities
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by code weakness. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_code_weakness
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by secrets. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_secrets
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by IaC. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_iac
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by malware. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_malware
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: Is scanned by CICD. Accepts a comma-separated list.
          isArray: true
          name: is_scanned_by_cicd
          predefined:
            - DISABLED
            - ENABLED
            - IRRELEVANT
        - auto: PREDEFINED
          description: The last scan status. Accepts a comma-separated list.
          isArray: true
          name: last_scan_status
          predefined:
            - NOT_SCANNED_YET
            - ERROR
            - COMPLETED
        - auto: PREDEFINED
          description: The asset type. Accepts a comma-separated list.
          isArray: true
          name: asset_type
          predefined:
            - CICD PIPELINE
            - CONTAINER IMAGE REPOSITORY
            - REPOSITORY
        - auto: PREDEFINED
          description: The asset provider. Accepts a comma-separated list.
          isArray: true
          name: asset_provider
          predefined:
            - AWS
            - AWS_CODE_BUILD
            - AWS_CODE_COMMIT
            - AZURE
            - AZURE_PIPELINES
            - AZURE_REPOS
            - BITBUCKET
            - CIRCLE_CI
            - DOCKER
            - GCP
            - GITHUB
            - GITHUB_ACTIONS
            - GITLAB
            - GITLAB_CI
            - HCP_TFC_RUN_TASKS
            - JENKINS
            - JFROG_ARTIFACTORY
            - OCI
        - auto: PREDEFINED
          description: The vendor name. Accepts a comma-separated list.
          isArray: true
          name: vendor_name
          predefined:
            - AWS
            - AWS_CODE_BUILD
            - AWS_CODE_COMMIT
            - AZURE
            - AZURE_REPOS
            - BITBUCKET
            - BITBUCKET_DATACENTER
            - CIRCLE_CI
            - DOCKER
            - GCP
            - GITHUB
            - GITHUB_ACTIONS
            - GITHUB_ENTERPRISE
            - GITLAB
            - GITLAB_SELF_MANAGED
            - HCP_TFC_RUN_TASKS
            - HCP_TFE_RUN_TASKS
            - JENKINS
            - JFROG_ARTIFACTORY
            - OCI
        - name: limit
          description: "The maximum number of assets to return."
          defaultValue: "100"
        - name: sort_field
          description: The field by which to sort the results.
          predefined:
            - asset_id
            - asset_name
            - business_application_names
            - status_coverage
            - is_scanned_by_vulnerabilities
            - is_scanned_by_code_weakness
            - is_scanned_by_secrets
            - is_scanned_by_iac
            - is_scanned_by_malware
            - is_scanned_by_cicd
            - last_scan_status
            - asset_type
            - asset_provider
            - vendor_name
        - auto: PREDEFINED
          description: The order in which to sort the results.
          name: sort_order
          predefined:
            - DESC
            - ASC
      name: core-get-asset-coverage
      description: "Retrieves a list of assets (e.g., Repositories, CI/CD Pipelines, Container Image Repositories) along with their scan coverage status."
      outputs:
        - contextPath: Core.Coverage.Asset.asset_id
          description: The unique ID of the asset. Each asset is assigned a unique identifier in the system.
          type: String
        - contextPath: Core.Coverage.Asset.asset_name
          description: The name of the asset. Typically corresponds to the repository, container image, or pipeline name.
          type: String
        - contextPath: Core.Coverage.Asset.asset_provider
          description:
            "The vendor or source platform of the asset. Indicates where the asset originates from. Possible values: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_REPOS, BITBUCKET, BITBUCKET_DATACENTER, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITHUB_ENTERPRISE, GITLAB, GITLAB_SELF_MANAGED, HCP_TFC_RUN_TASKS, HCP_TFE_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI."
          type: String
        - contextPath: Core.Coverage.Asset.asset_type
          description:
            "The type or category of the asset. Determines the nature of the resource being scanned. Possible values: CICD PIPELINE, CONTAINER IMAGE REPOSITORY, REPOSITORY."
          type: String
        - contextPath: Core.Coverage.Asset.business_application_names
          description: A list of business applications associated with the asset. These applications help map the asset to business context or ownership.
          type: Array
        - contextPath: Core.Coverage.Asset.is_scanned_by_cicd
          description:
            "Indicates whether the asset is scanned within CI/CD pipelines. Possible values: ENABLED, DISABLED, IRRELEVANT."
          type: String
        - contextPath: Core.Coverage.Asset.is_scanned_by_code_weakness
          description:
            "Indicates whether code weakness scanning is performed on the asset. Possible values: ENABLED, DISABLED, IRRELEVANT."
          type: String
        - contextPath: Core.Coverage.Asset.is_scanned_by_iac
          description:
            "Indicates whether infrastructure-as-code (IaC) scanning is enabled for the asset. Possible values: ENABLED, DISABLED, IRRELEVANT."
          type: String
        - contextPath: Core.Coverage.Asset.is_scanned_by_malware
          description:
            "Indicates whether malware scanning is enabled for the asset. Possible values: ENABLED, DISABLED, IRRELEVANT."
          type: String
        - contextPath: Core.Coverage.Asset.is_scanned_by_secrets
          description:
            "Indicates whether the asset is scanned for hardcoded secrets or credentials. Possible values: ENABLED, DISABLED, IRRELEVANT."
          type: String
        - contextPath: Core.Coverage.Asset.is_scanned_by_semgrep
          description:
            "Boolean flag indicating whether the asset is analyzed using Semgrep for code issues or misconfigurations. Possible values: true, false."
          type: Boolean
        - contextPath: Core.Coverage.Asset.is_scanned_by_sonarqube
          description:
            "Boolean flag indicating whether the asset is analyzed using SonarQube for code quality and security issues. Possible values: true, false."
          type: Boolean
        - contextPath: Core.Coverage.Asset.is_scanned_by_veracode
          description:
            "Boolean flag indicating whether the asset is scanned using Veracode for security vulnerabilities. Possible values: true, false."
          type: Boolean
        - contextPath: Core.Coverage.Asset.is_scanned_by_vulnerabilities
          description:
            "Indicates whether vulnerability scanning is enabled for the asset. Possible values: ENABLED, DISABLED, IRRELEVANT."
          type: String
        - contextPath: Core.Coverage.Asset.last_scan_status
          description:
            "The status of the most recent scan performed on the asset. Possible values: NOT_SCANNED_YET, ERROR, COMPLETED."
          type: String
        - contextPath: Core.Coverage.Asset.scanners_data
          description: An array containing detailed information from the scanners that evaluated the asset, including scan results, timestamps, and metadata.
          type: Array
        - contextPath: Core.Coverage.Asset.status_coverage
          description:
            "The overall scan coverage of the asset. Possible values: FULLY SCANNED, PARTIALLY SCANNED, NOT SCANNED."
          type: String
        - contextPath: Core.Coverage.Asset.unified_provider
          description:
            "The unified provider name associated with the asset. Standardized across different vendor integrations. Possible values: AWS, AWS_CODE_BUILD, AWS_CODE_COMMIT, AZURE, AZURE_PIPELINES, AZURE_REPOS, BITBUCKET, CIRCLE_CI, DOCKER, GCP, GITHUB, GITHUB_ACTIONS, GITLAB, GITLAB_CI, HCP_TFC_RUN_TASKS, JENKINS, JFROG_ARTIFACTORY, OCI."
          type: String
    - arguments:
        - description: The unique ID of the issue. Accepts a comma-separated list.
          name: issue_id
          isArray: true
        - auto: PREDEFINED
          description: The severity of the issue. Accepts a comma-separated list.
          isArray: true
          name: severity
          predefined:
            - low
            - medium
            - high
            - critical
        - description: "A custom filter. When using this argument, other filter arguments are not relevant. example: \n`{\n                \"OR\": [\n                    {\n                        \"SEARCH_FIELD\": \"actor_process_command_line\",\n                        \"SEARCH_TYPE\": \"EQ\",\n                        \"SEARCH_VALUE\": \"path_to_file\"\n                    }\n                ]\n            }`."
          name: custom_filter
        - auto: PREDEFINED
          description: Account type. Accepts a comma-separated list.
          isArray: true
          name: Identity_type
          predefined:
            - ANONYMOUS
            - APPLICATION
            - COMPUTE
            - FEDERATED_IDENTITY
            - SERVICE
            - SERVICE_ACCOUNT
            - TEMPORARY_CREDENTIALS
            - TOKEN
            - UNKNOWN
            - USER
        - description: A unique identifier per agent. Accepts a comma-separated list.
          isArray: true
          name: agent_id
        - description: The hostname to connect to. In case of a proxy connection, this value will differ from action_remote_ip. Accepts a comma-separated list.
          isArray: true
          name: action_external_hostname
        - description: A string identifying the user rule. Accepts a comma-separated list.
          isArray: true
          name: rule_id
        - description: The name of the user rule. Accepts a comma-separated list.
          isArray: true
          name: rule_name
        - description: The issue name. Accepts a comma-separated list.
          isArray: true
          name: issue_name
        - description: The issue source. Accepts a comma-separated list.
          isArray: true
          name: issue_source
          auto: PREDEFINED
          predefined:
            - XDR Agent
            - XDR Analytics
            - XDR Analytics BIOC
            - PAN NGFW
            - XDR BIOC
            - XDR IOC
            - Threat Intelligence
            - XDR Managed Threat Hunting
            - Correlation
            - Prisma Cloud
            - Prisma Cloud Compute
            - ASM
            - IoT Security
            - Custom Alert
            - Health
            - SaaS Attachments
            - Attack Path
            - Cloud Network Analyzer
            - IaC Scanner
            - CAS Secret Scanner
            - CI/CD Risks
            - CLI Scanner
            - CIEM Scanner
            - API Traffic Monitor
            - API Posture Scanner
            - Agentless Disk Scanner
            - Kubernetes Scanner
            - Compute Policy
            - CSPM Scanner
            - CAS CVE Scanner
            - CAS License Scanner
            - Secrets Scanner
            - SAST Scanner
            - Data Policy
            - Attack Surface Test
            - Package Operational Risk
            - Vulnerability Policy
            - AI Security Posture
        - auto: PREDEFINED
          description: This argument is deprecated. Use *start_time* instead. Supports relative or custom time options. If you choose custom, use the start_time and end_time arguments.
          name: time_frame
          predefined:
            - 60 minutes
            - 3 hours
            - 12 hours
            - 24 hours
            - 2 days
            - 7 days
            - 14 days
            - 30 days
            - custom
          deprecated: true
        - description: The name assigned to the user_id during agent runtime. Accepts a comma-separated list.
          isArray: true
          name: user_name
        - description: The file name of the binary file. Accepts a comma-separated list.
          isArray: true
          name: actor_process_image_name
        - description: SHA256 Causality Graph Object command line. Accepts a comma-separated list.
          isArray: true
          name: causality_actor_process_image_command_line
        - description: Command line used by the process image initiated by the causality actor.
          isArray: true
          name: actor_process_image_command_line
        - description: SHA256 The command line of the process created. Accepts a comma-separated list.
          isArray: true
          name: action_process_image_command_line
        - description: SHA256 hash of the binary file. Accepts a comma-separated list.
          isArray: true
          name: actor_process_image_sha256
        - description: SHA256 hash of the binary file. Accepts a comma-separated list.
          isArray: true
          name: causality_actor_process_image_sha256
        - description: SHA256 of the binary file. Accepts a comma-separated list.
          isArray: true
          name: action_process_image_sha256
        - description: SHA256 of the file related to the event. Accepts a comma-separated list.
          isArray: true
          name: action_file_image_sha256
        - description: The name of the registry. Accepts a comma-separated list.
          isArray: true
          name: action_registry_name
        - description: The key data of the registry. Accepts a comma-separated list.
          isArray: true
          name: action_registry_key_data
        - description: The host IP address. Accepts a comma-separated list.
          isArray: true
          name: host_ip
        - description: The local IP address for the connection. Accepts a comma-separated list.
          isArray: true
          name: action_local_ip
        - description: Remote IP address for the connection. Accepts a comma-separated list.
          isArray: true
          name: action_remote_ip
        - auto: PREDEFINED
          description: Issue action status.
          name: issue_action_status
          predefined:
            - detected
            - detected (allowed the session)
            - detected (download)
            - detected (forward)
            - detected (post detected)
            - detected (prompt allow)
            - detected (raised an alert)
            - detected (reported)
            - detected (on write)
            - detected (scanned)
            - detected (sinkhole)
            - detected (syncookie sent)
            - detected (wildfire upload failure)
            - detected (wildfire upload success)
            - detected (wildfire upload skip)
            - detected (xdr managed threat hunting)
            - prevented (block)
            - prevented (blocked)
            - prevented (block-override)
            - prevented (blocked the url)
            - prevented (blocked the ip)
            - prevented (continue)
            - prevented (denied the session)
            - prevented (dropped all packets)
            - prevented (dropped the session)
            - prevented (dropped the session and sent a tcp reset)
            - prevented (dropped the packet)
            - prevented (override)
            - prevented (override-lockout)
            - prevented (post detected)
            - prevented (prompt block)
            - prevented (random-drop)
            - prevented (silently dropped the session with an icmp unreachable message to the host or application)
            - prevented (terminated the session and sent a tcp reset to both sides of the connection)
            - prevented (terminated the session and sent a tcp reset to the client)
            - prevented (terminated the session and sent a tcp reset to the server)
            - prevented (on write)
        - description: The local port for the connection. Accepts a comma-separated list.
          isArray: true
          name: action_local_port
        - description: The remote port for the connection. Accepts a comma-separated list.
          isArray: true
          name: action_remote_port
        - description: The hostname to connect to. In case of a proxy connection, this value will differ from action_remote_ip. Accepts a comma-separated list.
          isArray: true
          name: dst_action_external_hostname
        - defaultValue: source_insert_ts
          description: The field by which to sort the results.
          name: sort_field
        - auto: PREDEFINED
          description: The order in which to sort the results.
          name: sort_order
          predefined:
            - DESC
            - ASC
        - description: This argument is deprecated. Use *page* instead. The first page number to retrieve issues from.
          name: offset
          deprecated: true
        - description: This argument is deprecated. Use *page_size* instead. The last page number to retrieve issues from.
          name: limit
          deprecated: true
        - defaultValue: "0"
          description: The page number for the issues to return for pagination. 
          name: page
        - defaultValue: "50"
          description: The number of issues to return per page.
          name: page_size
        - description: Supports epoch timestamp, simplified extended ISO format (YYYY-MM-DDThh:mm:ss).
          name: start_time
        - description: Supports epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss).
          name: end_time
        - auto: PREDEFINED
          description: Whether the issue is starred.
          name: starred
          predefined:
            - "true"
            - "false"
        - description: The MITRE attack technique. Accepts a comma-separated list.
          isArray: true
          name: mitre_technique_id_and_name
        - description: The category of the issue. Accepts a comma-separated list.
          isArray: true
          name: issue_category
        - auto: PREDEFINED
          description: The domain of the issue. Accepts a comma-separated list.
          isArray: true
          name: issue_domain
          predefined:
            - Health
            - Hunting
            - IT
            - Posture
            - Security
        - description: The description of the issue. Accepts a comma-separated list.
          isArray: true
          name: issue_description
        - description: The SHA256 hash of the OS actor process image. Accepts a comma-separated list.
          isArray: true
          name: os_actor_process_image_sha256
        - description: The SHA256 hash of the action file macro. Accepts a comma-separated list.
          isArray: true
          name: action_file_macro_sha256
        - description: The status progress. Accepts a comma-separated list.
          isArray: true
          name: status
          predefined:
            - New
            - In Progress
            - Resolved
          auto: PREDEFINED
        - description: Not status progress. Accepts a comma-separated list.
          isArray: true
          name: not_status
          predefined:
            - New
            - In Progress
            - Resolved
          auto: PREDEFINED
        - description: The assets IDs related to the issue. Accepts a comma-separated list.
          isArray: true
          name: asset_ids
        - description: |
            The assignee of the issue. Accepts a comma-separated list of either assignee emails or names, not both.
            Use "unassigned" for unassigned issues or "assigned" for all assigned issues.
          isArray: true
          name: assignee
        - description: A comma separated list of outputs to include in the context.
          isArray: true
          name: output_keys
      name: core-get-issues
      description: "Returns a list of issues and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
      outputs:
        - contextPath: Core.Issue.internal_id
          description: The unique ID of the issue.
          type: String
        - contextPath: Core.Issue.Identity_type
          description: The identity type of the account.
          type: String
        - contextPath: Core.Issue.source_insert_ts
          description: The detection timestamp.
          type: Number
        - contextPath: Core.Issue.issue_name
          description: The name of the issue.
          type: String
        - contextPath: Core.Issue.issue_category
          description: The category of the issue.
          type: String
        - contextPath: Core.Issue.issue_description
          description: The issue description.
          type: String
        - contextPath: Core.Issue.agent_id
          description: The agent (endpoint) ID associated with the issue.
          type: List
        - contextPath: Core.Issue.asset_ids
          description: The asset IDs related to the issue.
          type: List
        - contextPath: Core.Issue.severity
          description: The severity of the issue.
          type: String
        - contextPath: Core.Issue.issue_domain
          description: The domain of the issue.
          type: String
        - contextPath: Core.Issue.case_ids
          description: The case IDs associated with the issue.
          type: List
        - contextPath: Core.Issue.issue_source
          description: The source of the issue.
          type: String
        - contextPath: Core.Issue.starred
          description: Whether the issue is starred.
          type: Boolean
        - contextPath: Core.Issue.status.progress
          description: The progress status of the issue.
          type: String
        - contextPath: Core.Issue.assigned_to_pretty
          description: The pretty name of the user assigned to the issue.
          type: String
        - contextPath: Core.Issue.assigned_to
          description: The user assigned to the issue.
          type: String
        - contextPath: Core.Issue.agent_ip_addresses
          description: The host IP address.
          type: String
        - contextPath: Core.Issue.agent_hostname
          description: The hostname.
          type: String
        - contextPath: Core.Issue.mitre_tactic_id_and_name
          description: The MITRE attack tactic.
          type: String
        - contextPath: Core.Issue.mitre_technique_id_and_name
          description: The MITRE attack technique.
          type: String
        - contextPath: Core.Issue.issue_action_status 
          description: The issue action status.
          type: String
        - contextPath: Core.Issue.issue_action_status_readable
          description: The issue action status in readable format.
          type: String
        - contextPath: Core.Issue.action_file_macro_sha256
          description: File Macro SHA256 hash of the action file macro.
          type: String
        - contextPath: Core.Issue.action_process_image_sha256
          description: Action process image SHA256 hash.
          type: String
        - contextPath: Core.Issue.causality_actor_process_image_sha256
          description: Causality actor process image SHA256 hash.
          type: String
        - contextPath: Core.Issue.os_actor_process_image_sha256
          description: OS Parent SHA256 hash of the OS actor process image.
          type: String
        - contextPath: Core.Issue.actor_process_image_sha256
          description: Actor process image SHA256 hash.
          type: String
        - contextPath: Core.IssueMetadata.returned_count
          description: The actual number of issues that match all filter criteria and returned in this specific response.
          type: Number
        - contextPath: Core.IssueMetadata.filtered_count
          description: The total number of issues in the system that match all filter criteria.
          type: Number
    - arguments:
        - description: Asset unique identifier.
          name: asset_id
          required: true
      name: core-get-asset-details
      description: Get asset information.
      outputs:
        - contextPath: Core.CoreAsset
          description: Asset additional information.
        - contextPath: Core.CoreAsset.xdm__asset__provider
          description: The cloud provider or source responsible for the asset.
        - contextPath: Core.CoreAsset.xdm__asset__realm
          description: The realm or logical grouping of the asset.
        - contextPath: Core.CoreAsset.xdm__asset__last_observed
          description: The timestamp when the asset was last observed, in ISO 8601 format.
        - contextPath: Core.CoreAsset.xdm__asset__type__id
          description: The unique identifier for the asset type.
        - contextPath: Core.CoreAsset.xdm__asset__first_observed
          description: The timestamp when the asset was first observed, in ISO 8601 format.
        - contextPath: Core.CoreAsset.asset_hierarchy
          description: The hierarchy or structure representing the asset.
        - contextPath: Core.CoreAsset.xdm__asset__type__category
          description: The asset category type.
        - contextPath: Core.CoreAsset.xdm__asset__cloud__region
          description: The cloud region where the asset resides.
        - contextPath: Core.CoreAsset.xdm__asset__module_unstructured_fields
          description: The unstructured fields or metadata associated with the asset module.
        - contextPath: Core.CoreAsset.xdm__asset__source
          description: The originating source of the asset's information.
        - contextPath: Core.CoreAsset.xdm__asset__id
          description: The source unique identifier for the asset.
        - contextPath: Core.CoreAsset.xdm__asset__type__class
          description: The classification or type class of the asset.
        - contextPath: Core.CoreAsset.xdm__asset__type__name
          description: The specific name of the asset type.
        - contextPath: Core.CoreAsset.xdm__asset__strong_id
          description: The strong or immutable identifier for the asset.
        - contextPath: Core.CoreAsset.xdm__asset__name
          description: The name of the asset.
        - contextPath: Core.CoreAsset.xdm__asset__raw_fields
          description: The raw fields or unprocessed data related to the asset.
        - contextPath: Core.CoreAsset.xdm__asset__normalized_fields
          description: The normalized fields associated with the asset.
        - contextPath: Core.CoreAsset.all_sources
          description: A list of all sources providing information about the asset.
    - arguments:
      - description: A comma separated list of case IDs.
        isArray: true
        name: case_id
        required: true
      - defaultValue: '1000'
        description: Maximum number of issues to return per case. The maximum is 1000.
        name: issues_limit
      name: core-get-case-extra-data
      description: Get extra data fields of a specific case, including issues and key artifacts.
      outputs:
        - contextPath: Core.CaseExtraData.case.case_id
          description: The unique identifier for the case.
          type: String
        - contextPath: Core.CaseExtraData.case.case_name
          description: The name assigned to the case.
          type: String
        - contextPath: Core.CaseExtraData.case.creation_time
          description: The timestamp (in epoch format) when the case was created.
          type: Number
        - contextPath: Core.CaseExtraData.case.modification_time
          description: The timestamp (in epoch format) when the case was last modified.
          type: Number
        - contextPath: Core.CaseExtraData.case.detection_time
          description: The timestamp when the activity related to the case was first detected.
          type: String
        - contextPath: Core.CaseExtraData.case.status
          description: The current status of the case (e.g., 'new', 'under_investigation', 'closed').
          type: String
        - contextPath: Core.CaseExtraData.case.severity
          description: The severity level of the case (e.g., 'low', 'medium', 'high', 'critical').
          type: String
        - contextPath: Core.CaseExtraData.case.description
          description: A detailed textual description of the case.
          type: String
        - contextPath: Core.CaseExtraData.case.assigned_user_mail
          description: The email address of the user assigned to the case.
          type: String
        - contextPath: Core.CaseExtraData.case.assigned_user_pretty_name
          description: The display name of the user assigned to the case.
          type: String
        - contextPath: Core.CaseExtraData.case.issue_count
          description: The total number of issues associated with the case.
          type: Number
        - contextPath: Core.CaseExtraData.case.low_severity_issue_count
          description: The total number of low-severity issues within the case.
          type: Number
        - contextPath: Core.CaseExtraData.case.med_severity_issue_count
          description: The total number of medium-severity issues within the case.
          type: Number
        - contextPath: Core.CaseExtraData.case.high_severity_issue_count
          description: The total number of high-severity issues within the case.
          type: Number
        - contextPath: Core.CaseExtraData.case.critical_severity_issue_count
          description: The total number of critical-severity issues within the case.
          type: Number
        - contextPath: Core.CaseExtraData.case.user_count
          description: The number of unique users involved in the case.
          type: Number
        - contextPath: Core.CaseExtraData.case.host_count
          description: The number of unique hosts involved in the case.
          type: Number
        - contextPath: Core.CaseExtraData.case.notes
          description: A collection of notes or comments added to the case by analysts.
          type: Array
        - contextPath: Core.CaseExtraData.case.resolve_comment
          description: The comment entered by a user when resolving the case.
          type: String
        - contextPath: Core.CaseExtraData.case.manual_severity
          description: The severity level manually set by a user, which may override the calculated severity for the case.
          type: String
        - contextPath: Core.CaseExtraData.case.manual_description
          description: A description of the case that was manually entered by a user.
          type: String
        - contextPath: Core.CaseExtraData.case.xdr_url
          description: The direct URL to view the case in the Cortex XDR platform.
          type: String
        - contextPath: Core.CaseExtraData.case.starred
          description: A flag indicating whether the case has been starred or marked as a favorite.
          type: Boolean
        - contextPath: Core.CaseExtraData.case.hosts
          description: A comma-separated list of hostnames involved in the case.
          type: Array
        - contextPath: Core.CaseExtraData.case.case_sources
          description: The products or sources that contributed issues to this case (e.g., 'XDR Agent', 'Firewall').
          type: String
        - contextPath: Core.CaseExtraData.case.rule_based_score
          description: The case's risk score as calculated by automated detection rules.
          type: Number
        - contextPath: Core.CaseExtraData.case.manual_score
          description: A risk score manually assigned to the case by a user.
          type: Number
        - contextPath: Core.CaseExtraData.case.wildfire_hits
          description: The number of times a file associated with this case was identified as malicious by WildFire.
          type: Number
        - contextPath: Core.CaseExtraData.case.issues_grouping_status
          description: The current status of the issue grouping or clustering process for this case.
          type: String
        - contextPath: Core.CaseExtraData.case.mitre_techniques_ids_and_names
          description: A list of MITRE ATT&CK technique IDs and names observed in the case.
          type: String
        - contextPath: Core.CaseExtraData.case.mitre_tactics_ids_and_names
          description: A list of MITRE ATT&CK tactic IDs and names observed in the case.
          type: String
        - contextPath: Core.CaseExtraData.case.issue_categories
          description: A comma-separated list of categories for the issues included in the case.
          type: String
        - contextPath: Core.CaseExtraData.issues.total_count
          description: The total number of individual issues that are part of the case.
          type: Number
        - contextPath: Core.CaseExtraData.issues.data.external_id
          description: The unique external identifier for an individual issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.severity
          description: The severity of the individual issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.matching_status
          description: The correlation status for the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.end_match_attempt_ts
          description: The timestamp of the last attempt to match the issue with others.
          type: Date
        - contextPath: Core.CaseExtraData.issues.data.local_insert_ts
          description: The timestamp when the issue was first recorded in the system.
          type: Date
        - contextPath: Core.CaseExtraData.issues.data.bioc_indicator
          description: The specific Behavioral Indicator of Compromise (BIOC) that triggered the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.matching_service_rule_id
          description: The ID of the matching service rule that identified the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.attempt_counter
          description: The number of times a matching attempt has been made for this issue.
          type: Number
        - contextPath: Core.CaseExtraData.issues.data.bioc_category_enum_key
          description: The key representing the category of the Behavioral Indicator of Compromise (BIOC).
          type: String
        - contextPath: Core.CaseExtraData.issues.data.case_id
          description: The ID of the case to which this issue belongs.
          type: Number
        - contextPath: Core.CaseExtraData.issues.data.is_whitelisted
          description: A flag indicating whether this issue has been whitelisted or suppressed.
          type: Boolean
        - contextPath: Core.CaseExtraData.issues.data.starred
          description: A flag indicating whether this individual issue has been starred.
          type: Boolean
        - contextPath: Core.CaseExtraData.issues.data.deduplicate_tokens
          description: Tokens used to identify and deduplicate similar issues.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.filter_rule_id
          description: The ID of any filter rule that was applied to this issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.mitre_technique_id_and_name
          description: The specific MITRE ATT&CK technique ID and name associated with the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.mitre_tactic_id_and_name
          description: The specific MITRE ATT&CK tactic ID and name associated with the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.agent_version
          description: The version of the agent installed on the endpoint related to the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.agent_device_domain
          description: The domain of the endpoint device.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.agent_fqdn
          description: The fully qualified domain name (FQDN) of the agent's host.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.agent_os_type
          description: The operating system type of the endpoint (e.g., 'Windows', 'Linux').
          type: String
        - contextPath: Core.CaseExtraData.issues.data.agent_os_sub_type
          description: The specific version or distribution of the agent's operating system.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.agent_data_collection_status
          description: The status of the agent's data collection process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.mac
          description: The primary MAC address of the endpoint.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.mac_addresses
          description: A list of all MAC addresses associated with the endpoint.
          type: Array
        - contextPath: Core.CaseExtraData.issues.data.agent_is_vdi
          description: A flag indicating whether the agent is installed on a Virtual Desktop Infrastructure (VDI) instance.
          type: Boolean
        - contextPath: Core.CaseExtraData.issues.data.agent_install_type
          description: The installation type of the agent.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.agent_host_boot_time
          description: The last boot time of the host where the agent is installed.
          type: Date
        - contextPath: Core.CaseExtraData.issues.data.event_sub_type
          description: A more specific classification of the event type.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.module_id
          description: The identifier of the agent module that generated the event.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.association_strength
          description: A score indicating the strength of the event's association to the case.
          type: Number
        - contextPath: Core.CaseExtraData.issues.data.dst_association_strength
          description: The association strength related to the destination entity in the event.
          type: Number
        - contextPath: Core.CaseExtraData.issues.data.story_id
          description: An identifier that groups a sequence of related events into a "story".
          type: String
        - contextPath: Core.CaseExtraData.issues.data.event_id
          description: The unique identifier for the event.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.event_type
          description: The primary type of the event (e.g., 'Process Execution', 'Network Connection').
          type: String
        - contextPath: Core.CaseExtraData.issues.data.events_length
          description: The number of raw events that were aggregated to create this issue.
          type: Number
        - contextPath: Core.CaseExtraData.issues.data.event_timestamp
          description: The timestamp when the original event occurred.
          type: Date
        - contextPath: Core.CaseExtraData.issues.data.actor_process_instance_id
          description: The unique instance ID of the primary actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_image_path
          description: The full file path of the actor process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_image_name
          description: The filename of the actor process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_command_line
          description: The command line used to launch the actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_signature_status
          description: The digital signature status of the actor process executable (e.g., 'Signed', 'Unsigned').
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_signature_vendor
          description: The vendor name from the digital signature of the actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_image_sha256
          description: The SHA256 hash of the actor process executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_image_md5
          description: The MD5 hash of the actor process executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_causality_id
          description: The causality ID of the actor process, which links it to its parent process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_causality_id
          description: The causality ID of the primary actor in the event.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_process_os_pid
          description: The operating system's Process ID (PID) of the actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.actor_thread_thread_id
          description: The ID of the specific thread within the actor process that initiated the action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_image_name
          description: The image name of the process that initiated the actor process (the grandparent).
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_command_line
          description: The command line of the causality actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_image_path
          description: The file path of the causality actor process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_signature_vendor
          description: The signature vendor of the causality actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_signature_status
          description: The signature status of the causality actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_causality_id
          description: The causality ID of the causality actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_execution_time
          description: The execution timestamp of the causality actor process.
          type: Date
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_image_md5
          description: The MD5 hash of the causality actor process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.causality_actor_process_image_sha256
          description: The SHA256 hash of the causality actor process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_file_path
          description: The file path of the file that was the target of an action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_file_name
          description: The name of the file that was the target of an action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_file_md5
          description: The MD5 hash of the file that was the target of an action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_file_sha256
          description: The SHA256 hash of the file that was the target of an action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_file_macro_sha256
          description: The SHA256 hash of a macro embedded within the target file.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_registry_data
          description: The data written to or read from a registry value during the action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_registry_key_name
          description: The name of the registry key involved in the action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_registry_value_name
          description: The name of the registry value involved in the action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_registry_full_key
          description: The full path of the registry key involved in the action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_local_ip
          description: The local IP address involved in a network action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_local_port
          description: The local port number involved in a network action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_remote_ip
          description: The remote IP address involved in a network action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_remote_port
          description: The remote port number involved in a network action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_external_hostname
          description: The external hostname or domain associated with the network action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_country
          description: The country associated with the remote IP address in the network action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_process_instance_id
          description: The instance ID of the process that was the target of an action.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_process_causality_id
          description: The causality ID of the target process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_process_image_name
          description: The executable name of the target process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_process_image_sha256
          description: The SHA256 hash of the target process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_process_image_command_line
          description: The command line of the target process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_process_signature_status
          description: The signature status of the target process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_process_signature_vendor
          description: The signature vendor of the target process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_effective_username
          description: The effective username of the OS-level actor responsible for the event.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_instance_id
          description: The instance ID of the OS actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_image_path
          description: The file path of the OS actor process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_image_name
          description: The image name of the OS actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_command_line
          description: The command line of the OS actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_signature_status
          description: The signature status of the OS actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_signature_vendor
          description: The signature vendor of the OS actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_image_sha256
          description: The SHA256 hash of the OS actor process's executable.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_causality_id
          description: The causality ID of the OS actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_causality_id
          description: The causality ID of the OS actor.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_process_os_pid
          description: The operating system PID of the OS actor process.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.os_actor_thread_thread_id
          description: The thread ID of the OS actor.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_app_id
          description: The firewall application ID for the traffic.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_interface_from
          description: The firewall interface from which the traffic originated.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_interface_to
          description: The firewall interface to which the traffic was destined.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_rule
          description: The name of the firewall rule that matched the traffic.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_rule_id
          description: The unique ID of the firewall rule that matched the traffic.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_device_name
          description: The name of the firewall device that logged the event.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_serial_number
          description: The serial number of the firewall device.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_url_domain
          description: The domain visited, as logged by the firewall.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_email_subject
          description: The subject line of an email, as logged by the firewall.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_email_sender
          description: The sender of an email, as logged by the firewall.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_email_recipient
          description: The recipient of an email, as logged by the firewall.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_app_subcategory
          description: The application subcategory as identified by the firewall.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_app_category
          description: The application category as identified by the firewall.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_app_technology
          description: The application technology as identified by the firewall.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_vsys
          description: The virtual system on the firewall that processed the traffic.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_xff
          description: The X-Forwarded-For (XFF) header value from the traffic.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_misc
          description: Miscellaneous firewall log data.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.fw_is_phishing
          description: A flag indicating if the firewall identified the event as phishing.
          type: Boolean
        - contextPath: Core.CaseExtraData.issues.data.dst_agent_id
          description: The agent ID of the destination endpoint in a lateral movement event.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.dst_causality_actor_process_execution_time
          description: The execution time of the causality actor process on the destination endpoint.
          type: Date
        - contextPath: Core.CaseExtraData.issues.data.dns_query_name
          description: The domain name in a DNS query event.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.dst_action_external_hostname
          description: The external hostname of the destination.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.dst_action_country
          description: The country of the destination.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.dst_action_external_port
          description: The external port of the destination.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.issue_id
          description: The unique identifier for the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.detection_timestamp
          description: The timestamp when the issue was first detected.
          type: Number
        - contextPath: Core.CaseExtraData.issues.data.name
          description: The name or title of the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.category
          description: The category of the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.endpoint_id
          description: The unique ID of the endpoint where the issue occurred.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.description
          description: A detailed description of the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.host_ip
          description: The IP address of the host related to the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.host_name
          description: The hostname of the endpoint related to the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.source
          description: The source of the issue (e.g., 'XDR').
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action
          description: The action taken in response to the event (e.g., 'detected', 'prevented').
          type: String
        - contextPath: Core.CaseExtraData.issues.data.action_pretty
          description: A user-friendly representation of the action taken.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.user_name
          description: The name of the user associated with the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.contains_featured_host
          description: A flag indicating if the issue involves a host marked as featured or critical.
          type: Boolean
        - contextPath: Core.CaseExtraData.issues.data.contains_featured_user
          description: A flag indicating if the issue involves a user marked as featured or critical.
          type: Boolean
        - contextPath: Core.CaseExtraData.issues.data.contains_featured_ip_address
          description: A flag indicating if the issue involves an IP address marked as featured or critical.
          type: Boolean
        - contextPath: Core.CaseExtraData.issues.data.tags
          description: Any tags that have been applied to the issue.
          type: String
        - contextPath: Core.CaseExtraData.issues.data.original_tags
          description: The original set of tags applied to the issue before any modifications.
          type: String
        - contextPath: Core.CaseExtraData.network_artifacts.total_count
          description: The total number of network artifacts associated with the case.
          type: Number
        - contextPath: Core.CaseExtraData.network_artifacts.data.type
          description: The type of network artifact (e.g., 'IP Address', 'Domain').
          type: String
        - contextPath: Core.CaseExtraData.network_artifacts.data.issue_count
          description: The number of issues in the case that involve this network artifact.
          type: Number
        - contextPath: Core.CaseExtraData.network_artifacts.data.is_manual
          description: A flag indicating if the network artifact was added manually by a user.
          type: Boolean
        - contextPath: Core.CaseExtraData.network_artifacts.data.network_domain
          description: The domain name of the network artifact.
          type: String
        - contextPath: Core.CaseExtraData.network_artifacts.data.network_remote_ip
          description: The remote IP address of the network artifact.
          type: String
        - contextPath: Core.CaseExtraData.network_artifacts.data.network_remote_port
          description: The remote port number of the network artifact.
          type: String
        - contextPath: Core.CaseExtraData.network_artifacts.data.network_country
          description: The country associated with the network artifact's IP address.
          type: String
        - contextPath: Core.CaseExtraData.file_artifacts.total_count
          description: The total number of file artifacts associated with the case.
          type: Number
        - contextPath: Core.CaseExtraData.file_artifacts.data.issue_count
          description: The number of issues in the case that involve this file artifact.
          type: Number
        - contextPath: Core.CaseExtraData.file_artifacts.data.file_name
          description: The name of the file artifact.
          type: String
        - contextPath: Core.CaseExtraData.file_artifacts.data.File_sha256
          description: The SHA256 hash of the file artifact.
          type: String
        - contextPath: Core.CaseExtraData.file_artifacts.data.file_signature_status
          description: The digital signature status of the file artifact.
          type: String
        - contextPath: Core.CaseExtraData.file_artifacts.data.file_wildfire_verdict
          description: The verdict from WildFire for this file (e.g., 'malicious', 'benign').
          type: String
        - contextPath: Core.CaseExtraData.file_artifacts.data.is_malicous
          description: A flag indicating whether the file artifact is considered malicious.
          type: Boolean
        - contextPath: Core.CaseExtraData.file_artifacts.data.is_manual
          description: A flag indicating if the file artifact was added manually by a user.
          type: Boolean
        - contextPath: Core.CaseExtraData.file_artifacts.data.is_process
          description: A flag indicating if the file artifact is a process executable.
          type: Boolean
        - contextPath: Core.CaseExtraData.file_artifacts.data.low_confidence
          description: A flag indicating if the verdict on the file artifact has low confidence.
          type: Boolean
        - contextPath: Core.CaseExtraData.file_artifacts.data.type
          description: The type of the file artifact.
          type: String
    - arguments:
      - description: Issue ID to update. If empty, updates the current issue ID.
        name: id
        type: string
      - description: Email address of the user to assign the issue to.
        name: assigned_user_mail
        type: string
      - name: severity
        auto: PREDEFINED
        description: Change the severity of an issue.
        type: string
        predefined:
          - low
          - medium
          - high
          - critical
      - name: name
        description: Change the issue name.
        type: string
      - name: occurred
        description: >
          Change the occurred time of an issue. Supports different time formats, for example: 3 days ago, 2017-09-27T10:00:00+03:00.
        type: string
      - name: phase
        description: Change the phase of an issue.
        type: string
        auto: PREDEFINED
        predefined:
          - Triage
          - Investigation
          - Containment
          - Response
      - name: type
        description: Change the type of an issue.
        type: string
      - name: description
        description: Change the description of an issue.
        type: string
      - name: status
        description: Change the status of an issue.
        type: string
        auto: PREDEFINED
        predefined:
        - New
        - In Progress
        - Resolved - Known Issue
        - Resolved - Duplicate Issue
        - Resolved - False Positive
        - Resolved - other
        - Resolved - True Positive
        - Resolved - Security Testing
        - Resolved - Dismissed
        - Resolved - Fixed
        - Resolved - Risk Accepted
      - name: link_cases
        description: Comma-separated list of case IDs to link the issue to.
        type: string
        isArray: true
      - name: unlink_cases
        description: Comma-separated list of case IDs to unlink the issue from.
        type: string
        isArray: true
      name: core-update-issue
      description: Updates the properties of an issue. This command does not provide an explicit indication of success.
    - arguments:
      - name: page_size
        description: The number of assets to return per page. Max is 5000.
        defaultValue: "100"
      - name: page_number
        description: The page number for the assets to return for pagination. Default is 0.
      - name: asset_names
        description: Comma-separated list of asset names to search for. (e.g., "asset_name1,asset_name2").
        isArray: true
      - name: asset_types
        description: Comma-separated list of asset types to search for. (e.g., "asset_type1,asset_type2").
        isArray: true
      - name: asset_tags
        description: |
          A JSON encoded string representing a list of tag:value pairs to search for. (e.g., `[{"tag1": "value1"}, {"tag2": "value2"}]`).
        isArray: true
      - name: asset_ids
        description: Comma-separated list of asset IDs to search for. (e.g., "asset_id1,asset_id2").
        isArray: true
      - name: asset_providers
        description: Comma-separated list of asset providers to search for. (e.g., "provider1,provider2").
        isArray: true
      - name: asset_realms
        description: Comma-separated list of asset realms to search for. (e.g., "realm1,realm2").
        isArray: true
      - name: asset_groups
        description: |
          A JSON encoded string representing a list of asset groups to search for. (e.g., `["group1", "group2"]`).
        isArray: true
      - name: asset_categories
        description: A Comma-separated list of asset categories to search for. (e.g., "category1,category2").
      - name: asset_classes
        description: A comma-separated list of asset classes to search for.
        auto: PREDEFINED
        predefined:
        - AI
        - API
        - Application
        - Code
        - Compute
        - Data
        - Device
        - External Surface
        - Identity
        - Management
        - Network
        - Organization
        - Other
        - Security Services
      - name: software_package_versions
        description: A comma-separated list of software package versions to search for. (e.g., "0.23.0,5.2.0").
      - name: kubernetes_cluster_versions
        description: A comma-separated list of Kubernetes cluster versions to search for. (e.g., "1.22,1.3").
      name: core-search-assets
      description: Retrieves asset from the Cortex platform using optional filter criteria.
      outputs:
      - contextPath: Core.Asset.external_provider_id
        description: The external provider ID of the asset.
      - contextPath: Core.Asset.first_observed
        description: The first time the asset was observed.
      - contextPath: Core.Asset.tags
        description: The tags of the asset.
      - contextPath: Core.Asset.realm
        description: The realm of the asset.
      - contextPath: Core.Asset.type.id
        description: The ID of the asset type.
      - contextPath: Core.Asset.related_issues.critical_issues
        description: Critical issues related to the asset.
      - contextPath: Core.Asset.issues_critical
        description: Critical issues related to the asset.
      - contextPath: Core.Asset.related_cases.critical_cases
        description: Critical cases related to the asset.
      - contextPath: Core.Asset.cases_critical
        description: Critical cases related to the asset.
      - contextPath: Core.Asset.id
        description: The ID of the asset.
      - contextPath: Core.Asset.last_observed
        description: The last time the asset was observed.
      - contextPath: Core.Asset.type.category
        description: The category of the asset type.
      - contextPath: Core.Asset.group_ids
        description: The group IDs of the asset.
      - contextPath: Core.Asset.type.class
        description: The class of the asset type.
      - contextPath: Core.Asset.related_issues.issues_breakdown
        description: The related issues breakdown of the asset.
      - contextPath: Core.Asset.issues_breakdown
        description: The related issues breakdown of the asset.
      - contextPath: Core.Asset.related_cases.cases_breakdown
        description: The related cases breakdown of the asset.
      - contextPath: Core.Asset.cases_breakdown
        description: The related cases breakdown of the asset.
      - contextPath: Core.Asset.type.name
        description: The type of the asset.
      - contextPath: Core.Asset.name
        description: The name of the asset.
      - contextPath: Core.Asset.strong_id
        description: The strong ID of the asset.
      - contextPath: Core.Asset.cloud.region
        description: The cloud region of the asset.

      - contextPath: Core.Asset.provider
        description: The asset provider.
      - contextPath: Core.Asset.kubernetes.cluster.version
        description: The Kubernetes cluster version of the asset.
      - contextPath: Core.Asset.software_package.version
        description: The software package version of the asset.
    - arguments:
        - description: The maximum number of groups to return.
          defaultValue: "50"
          name: limit
        - description: A JSON list of asset group names to search for. (e.g., `["group1", "group2"]`).
          name: name
        - description: A comma-separated list of asset group IDs to search for.
          isArray: true
          name: id
        - auto: PREDEFINED
          description: Filter asset groups by type. When not specified, both types are used.
          name: type
          predefined:
            - STATIC
            - DYNAMIC
        - description: A JSON list of asset group descriptions to search for. (e.g. `["description1", "description2"]`).
          name: description
      name: core-search-asset-groups
      description: Searches for asset groups from the Cortex platform using one or more filter criteria.
      outputs:
        - contextPath: Core.AssetGroups.name
          description: The name of the asset group.
          type: String
        - contextPath: Core.AssetGroups.filter
          description: The filter criteria for the asset group.
          type: String
        - contextPath: Core.AssetGroups.membership_predicate
          description: The predicate used to create the asset group.
          type: String
        - contextPath: Core.AssetGroups.type
          description: The type of the asset group.
          type: String
        - contextPath: Core.AssetGroups.description
          description: The description of the asset group.
          type: String
        - contextPath: Core.AssetGroups.modified_by
          description: The user who modified the asset group.
          type: String
        - contextPath: Core.AssetGroups.created_by
          description: The user who created the asset group.
          type: String
        - contextPath: Core.AssetGroups.created_by_pretty
          description: The formatted name of the user who created the asset group.
          type: String
        - contextPath: Core.AssetGroups.modified_by_pretty
          description: The formatted name of the user who created the asset group.
    - name: core-get-vulnerabilities
      description: "Retrieves vulnerabilities based on specified filters."
      arguments:
        - name: limit
          description: "The maximum number of vulnerabilities to return."
          defaultValue: "50"
        - defaultValue: LAST_OBSERVED
          auto: PREDEFINED
          description: The field by which to sort the results.
          name: sort_field
          predefined:
            - PLATFORM_SEVERITY
            - CVSS_SCORE
            - EPSS_SCORE
            - CORTEX_VULNERABILITY_RISK_SCORE
            - LAST_OBSERVED
        - auto: PREDEFINED
          defaultValue: DESC
          description: The order in which to sort the results.
          name: sort_order
          predefined:
            - DESC
            - ASC
        - name: cve_id
          description: "The CVE ID. Accepts a comma-separated list."
          isArray: true
        - name: issue_id
          description: "The issue ID. Accepts a comma-separated list."
          isArray: true
        - name: cvss_score_gte
          description: "The minimum CVSS score."
        - name: epss_score_gte
          description: "The minimum EPSS score."
        - name: internet_exposed
          description: "Filter by internet exposed assets."
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: exploitable
          description: "Filter by exploitable vulnerabilities."
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: has_kev
          description: "Filter by vulnerabilities that have a Known Exploited Vulnerability (KEV)."
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: affected_software
          description: "Filter by affected software. Accepts a comma-separated list."
          isArray: true
        - name: on_demand_fields
          description: "A comma-separated list of additional fields to retrieve."
          isArray: true
        - description: "The start time for filtering according to case creation time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025."
          name: start_time
        - description: "The end time for filtering according to case creation time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025."
          name: end_time
        - auto: PREDEFINED
          description: The severity of the vulnerability issue.
          isArray: true
          name: severity
          predefined:
            - info
            - low
            - medium
            - high
            - critical
        - name: assignee
          description: |
            The email of the user assigned to the vulnerability. Accepts a comma-separated list. 
            Use 'unassigned' for unassigned vulnerabilities or 'assigned' for all assigned vulnerabilities.
          isArray: true
        - auto: PREDEFINED
          description: The finding sources of the vulnerability. Accepts a comma-separated list.
          isArray: true
          name: finding_sources
          predefined:
            - CORTEX_AGENT
            - CORTEX_AGENTLESS_SCANNER
            - CORTEX_ATTACK_SURFACE_MANAGEMENT
            - CORTEX_ATTACK_SURFACE_TESTING
            - CORTEX_CLI_SCANNER
            - CORTEX_CONTAINER_REGISTRY_SCANNER
            - CORTEX_NETWORK_SCANNER
            - CORTEX_SERVERLESS_FUNCTION_SCANNER
            - QUALYS
            - TENABLE
        - name: cvrs_gte
          description: The minimum risk score assigned to the vulnerability (range 0-100).
        - name: compensating_controls_effective_coverage
          description: The assessed effectiveness and coverage of detected compensating controls.
          isArray: true
          auto: PREDEFINED
          predefined:
            - EFFECTIVE
            - EFFECTIVE_REQUIRES_CONFIGURATION_UPDATE
            - EFFECTIVE_REQUIRES_CONTENT_UPDATE
            - EXPLOIT_CONFIRMED
            - EXPLOIT_UNREACHABLE
            - NOT_INSTALLED
            - NO_CONTROLS_FOUND
            - UNKNOWN_COVERAGE
      outputs:
        - contextPath: Core.VulnerabilityIssue.ISSUE_ID
          description: The unique identifier for the vulnerability issue.
          type: String
        - contextPath: Core.VulnerabilityIssue.CVE_ID
          description: The CVE identifier for the vulnerability.
          type: String
        - contextPath: Core.VulnerabilityIssue.CVE_DESCRIPTION
          description: The description of the CVE.
          type: String
        - contextPath: Core.VulnerabilityIssue.ASSET_NAME
          description: The name of the affected asset.
          type: String
        - contextPath: Core.VulnerabilityIssue.PLATFORM_SEVERITY
          description: The severity of the vulnerability as determined by the platform.
          type: String
        - contextPath: Core.VulnerabilityIssue.EPSS_SCORE
          description: The Exploit Prediction Scoring System (EPSS) score.
          type: Number
        - contextPath: Core.VulnerabilityIssue.CVSS_SCORE
          description: The Common Vulnerability Scoring System (CVSS) score.
          type: Number
        - contextPath: Core.VulnerabilityIssue.ASSIGNED_TO
          description: The email of the user assigned to the vulnerability.
          type: String
        - contextPath: Core.VulnerabilityIssue.ASSIGNED_TO_PRETTY
          description: The full name of the user assigned to the vulnerability.
          type: String
        - contextPath: Core.VulnerabilityIssue.AFFECTED_SOFTWARE
          description: The software affected by the vulnerability.
          type: Unknown
        - contextPath: Core.VulnerabilityIssue.FIX_AVAILABLE
          description: Indicates if a fix is available for the vulnerability.
          type: Boolean
        - contextPath: Core.VulnerabilityIssue.INTERNET_EXPOSED
          description: Indicates if the asset is exposed to the internet.
          type: Boolean
        - contextPath: Core.VulnerabilityIssue.HAS_KEV
          description: Indicates if the vulnerability is a Known Exploited Vulnerability (KEV).
          type: Boolean
        - contextPath: Core.VulnerabilityIssue.EXPLOITABLE
          description: Indicates if the vulnerability is exploitable.
          type: Boolean
        - contextPath: Core.VulnerabilityIssue.ASSET_IDS
          description: The unique identifier for the asset.
          type: String
        - contextPath: Core.VulnerabilityIssue.FINDING_SOURCES
          description: The finding sources that originally generated the security finding of the vulnerability.
          type: String
        - contextPath: Core.VulnerabilityIssue.COMPENSATING_CONTROLS_DETECTED_COVERAGE
          description: The coverage status of detected compensating controls.
          type: String
        - contextPath: Core.VulnerabilityIssue.CORTEX_VULNERABILITY_RISK_SCORE
          description: The risk score assigned to the vulnerability.
          type: Number
        - contextPath: Core.VulnerabilityIssue.FIX_VERSIONS
          description: The package versions that contain a fix for the vulnerability.
          type: Array
        - contextPath: Core.VulnerabilityIssue.ASSET_TYPES
          description: The types of assets affected by the vulnerability.
          type: Array
        - contextPath: Core.VulnerabilityIssue.COMPENSATING_CONTROLS_DETECTED_CONTROLS
          description: The compensating controls that were detected for the vulnerability.
          type: Array
        - contextPath: Core.VulnerabilityIssue.EXPLOIT_LEVEL
          description: The exploitability level or status of the vulnerability.
          type: String
        - contextPath: Core.VulnerabilityIssue.ISSUE_NAME
          description: The name of the vulnerability issue.
          type: String
        - contextPath: Core.VulnerabilityIssue.PACKAGE_IN_USE
          description: Indicates whether the vulnerable package is actively used in the environment.
          type: Boolean
        - contextPath: Core.VulnerabilityIssue.PROVIDERS
          description: The providers or sources of the vulnerability information.
          type: Array
        - contextPath: Core.VulnerabilityIssue.OS_FAMILY
          description: The operating system family of the affected asset.
          type: String
        - contextPath: Core.VulnerabilityIssue.IMAGE
          description: Information related to the affected container or system image.
          type: String
    - arguments:
        - description: Comma-separated list of IDs of the issues to get recommendations for (maximum 10 per request).
          name: issue_ids
          required: true
          isArray: true
      name: core-get-issue-recommendations
      description: Get comprehensive recommendations for an issue, including remediation steps, playbook suggestions, and recommended actions.
      outputs:
        - contextPath: Core.IssueRecommendations.issue_id
          description: The unique identifier for the issue.
          type: String
        - contextPath: Core.IssueRecommendations.issue_name
          description: The name of the issue.
          type: String
        - contextPath: Core.IssueRecommendations.severity
          description: The severity of the issue.
          type: String
        - contextPath: Core.IssueRecommendations.description
          description: Description of the issue.
          type: String
        - contextPath: Core.IssueRecommendations.remediation
          description: Remediation steps and recommendations for the issue.
          type: String
        - contextPath: Core.IssueRecommendations.playbook_suggestions.playbook_id
          description: The ID of the suggested playbook.
          type: String
        - contextPath: Core.IssueRecommendations.playbook_suggestions.suggestion_rule_id
          description: The ID of the suggestion rule that generated this recommendation.
          type: String
        - contextPath: Core.IssueRecommendations.playbook_suggestions.name
          description: The name of the suggested playbook.
          type: String
        - contextPath: Core.IssueRecommendations.playbook_suggestions.comment
          description: An explanation of the suggested playbook.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.name
          description: The name of the suggested quick action.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.suggestion_rule_id
          description: The ID of the suggestion quick action rule that generated this recommendation.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.brand
          description: The brand of the quick action.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.category
          description: The category of the quick action.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.description
          description: An explanation of the quick action.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.pretty_name
          description: The display name of the quick action.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.arguments.name
          description: The argument name.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.arguments.prettyName
          description: The argument display name.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.arguments.prettyPredefined
          description: The argument predefined display value.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.arguments.description
          description: The argument description.
          type: String
        - contextPath: Core.IssueRecommendations.quick_action_suggestions.arguments.required
          description: Whether the argument is required.
          type: String
        - contextPath: Core.IssueRecommendations.existing_code_block
          description: Original vulnerable code.
          type: String
        - contextPath: Core.IssueRecommendations.suggested_code_block
          description: Code block fix suggestion.
          type: String
        - contextPath: Core.IssueRecommendations.network_reachability
          description: The Network reachability information for the issue.
          type: Json
    - arguments:
      - description: A comma-separated list of issue IDs to fix (maximum 10 per request).
        name: issue_ids
        required: true
        isArray: true
      - description: Custom title for the pull request.
        name: title
      name: core-appsec-remediate-issue
      description: Create automated pull requests to fix multiple security issues in a single bulk operation.
      outputs:
      - contextPath: Core.TriggeredPRs.issueId
        description: The issue identifier.
        type: String
      - contextPath: Core.TriggeredPRs.status
        description: Either "triggered" or "automated_fix_not_available".
        type: String
    - arguments:
        - description: List of repository asset IDs to configure scanners for.
          name: repository_ids
          isArray: true
          required: true
        - auto: PREDEFINED
          description: List of scanners to enable.
          name: enable_scanners
          isArray: true
          predefined:
            - SECRETS
            - IAC
            - SCA
        - auto: PREDEFINED
          description: List of scanners to disable.
          name: disable_scanners
          isArray: true
          predefined:
            - SECRETS
            - IAC
            - SCA
        - auto: PREDEFINED
          description: Enable live validation of discovered secrets. This argument only relevant when SECRETS scanner is enabled.
          type: boolean
          name: secret_validation
          predefined:
            - "true"
            - "false"
        - auto: PREDEFINED
          description: Enable scanning on pull requests.
          type: boolean
          name: pr_scanning
          predefined:
            - "true"
            - "false"
        - auto: PREDEFINED
          description: Block deployment on scanner errors.
          name: block_on_error
          type: boolean
          predefined:
            - "true"
            - "false"
        - auto: PREDEFINED
          description: Enable tagging of resource blocks.
          name: tag_resource_blocks
          type: boolean
          predefined:
            - "true"
            - "false"
        - auto: PREDEFINED
          description: Enable tagging of module blocks.
          name: tag_module_blocks
          type: boolean
          predefined:
            - "true"
            - "false"
        - description: List of file paths to exclude from scanning.
          name: exclude_paths
          isArray: true
      name: core-enable-scanners
      description: Enable or disable scanners with the specified configuration.
    - name: core-create-appsec-policy
      description: Creates a new AppSec policy in Cortex Platform with defined conditions, scope, and triggers for application security governance.
      arguments:
        - name: policy_name
          description: A unique name for the AppSec policy. Must be descriptive and follow organizational naming conventions.
          required: true
        - name: description
          description: A detailed explanation of the policy's objective, use case, and expected outcomes.
        - name: asset_group_names
          description: Comma-separated list of Asset Group names to apply the policy to. Asset groups will be automatically resolved to their corresponding IDs.
          isArray: true
        # Condition Filters (Findings Criteria)
        - name: conditions_finding_type
          description: "Filter by specific finding types to target policy enforcement. Supported values: Vulnerabilities, IaC Misconfiguration, Licenses, Operational Risk, Secrets, Code Weaknesses, CI/CD Risks. Also accepts raw API values: CAS_CVE_SCANNER, CAS_IAC_SCANNER, CAS_LICENSE_SCANNER, CAS_OPERATIONAL_RISK_SCANNER, CAS_SECRET_SCANNER, CAS_SAST_SCANNER, CAS_CI_CD_RISK_SCANNER."
          isArray: true
        - name: conditions_severity
          description: "Filter findings by severity level to prioritize policy actions. Supported values: CRITICAL, HIGH, MEDIUM, LOW."
          isArray: true
        - name: conditions_respect_developer_suppression
          description: "Controls whether a developer's manual suppression should be honored. Set to 'true' to respect developer suppression (evaluate only non-suppressed findings). Set to 'false' to ignore suppression and always evaluate the finding."
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: conditions_backlog_status
          description: Filter findings based on their backlog workflow status (NEW or BACKLOG).
          auto: PREDEFINED
          predefined:
            - NEW
            - BACKLOG
        - name: conditions_package_name
          description: Target specific software packages by name for license or vulnerability policies.
        - name: conditions_package_version
          description: Specify software package version constraints for precise policy targeting.
        - name: conditions_package_operational_risk
          description: "Filter packages by their operational risk assessment level. Supported values: HIGH, MEDIUM, LOW."
        - name: conditions_appsec_rule_names
          description: Comma-separated list of AppSec rule names to include in policy evaluation. Rule names will be automatically resolved to their corresponding IDs.
          isArray: true
        - name: conditions_cvss
          description: CVSS base score threshold for vulnerability findings (0.0-10.0). Only vulnerabilities meeting or exceeding this score will trigger the policy.
        - name: conditions_epss
          description: Exploit Prediction Scoring System score threshold (0-100). Targets vulnerabilities with higher exploitation probability.
        - name: conditions_has_a_fix
          description: Filter findings based on whether a remediation fix or patch is available.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: conditions_is_kev
          description: Target findings listed in CISA's Known Exploited Vulnerabilities (KEV) catalog for prioritized remediation.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: conditions_secret_validity
          description: "Filter exposed secrets by their validity status. Supported values: VALID (active secrets), PRIVILEGED (high-access secrets), INVALID (expired/revoked), UNAVAILABLE (status unknown)."
          isArray: true
        - name: conditions_license_type
          description: Target specific software license types for compliance and legal risk management.
          isArray: true
        # Scope Filters (Asset Criteria)
        - name: scope_category
          description: "Define asset categories to include in policy scope. Supported values: Application, Repository, CI/CD Instance, CI/CD Pipeline, VCS Collaborator, VCS Organization."
          isArray: true
        - name: scope_business_application_names
          description: Target specific business applications by name for focused policy enforcement.
          isArray: true
        - name: scope_application_business_criticality
          description: "Filter applications by business criticality level. Supported values: CRITICAL, HIGH, MEDIUM, LOW."
          isArray: true
        - name: scope_repository_name
          description: Target specific code repositories by name for repository-focused policies.
          isArray: true
        - name: scope_is_public_repository
          description: Filter repositories based on their visibility (public vs private) for exposure risk management.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: scope_has_deployed_assets
          description: Target repositories or applications that have associated deployed infrastructure or runtime assets.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: scope_has_internet_exposed_deployed_assets
          description: Filter assets based on whether the deployed components are exposed to internet traffic for external attack surface management.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: scope_has_sensitive_data_access
          description: Target deployed assets that have access to sensitive data stores, databases, or classified information.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: scope_has_privileged_capabilities
          description: Filter deployed assets with elevated privileges, admin access, or high-impact system capabilities.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        # Trigger Settings (Policy Execution Events)
        - name: triggers_periodic_report_issue
          description: Enables detection during scheduled scans. When a violation is found in a periodic scan, an issue will be created ("Detect").
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: triggers_periodic_override_severity
          description: Override the default severity level for issues created by periodic scan detections.
          auto: PREDEFINED
          predefined:
            - Critical
            - High
            - Medium
            - Low
        - name: triggers_pr_report_issue
          description: Enables detection during pull request scans. When a violation is found in a PR, an issue is created. Required for PR-based detection.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: triggers_pr_block_pr
          description: Blocks merging of pull requests that contain violations detected by the policy.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: triggers_pr_report_pr_comment
          description: Adds an automated comment to pull requests summarizing detected violations and guidance.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: triggers_pr_override_severity
          description: Override the default severity level for issues created by pull request detections.
          auto: PREDEFINED
          predefined:
            - Critical
            - High
            - Medium
            - Low
        - name: triggers_cicd_report_issue
          description: Enables detection during CI/CD pipeline scans. When a violation is found in a pipeline run, an issue is created.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: triggers_cicd_block_cicd
          description: Blocks or fails CI/CD pipeline runs when violations occur.
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: triggers_cicd_report_cicd
          description: Reports violation details back to the CI/CD system (pipeline logs, dashboards, status checks).
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: triggers_cicd_override_severity
          description: Override the default severity level for issues created by CI/CD pipeline detections.
          auto: PREDEFINED
          predefined:
            - Critical
            - High
            - Medium
            - Low
        - name: suggestion_id
          description: The ID of a policy suggestion to associate with this policy. When provided, links the created policy to the AI-generated suggestion it was based on.
    - arguments:
        - name: case_id_list
          description: A comma-separated list of case IDs to filter by.
          isArray: true
        - auto: PREDEFINED
          description: Sorts returned cases by the date/time that the case was created ("asc" - ascending, "desc" - descending).
          name: sort_by_creation_time
          predefined:
            - ASC
            - DESC
        - auto: PREDEFINED
          description: Sorts returned cases by the date/time that the case was modified ("asc" - ascending, "desc" - descending).
          name: sort_by_modification_time
          predefined:
            - ASC
            - DESC
        - defaultValue: '0'
          description: Page number (for pagination). The default is 0 (the first page).
          name: page
        - defaultValue: '100'
          description: Maximum number of cases to return per page. The default and maximum value is 100.
          name: limit
        - auto: PREDEFINED
          description: A comma-separated list of domains to filter cases by.
          isArray: true
          name: case_domain
          predefined:
            - 'DOMAIN_SECURITY'
            - 'DOMAIN_POSTURE'
            - 'DOMAIN_IT'
            - 'DOMAIN_HEALTH'
            - 'DOMAIN_HUNTING'
        - auto: PREDEFINED
          description: |
            A comma-separated list of case statuses to filter cases by.
          isArray: true
          name: status
          predefined:
            - 'new'
            - 'in_progress'
            - 'resolved'
        - description: A comma-separated list of statuses to exclude.
          isArray: true
          name: not_status
          predefined:
            - 'new'
            - 'in_progress'
            - 'resolved'
          auto: PREDEFINED
        - auto: PREDEFINED
          description: |
            A comma-separated list of severity levels to filter cases by.
          isArray: true
          name: severity
          predefined:
            - 'low'
            - 'medium'
            - 'high'
            - 'critical'
        - description: A comma-separated list of Asset IDs associated with the case by which to filter the cases.
          isArray: true
          name: asset_ids
        - description: A comma-separated list of Asset Group IDs, where the case is filtered by the assets contained within those groups.
          isArray: true
          name: asset_groups
        - description: A comma-separated list of hosts to filter cases by.
          isArray: true
          name: hosts
        - description: |-
            A comma-separated list of assignee names or emails to filter cases by. Note: all values must be either names or emails - mixing both in the same request is not supported. Use the special values: "assigned" - to get all cases with assignees, "unassigned" - to get cases with no assignees.
          name: assignee
          isArray: true
        - auto: PREDEFINED
          description: Filter cases by whether they are starred or not.
          name: starred
          isArray: true
          predefined:
            - 'true'
            - 'false'
        - description: A comma-separated list of names to filter cases by.
          name: case_name
        - description: A comma-separated list of descriptions to filter cases by.
          name: case_description
        - description: A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or before the specified datetime will be retrieved.
          name: lte_creation_time
        - description: A datetime with the format 2019-12-31T23:59:00. Only cases that were created on or after the specified datetime will be retrieved.
          name: gte_creation_time
        - description: Filters for returned cases that were created on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on.
          name: since_creation_time
        - description: Filters for returned cases that were created on or before the specified datetime with the format 2019-12-31T23:59:00.
          name: lte_modification_time
        - description: Filters for returned cases that were modified on or after the specified datetime with the format 2019-12-31T23:59:00.
          name: gte_modification_time
        - description: Filters for returned cases that were modified on or after the specified date range, for example, 1 month, 2 days, 1 hour, and so on.
          name: since_modification_time
        - auto: PREDEFINED
          description: Whether to include enriched case data in the response (detection_time, notes, xdr_url, manual_description, starred_manually). Only supported for up to 10 cases. When more than 10 cases are returned, the command automatically falls back to standard case data.
          name: get_enriched_case_data
          defaultValue: 'false'
          predefined:
            - 'true'
            - 'false'
        - description: A comma-separated list of tags to filter cases by.
          name: tag
      name: core-get-cases
      description: Get case information based on the specified filters.
      outputs:
        - contextPath: Core.Case.case_id
          description: Unique ID assigned to each returned case.
          type: String
        - contextPath: Core.Case.case_name
          description: Name of the case.
          type: String
        - contextPath: Core.Case.creation_time
          description: Timestamp when the case was created.
          type: Number
        - contextPath: Core.Case.modification_time
          description: Timestamp when the case was last modified.
          type: Number
        - contextPath: Core.Case.status
          description: Current status of the case.
          type: String
        - contextPath: Core.Case.severity
          description: Severity level of the case.
          type: String
        - contextPath: Core.Case.description
          description: Description of the case.
          type: String
        - contextPath: Core.Case.assigned_user_mail
          description: Email address of the assigned user. May be null.
          type: String
        - contextPath: Core.Case.assigned_user_pretty_name
          description: Full name of the assigned user. May be null.
          type: String
        - contextPath: Core.Case.issue_count
          description: Total number of issues in the case.
          type: Number
        - contextPath: Core.Case.low_severity_issue_count
          description: Number of issues with low severity.
          type: Number
        - contextPath: Core.Case.med_severity_issue_count
          description: Number of issues with medium severity.
          type: Number
        - contextPath: Core.Case.high_severity_issue_count
          description: Number of issues with high severity.
          type: Number
        - contextPath: Core.Case.critical_severity_issue_count
          description: Number of issues with critical severity.
          type: Number
        - contextPath: Core.Case.user_count
          description: Number of users involved in the case.
          type: Number
        - contextPath: Core.Case.host_count
          description: Number of hosts involved in the case.
          type: Number
        - contextPath: Core.Case.resolve_comment
          description: Comments added when resolving the case. May be null.
          type: String
        - contextPath: Core.Case.resolve_reason
          description: The reason for resolving the case (e.g. known_issue, duplicate, false_positive, other, true_positive, security_testing). May be null.
          type: String
        - contextPath: Core.Case.resolved_timestamp
          description: Timestamp when the case was resolved.
          type: Number
        - contextPath: Core.Case.manual_severity
          description: Severity manually assigned by the user. May be null.
          type: Number
        - contextPath: Core.Case.starred
          description: Indicates whether the case is starred.
          type: Boolean
        - contextPath: Core.Case.hosts
          description: List of hosts involved in the case.
          type: Array
        - contextPath: Core.Case.users
          description: List of users involved in the case.
          type: Array
        - contextPath: Core.Case.case_sources
          description: Sources of the case.
          type: Array
        - contextPath: Core.Case.manual_score
          description: Manually assigned score. May be null.
          type: Number
        - contextPath: Core.Case.rule_based_score
          description: Score based on rules.
          type: Number
        - contextPath: Core.Case.wildfire_hits
          description: Number of WildFire hits.
          type: Number
        - contextPath: Core.Case.issues_grouping_status
          description: Status of issue grouping.
          type: String
        - contextPath: Core.Case.mitre_tactics_ids_and_names
          description: List of MITRE ATT&CK tactic IDs and names associated with the case.
          type: Array
        - contextPath: Core.Case.mitre_techniques_ids_and_names
          description: List of MITRE ATT&CK technique IDs and names associated with the case.
          type: Array
        - contextPath: Core.Case.issue_categories
          description: Categories of issues associated with the case.
          type: Array
        - contextPath: Core.Case.original_tags
          description: Original tags assigned to the case.
          type: Array
        - contextPath: Core.Case.tags
          description: Current tags assigned to the case.
          type: Array
        - contextPath: Core.Case.case_domain
          description: Domain associated with the case.
          type: String
        - contextPath: Core.Case.custom_fields
          description: Custom fields for the case with standardized lowercase, whitespace-free names.
          type: Unknown
        - contextPath: Core.Case.CaseExtraData.issue_ids
          description: List of issue IDs associated with the case.
          type: Array
        - contextPath: Core.Case.CaseExtraData.file_artifacts
          description: File artifacts associated with the case.
          type: Array
        - contextPath: Core.Case.CaseExtraData.network_artifacts
          description: Network artifacts associated with the case.
          type: Array
        - contextPath: Core.Case.CaseExtraData.starred_manually
          description: True if the case was starred manually; false if starred by rules.
          type: Boolean
        - contextPath: Core.Case.CaseExtraData.xdr_url
          description: URL to view the case in Cortex XDR.
          type: String
        - contextPath: Core.Case.CaseExtraData.manual_description
          description: Description manually provided by the user.
          type: String
        - contextPath: Core.Case.CaseExtraData.notes
          description: The notes related to the case.
          type: String
        - contextPath: Core.Case.CaseExtraData.detection_time
          description: The timestamp when the first issue was detected in the case.
          type: Date
        - contextPath: Core.CasesMetadata.returned_count
          description: The actual number of cases that match all filter criteria and returned in this specific response.
          type: Number
        - contextPath: Core.CasesMetadata.filtered_count
          description: The total number of cases in the system that match all filter criteria.
          type: Number
    - name: core-get-appsec-issues
      description: "Retrieves application security issues based on specified filters."
      arguments:
        - name: issue_category
          description: "Filter by specific issue categories. Accepts a comma-separated list. Supported values: vulnerabilities, secrets, iac, weaknesses, operational_risk, licenses, cicd. If not specified, all applicable issue categories are queried based on the provided filters."
          isArray: true
        - name: limit
          description: "The maximum number of issues to return."
          defaultValue: "50"
        - name: sort_field
          description: The field by which to sort the results.
          defaultValue: severity
        - name: sort_order
          description: The order in which to sort the results.
          auto: PREDEFINED
          predefined:
            - DESC
            - ASC
          defaultValue: DESC
        - name: start_time
          description: "The start time for filtering according to issue insert time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025."
        - name: end_time
          description: "The end time for filtering according to issue insert time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025."
        - name: issue_id
          description: "The issue ID. Accepts a comma-separated list."
          isArray: true
        - name: assignee
          description: |
            The email of the user assigned to the issue. Accepts a comma-separated list. 
            Use 'unassigned' for all unassigned issues or 'assigned' for all assigned issues.
          isArray: true
        - name: collaborator
          description: The collaborators of the issue. Accepts a comma-separated list.
          isArray: true
        - name: status
          isArray: true
          description: The issue status. Accepts a comma-separated list.
          predefined:
            - New
            - In Progress
            - Resolved
          auto: PREDEFINED
        - name: issue_name
          isArray: true
          description: The issue name. Accepts a comma-separated list.
        - name: asset_name
          isArray: true
          description: The name of the affected asset for the issue. Accepts a comma-separated list.
        - name: repository
          isArray: true
          description: The repository of the issue. Accepts a comma-separated list.
        - name: file_path
          isArray: true
          description: The path of the relevant file for the issue. Accepts a comma-separated list.
        - name: backlog_status
          isArray: true
          description: The backlog status of the issue. Accepts a comma-separated list.
          predefined:
            - BACKLOG
            - NEW
          auto: PREDEFINED
        - name: cvss_score_gte
          description: "The minimum CVSS score."
        - name: epss_score_gte
          description: "The minimum EPSS score."
        - name: has_kev
          description: "Filter by vulnerabilities that have a Known Exploited Vulnerability (KEV)."
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: severity
          description: The severity of the issue. Accepts a comma-separated list.
          isArray: true
          auto: PREDEFINED
          predefined:
            - info
            - low
            - medium
            - high
            - critical
        - name: urgency
          description: The urgency of the issue. Accepts a comma-separated list.
          isArray: true
          auto: PREDEFINED
          predefined:
            - N/A
            - NOT_URGENT
            - URGENT
            - TOP_URGENT
        - name: automated_fix_available
          description: Is there an available automated fix.
          isArray: true
          auto: PREDEFINED
          predefined:
            - "true"
            - "false"
        - name: sla
          description: SLA status of the issue. Accepts a comma-separated list.
          isArray: true
          auto: PREDEFINED
          predefined:
            - Approaching
            - On Track
            - Overdue
        - name: validation
          description: Validation status of the issue. Accepts a comma-separated list.
          isArray: true
          auto: PREDEFINED
          predefined:
            - INVALID
            - NO_VALIDATION
            - PRIVILEGED
            - UNAVAILABLE
            - VALID
      outputs:
        - contextPath: Core.AppsecIssue.internal_id
          description: The unique identifier for the issue.
          type: String
        - contextPath: Core.AppsecIssue.asset_name
          description: The names of the assets related to the issue.
          type: String
        - contextPath: Core.AppsecIssue.severity
          description: The severity of the issue.
          type: String
        - contextPath: Core.AppsecIssue.epss_score
          description: The Exploit Prediction Scoring System (EPSS) score.
          type: Number
        - contextPath: Core.AppsecIssue.cvss_score
          description: The Common Vulnerability Scoring System (CVSS) score.
          type: Number
        - contextPath: Core.AppsecIssue.assignee
          description: The full name of the user assigned to the issue.
          type: String
        - contextPath: Core.AppsecIssue.is_fixable
          description: Whether a fix is available for the issue.
          type: Boolean
        - contextPath: Core.AppsecIssue.issue_name
          description: The name of the issue.
          type: String
        - contextPath: Core.AppsecIssue.issue_source
          description: The source of the issue.
          type: String
        - contextPath: Core.AppsecIssue.issue_category
          description: The category of the issue.
          type: String
        - contextPath: Core.AppsecIssue.issue_domain
          description: The domain of the issue.
          type: String
        - contextPath: Core.AppsecIssue.issue_description
          description: The description of the issue.
          type: String
        - contextPath: Core.AppsecIssue.status
          description: The status of the issue.
          type: String
        - contextPath: Core.AppsecIssue.time_added
          description: The timestamp when the issue was inserted.
          type: Number
        - contextPath: Core.AppsecIssue.urgency
          description: The urgency of the issue.
          type: String
        - contextPath: Core.AppsecIssue.sla_status
          description: The SLA status of the issue.
          type: String
        - contextPath: Core.AppsecIssue.secret_validation
          description: The secret validation status of the issue.
          type: String
        - contextPath: Core.AppsecIssue.repository_name
          description: The name of the repository where the issue was found.
          type: String
        - contextPath: Core.AppsecIssue.package_version
          description: The version of the vulnerable package.
          type: String
        - contextPath: Core.AppsecIssue.fix_version
          description: The version that fixes the vulnerability.
          type: String
        - contextPath: Core.AppsecIssue.repository_organization
          description: The organization of the repository where the issue was found.
          type: String
        - contextPath: Core.AppsecIssue.file_path
          description: The file path related to the issue.
          type: String
        - contextPath: Core.AppsecIssue.collaborator
          description: The collaborator associated with the issue.
          type: String
        - contextPath: Core.AppsecIssue.has_kev
          description: Whether the issue is part of the Known Exploited Vulnerabilities catalog (KEV).
          type: Boolean
        - contextPath: Core.AppsecIssue.backlog_status
          description: The backlog status of the issue.
          type: String
        - contextPath: Core.AppsecIssue.repository_is_public
          description: Whether the repository associated with the issue is public.
          type: Boolean
    - name: core-get-endpoint-support-file
      description: "Retrieves endpoint support files based on specified endpoint IDs."
      hidden: true
      arguments:
        - name: endpoint_ids
          description: "List of endpoint IDs to retrieve support files for."
          required: true
          isArray: true
      outputs:
        - contextPath: Core.EndpointSupportFile.group_action_id
          description: "The unique group action identifier for the support file."
          type: String
      supportedModules:
      - cloud_runtime_security
      - xsiam
      - edr
    - name: core-send-endpoint-heartbeat
      description: Sends endpoint heartbeat.
      hidden: true
      arguments:
        - name: endpoint_id
          description: The ID of the endpoint.
          required: true
      outputs: []
    - name: core-update-case
      description: Updates the properties of a case.
      arguments:
        - name: case_id
          description: A comma-separated list of case IDs to update.
          required: true
          isArray: true
          type: String
        - name: case_name
          description: The new name for the case.
          type: String
        - name: description
          description: The new description for the case.
          type: String
        - name: assignee
          description: The email address of the new assignee. Use "unassigned" to remove an existing assignee.
          type: String
        - auto: PREDEFINED
          name: status
          description: The new status for the case.
          type: String
          predefined:
            - "new"
            - "in_progress"
            - "resolved"
        - name: notes
          description: Additional notes for the case.
          type: String
        - auto: PREDEFINED
          name: starred
          description: Whether the case should be starred.
          type: Boolean
          predefined:
            - "true"
            - "false"
        - auto: PREDEFINED
          name: user_defined_severity
          description: The user-defined severity for the case.
          type: String
          predefined:
            - "low"
            - "medium"
            - "high"
            - "critical"
        - auto: PREDEFINED
          name: resolve_reason
          description: The reason for resolving the case. Only relevant when status is set to resolved.
          type: String
          predefined:
            - "known_issue"
            - "duplicate"
            - "false_positive"
            - "true_positive"
            - "security_testing"
            - "other"
        - name: resolved_comment
          description: Comment when resolving the case. Only relevant when status is set to resolved.
          type: String
        - auto: PREDEFINED
          name: resolve_all_alerts
          description: Whether to resolve all alerts associated with the case. Only relevant when status is set to resolved.
          type: Boolean
          predefined:
            - "true"
            - "false"
        - name: custom_fields
          description: |
            A JSON encoded string representing custom field name-value pairs to update.
            Preferred format: a JSON object where each key is a field name and each value is the field value (e.g., `{"field1": "value1", "multiselect_field": ["a", "b"]}`).
            Legacy format also supported: a list of single-key objects (e.g., `[{"field1": "value1"}, {"field2": "value2"}]`).
            For multiSelect fields, the value must be a JSON array (e.g., `["option1", "option2"]`).
          type: String
      outputs:
        - contextPath: Core.Case.modifiedBy
          description: User who last modified the case.
          type: String
        - contextPath: Core.Case.notes
          description: Notes associated with the case.
          type: String
        - contextPath: Core.Case.userSeverity
          description: User-defined severity for the case.
          type: String
        - contextPath: Core.Case.name.isUser
          description: Whether the case name is user-defined.
          type: Boolean
        - contextPath: Core.Case.name.value
          description: The name of the case.
          type: String
        - contextPath: Core.Case.creationTime
          description: The creation time of the case in milliseconds.
          type: Number
        - contextPath: Core.Case.lastUpdateTime
          description: The last update time of the case in milliseconds.
          type: Number
        - contextPath: Core.Case.topCounters.HOSTS
          description: Number of hosts in the case.
          type: Number
        - contextPath: Core.Case.topCounters.MAL_ARTIFACTS
          description: Number of malicious artifacts in the case.
          type: Number
        - contextPath: Core.Case.topCounters.USERS
          description: Number of users in the case.
          type: Number
        - contextPath: Core.Case.assigned.mail
          description: Email address of the assigned user.
          type: String
        - contextPath: Core.Case.assigned.pretty
          description: Display name of the assigned user.
          type: String
        - contextPath: Core.Case.internalStatus
          description: Internal status of the case.
          type: String
        - contextPath: Core.Case.status.resolveComment
          description: Comment when resolving the case.
          type: String
        - contextPath: Core.Case.status.resolve_reason
          description: Reason for resolving the case.
          type: String
        - contextPath: Core.Case.status.value
          description: Status value of the case.
          type: String
        - contextPath: Core.Case.severityCounters.SEV_020_LOW
          description: Number of low severity alerts in the case.
          type: Number
        - contextPath: Core.Case.severityCounters.SEV_030_MEDIUM
          description: Number of medium severity alerts in the case.
          type: Number
        - contextPath: Core.Case.severityCounters.SEV_040_HIGH
          description: Number of high severity alerts in the case.
          type: Number
        - contextPath: Core.Case.severityCounters.SEV_050_CRITICAL
          description: Number of critical severity alerts in the case.
          type: Number
        - contextPath: Core.Case.caseDomain
          description: Domain of the case.
          type: String
        - contextPath: Core.Case.groupingStatus.pretty
          description: Pretty display of grouping status.
          type: String
        - contextPath: Core.Case.groupingStatus.raw
          description: Raw grouping status value.
          type: String
        - contextPath: Core.Case.groupingStatus.reason
          description: Reason for the grouping status.
          type: String
        - contextPath: Core.Case.tags.tag_id
          description: Tag ID associated with the case.
          type: String
        - contextPath: Core.Case.tags.tag_name
          description: Tag name associated with the case.
          type: String
    - name: core-run-playbook
      description: Runs a playbook on specific issue IDs.
      hidden: true
      arguments:
        - name: playbook
          description: The name or ID of the playbook to run.
          required: true
        - name: playbook_id
          description: Deprecated. Use the 'playbook' argument instead. The ID of the playbook to run.
          deprecated: true
        - name: issue_ids
          description: The IDs of the issues to process with the playbook.
          required: true
          isArray: true
      outputs:
        - contextPath: Core.RunPlaybook.playbook
          description: The playbook name or ID that was provided as input.
          type: String
        - contextPath: Core.RunPlaybook.result
          description: The result of the playbook execution, containing either a success message or an error message describing what went wrong.
          type: String
    - name: core-list-scripts
      hidden: true
      supportedModules:
        - cloud_runtime_security
        - edr
        - xsiam
      description:  Gets a list of scripts available in the scripts library.
      arguments:
      - description: A comma-separated list of the script names.
        isArray: true
        name: script_name
      - auto: PREDEFINED
        description: Filters scripts based on the platform they are designed to run on.
        name: supported_platforms
        predefined:
        - 'windows'
        - 'linux'
        - 'macos'
      - name: page_size
        description: The number of scripts to return per page. The default is 100.
        defaultValue: 100
      - name: page_number
        description: Page number (for pagination). The default is 0 (the first page).
        defaultValue: 0
      outputs:
        - contextPath: Core.Scripts.name
          description: Name of the script.
          type: String
        - contextPath: Core.Scripts.description
          description: Description of the script.
          type: String
        - contextPath: Core.Scripts.windows_supported
          description: Whether the script supports Windows platform.
          type: Boolean
        - contextPath: Core.Scripts.linux_supported
          description: Whether the script supports Linux platform.
          type: Boolean
        - contextPath: Core.Scripts.macos_supported
          description: Whether the script supports macOS platform.
          type: Boolean
        - contextPath: Core.Scripts.script_uid
          description: The Globally Unique Identifier of the script, used to identify the script when executing.
          type: String
        - contextPath: Core.Scripts.script_id
          description: ID of the script.
          type: String
        - contextPath: Core.Scripts.script_inputs
          description: Input parameters for the script.
          type: JSON
        - contextPath: Core.ScriptsMetadata.returned_count
          description: |-
            The actual number of script results returned in this specific execution.
        - contextPath: Core.ScriptsMetadata.filtered_count
          description: |-
            The total number of script results in the system that match the specified filter criteria.
    - name: core-run-script-agentix
      description: Run a script on endpoints.
      hidden: true
      polling: true
      supportedModules:
        - cloud_runtime_security
        - edr
        - xsiam
      arguments:
        - name: script_uid
          description: The Globally Unique Identifier of the script. Either this field or script_name must be provided.
        - name: script_name
          description: The name of the script to run. Either this field or script_uid must be provided.
        - name: endpoint_ids
          description: A comma-separated list of endpoint IDs. Either this field or endpoint_names must be provided.
          isArray: true
        - name: endpoint_names
          description: A comma-separated list of endpoint names. Either this field or endpoint_ids must be provided.
          isArray: true
        - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}.
          name: parameters
      outputs:
      - contextPath: CoreApiModule.ScriptResult.action_id
        description: ID of the action initiated.
        type: Number
    - arguments:
      - description: A comma-separated list of endpoint names.
        name: endpoint_name
        isArray: true
      - description: A comma-separated list of endpoint types.
        name: endpoint_type
        isArray: true
        auto: PREDEFINED
        predefined:
        - mobile
        - server
        - workstation
        - containerized
        - serverless
      - description: A comma-separated list of endpoint connection statuses.
        name: endpoint_status
        isArray: true
        auto: PREDEFINED
        predefined:
        - connected
        - lost
        - disconnected
        - uninstalled
        - vdi pending login
        - forensics offline
      - description: A comma-separated list of endpoint platforms.
        name: platform
        isArray: true
        auto: PREDEFINED
        predefined:
        - windows
        - mac
        - linux
        - android
        - ios
        - serverless
      - description: A comma-separated list of operating system names (e.g., Windows 10, Ubuntu 24.04).
        name: operating_system
        isArray: true
      - description: A comma-separated list of agent versions (e.g., 8.9.0.14028).
        name: agent_version
        isArray: true
      - description: Indicates whether the endpoint is running an End-of-Life (EOL) agent version.
        name: agent_eol
        auto: PREDEFINED
        predefined:
        - 'true'
        - 'false'
      - description: A comma-separated list of OS versions (e.g., 10.0.22621).
        name: os_version
        isArray: true
      - description: A comma-separated list of endpoint IP addresses.
        name: ip_address
        isArray: true
      - description: A comma-separated list of domains.
        name: domain
        isArray: true
      - description: A comma-separated list of assigned prevention policies.
        name: assigned_prevention_policy
        isArray: true
        auto: PREDEFINED
        predefined:
        - pcastro
        - Caas Default
        - kris
        - democloud
        - Linux Default
        - Android Default
        - Serverless Function Default
        - macOS Default
        - iOS Default
        - Windows Default
        - bcpolicy
      - description: A comma-separated list of endpoint tags.
        name: tags
        isArray: true
      - description: A comma-separated list of endpoint IDs.
        name: endpoint_id
        isArray: true
      - description: A comma-separated list of endpoint operational protection statuses.
        name: operational_status
        isArray: true
        auto: PREDEFINED
        predefined:
        - protected
        - partially protected
        - unprotected
      - description: A comma-separated list of cloud providers.
        name: cloud_provider
        isArray: true
        auto: PREDEFINED
        predefined:
        - aws
        - azure
        - gcp
        - alibaba
        - oracle
        - on_prem
      - description: A comma-separated list of cloud regions.
        name: cloud_region
        isArray: true
      - defaultValue: '0'
        description: Page number for pagination. Default is 0.
        name: page
      - defaultValue: '100'
        description: The number of endpoints to return per page. Default and maximum is 100.
        name: page_size
      name: core-list-endpoints
      description: Retrieves endpoints based on the provided filters.
      hidden: true
      supportedModules:
        - cloud
        - cloud_runtime_security
        - cloud_posture
        - xsiam
        - edr
      outputs:
      - contextPath: Core.Endpoint.endpoint_name
        description: The endpoint name.
        type: String
      - contextPath: Core.Endpoint.endpoint_type
        description: The endpoint type.
        type: String
      - contextPath: Core.Endpoint.endpoint_status
        description: The endpoint status.
        type: String
      - contextPath: Core.Endpoint.platform
        description: The endpoint platform.
        type: String
      - contextPath: Core.Endpoint.operating_system
        description: The operating system of the endpoint.
        type: String
      - contextPath: Core.Endpoint.agent_version
        description: The agent version installed on the endpoint.
        type: String
      - contextPath: Core.Endpoint.agent_eol
        description: Is agent EOL.
        type: String
      - contextPath: Core.Endpoint.os_version
        description: The operating system version.
        type: String
      - contextPath: Core.Endpoint.ip_address
        description: The endpoint IP address.
        type: String
      - contextPath: Core.Endpoint.domain
        description: The domain of the endpoint.
        type: String
      - contextPath: Core.Endpoint.assigned_prevention_policy
        description: The assigned prevention policy.
        type: String
      - contextPath: Core.Endpoint.group_name
        description: A list of group names the endpoint belongs to.
        type: List
      - contextPath: Core.Endpoint.tags
        description: A list of tags assigned to the endpoint.
        type: List
      - contextPath: Core.Endpoint.endpoint_id
        description: The unique endpoint ID.
        type: String
      - contextPath: Core.Endpoint.operational_status
        description: The operational status of the endpoint.
        type: String
      - contextPath: Core.Endpoint.cloud_provider
        description: The cloud provider associated with the endpoint.
        type: String
      - contextPath: Core.Endpoint.cloud_region
        description: The cloud region of the endpoint.
        type: String
    - arguments:
      - name: profile_name
        description: The name of the assessment profile to create.
        required: true
      - name: profile_description
        description: The description of the assessment profile to create.
      - name: standard_name
        description: The name of the compliance standard to associate with the profile.
        required: true
      - name: asset_group_name
        description: The name of the asset group to apply the assessment profile to.
        required: true
      - auto: PREDEFINED
        name: day
        description: The day of the week to schedule the assessment. If left empty, assessment runs daily.
        predefined:
          - "Sunday"
          - "Monday"
          - "Tuesday"
          - "Wednesday"
          - "Thursday"
          - "Friday"
          - "Saturday"
      - name: time
        description: The time of day to run the assessment in HH:MM format.
        defaultValue: "12:00"
      name: core-add-assessment-profile
      description: Create new assessment profile.
      hidden: true
      supportedModules:
        - cloud_runtime_security
        - cloud_posture
      outputs:
      - contextPath: Core.AssessmentProfile.assessment_profile_id
        description: The unique identifier of the newly created assessment profile.
        type: String
    - arguments:
      - name: name
        description: The name of the standard.
      - auto: PREDEFINED
        name: created_by
        description: The user or entity who created the compliance.
        predefined:
        - System
        - Custom
      - name: page_size
        description: The number of standards to return per page. Default is 100.
      - name: page_number
        description: The page number for the standards to return for pagination. Default is 0.
      - auto: PREDEFINED
        name: labels
        description: A comma-separated list of labels to filter compliance standards.
        predefined:
          - "Aws"
          - "Azure"
          - "GCP"
          - "GKE"
          - "K8S"
          - "Windows"
          - "Linux"
          - "EKS"
          - "AKS"
          - "OCI"
          - "Alibaba Cloud"
          - "On Prem"
          - "LLM"
          - "Docker"
          - "Openshift"
      name: core-list-compliance-standards
      description: Create new assessment profile.
      hidden: true
      supportedModules:
        - cloud_runtime_security
        - cloud_posture
      outputs:
      - contextPath: Core.ComplianceStandards.id
        description: The unique identifier of the standard.
        type: String
      - contextPath: Core.ComplianceStandards.name
        description: The name of the standard.
        type: String
      - contextPath: Core.ComplianceStandards.description
        description: The description of the standard.
        type: String
      - contextPath: Core.ComplianceStandards.labels
        description: The labels associated with the compliance standard.
        type: Array
      - contextPath: Core.ComplianceStandards.controls_count
        description: The number of controls in the standard.
        type: Number
      - contextPath: Core.ComplianceStandards.assessments_profiles_count
        description: The number of assessment profiles associated with the standard.
        type: Number
      - contextPath: Core.ComplianceStandardsMetadata.returned_count
        description: The actual number of compliance standards that match all filter criteria and returned in this specific response.
        type: Number
      - contextPath: Core.ComplianceStandardsMetadata.filtered_count
        description: The total number of compliance standards in the system that match all filter criteria.
        type: Number
    - arguments:
      - description: A comma-separated list of endpoint IDs.
        name: endpoint_ids
        required: true
        isArray: true
      name: core-get-endpoint-update-version
      description: Retrieves endpoint update versions for the provided endpoint IDs.
      supportedModules:
        - cloud_runtime_security
        - edr
        - xsiam
      outputs:
      - contextPath: Core.EndpointUpdateVersion.total_count
        description: Total number of endpoints.
        type: String
      - contextPath: Core.EndpointUpdateVersion.platform_count
        description: Number of endpoints per platform.
        type: String
      - contextPath: Core.EndpointUpdateVersion.distributions.platform
        description: The platform of the endpoint update.
        type: String
      - contextPath: Core.EndpointUpdateVersion.distributions.version
        description: The version of the endpoint update.
        type: String
      - contextPath: Core.EndpointUpdateVersion.distributions.endpoints_with_higher_version_count
        description: The number of endpoints running a version later than the specified update.
        type: String
      - contextPath: Core.EndpointUpdateVersion.distributions.endpoints_with_same_version_count
        description: The number of endpoints running the same version as the specified update.
        type: String
      - contextPath: Core.EndpointUpdateVersion.distributions.endpoints_with_lower_version_count
        description: The number of endpoints running a version earlier than the specified update.
        type: String
    - arguments:
      - description: A comma-separated list of endpoint IDs.
        name: endpoint_ids
        required: true
        isArray: true
      - description: The platform of the endpoints.
        name: platform
        required: true
        auto: PREDEFINED
        predefined:
        - windows
        - macos
        - linux
      - description: The target version for updating the endpoints.
        name: version
        required: true
      - description: The start time for the update. Enter the time in a 24-hour format (HH:MM). Ensure that there are at least two hours between the start time and the end time.
        name: start_time
      - description: The end time for the update. Enter the time in a 24-hour format (HH:MM).
        name: end_time
      - description: A comma-separated list of days of the week the update may run.
        name: days
        isArray: true
        auto: PREDEFINED
        predefined:
        - Sunday
        - Monday
        - Tuesday
        - Wednesday
        - Thursday
        - Friday
        - Saturday
      name: core-update-endpoint-version
      supportedModules:
        - cloud_runtime_security
        - edr
        - xsiam
      description: Updates the version of the given endpoint to the target version supplied.
      outputs:
      - contextPath: Core.EndpointUpdate.endpoint_ids
        description: The IDs of the endpoints on which the update run.
        type: String
      - contextPath: Core.EndpointUpdate.action_id
        description: The ID of the update action. 0 means that the action failed.
        type: String
    - arguments:
        - description: The unique ID of the exception rule. Accepts a comma-separated list.
          name: id
          isArray: true
        - description: The name of the exception rule. Accepts a comma-separated list.
          name: rule_name
          isArray: true
        - description: The platform the rule applies to. Accepts a comma-separated list.
          isArray: true
          name: platform
          auto: PREDEFINED
          predefined:
            - AGENT_OS_WINDOWS
            - AGENT_OS_MAC
            - AGENT_OS_LINUX
            - AGENT_OS_ANDROID
            - AGENT_OS_IOS
            - AGENT_OS_CAAS_LINUX
            - AGENT_OS_SERVERLESS
        - description: The conditions defined in the rule. Accepts a comma-separated list.
          isArray: true
          name: conditions
        - description: The user who created the rule. Accepts a comma-separated list.
          isArray: true
          name: created_by
        - description: The email of the user associated with the rule. Accepts a comma-separated list.
          isArray: true
          name: user_email
        - description: "The start time for filtering according to rule modification time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025."
          name: start_modification_time
        - description: "The end time for filtering according to rule modification time. Supports free-text relative and absolute times. For example: 7 days ago, 2023-06-15T10:30:00Z, 13/8/2025."
          name: end_modification_time
        - description: The status of the exception rule.
          name: status
          auto: PREDEFINED
          predefined:
            - ENABLED
            - DISABLED
        - auto: PREDEFINED
          description: The type of the disable prevention rule. Accepts a comma-separated list.
          isArray: true
          name: rule_type
          predefined:
            - XDR
            - WAAS
        - description: The type of the exception rule. If not specified, both are returned.
          name: type
          auto: PREDEFINED
          predefined:
            - legacy_agent_exceptions
            - disable_prevention_rules
        - auto: PREDEFINED
          defaultValue: MODIFICATION_TIME
          description: The field by which to sort the results.
          name: sort_field
          predefined:
            - MODIFICATION_TIME
        - auto: PREDEFINED
          defaultValue: DESC
          description: The order in which to sort the results.
          name: sort_order
          predefined:
            - DESC
            - ASC
        - defaultValue: "100"
          description: Number of exception rules to return. Ignored if 'retrieve_all' is set to true.
          name: page_size
        - defaultValue: "0"
          description: Page number to return. Ignored if 'retrieve_all' is set to true.
          name: page
        - auto: PREDEFINED
          defaultValue: "false"
          description: Return all exception rules.
          name: retrieve_all
          predefined:
            - "true"
            - "false"
      name: core-list-exception-rules
      hidden: true
      description: "Returns a list of exception rules and their metadata, which you can filter by built-in arguments. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
      outputs:
        - contextPath: Core.ExceptionRules.ID
          description: The unique identifier for the exception rule.
          type: String
        - contextPath: Core.ExceptionRules.NAME
          description: The user-defined name of the exception rule.
          type: String
        - contextPath: Core.ExceptionRules.DESCRIPTION
          description: The detailed description of the exception rule.
          type: String
        - contextPath: Core.ExceptionRules.TYPE
          description: The general type of the rule (e.g., DISABLE_PREVENTION).
          type: String
        - contextPath: Core.ExceptionRules.RULE_TYPE
          description: The specific rule category (e.g., XDR).
          type: String
        - contextPath: Core.ExceptionRules.STATUS
          description: The current status of the rule (e.g., DISABLED).
          type: String
        - contextPath: Core.ExceptionRules.PLATFORM
          description: The operating system platform the rule targets (e.g., AGENT_OS_MAC).
          type: String
        - contextPath: Core.ExceptionRules.SCOPE
          description: The scope of the rule (e.g., GLOBAL).
          type: String
        - contextPath: Core.ExceptionRules.EFFECT
          description: The effect of the rule.
          type: String
        - contextPath: Core.ExceptionRules.USER_EMAIL
          description: The email address of the user associated with the rule.
          type: String
        - contextPath: Core.ExceptionRules.CREATED_BY
          description: The display name of the user who created the rule.
          type: String
        - contextPath: Core.ExceptionRules.CREATION_TIME
          description: The creation time of the rule (ISO 8601 string).
          type: String
        - contextPath: Core.ExceptionRules.CREATION_TIMESTAMP
          description: The creation time of the rule in milliseconds.
          type: Number
        - contextPath: Core.ExceptionRules.MODIFICATION_TIME
          description: The last modification time of the rule (ISO 8601 string).
          type: String
        - contextPath: Core.ExceptionRules.MODIFICATION_TIMESTAMP
          description: The last modification time of the rule in milliseconds.
          type: Number
        - contextPath: Core.ExceptionRules.GENERATING_ALERT_ID
          description: The ID of the alert that generated this rule.
          type: String
        - contextPath: Core.ExceptionRules.TRIGGER_ALERTS
          description: The alerts triggered by this rule.
          type: String
        - contextPath: Core.ExceptionRules.IS_IN_USER_SCOPE
          description: Boolean indicating if the rule is within the current user's scope.
          type: Boolean
        - contextPath: Core.ExceptionRules.PROFILE_TYPE
          description: The type of profile the rule belongs to.
          type: String
        - contextPath: Core.ExceptionRules.CONDITIONS
          description: The rule conditions (e.g., "Signer = ...").
          type: String
        - contextPath: Core.ExceptionRules.PROFILE_IDS
          description: A specific profile name the rule is associated with.
          type: String
        - contextPath: Core.ExceptionRules.MODULES
          description: A specific security component/module the rule applies to.
          type: String
        - contextPath: Core.ExceptionRules.ASSOCIATED_TARGETS
          description: A specific target (e.g., endpoint, group) the rule is applied to.
          type: String
        - contextPath: Core.ExceptionRulesMetadata.returned_count
          description: The actual number of exception rules that match all filter criteria and returned in this specific response.
          type: String
        - contextPath: Core.ExceptionRulesMetadata.filtered_count
          description: The total number of exception rules in the system that match all filter criteria.
    - arguments:
        - description: The email of the user. Accepts a comma-separated list.
          isArray: true
          name: email
      name: core-list-system-users
      description: "Returns a list users and their core properties within the system. Results are limited to 50."
      hidden: true
      outputs:
        - contextPath: Core.User.user_email
          description: The user's email address.
          type: String
        - contextPath: Core.User.user_first_name
          description: The user's first name.
          type: String
        - contextPath: Core.User.user_last_name
          description: The user's last name.
          type: String
        - contextPath: Core.User.role_name
          description: The specific role assigned to the user within this instance (e.g., Instance Administrator).
          type: String
        - contextPath: Core.User.user_type
          description: The identity provider or source of the user account (e.g., CSP / SSO).
          type: String
        - contextPath: Core.User.last_logged_in
          description: The last time the user successfully logged in, represented as a Unix epoch timestamp in milliseconds.
          type: Number
        - contextPath: Core.User.scope
          description: The user's defined access scope or permissions structure within the instance.
          type: String
        - contextPath: Core.User.groups
          description: A specific name of a group the user belongs to within this instance.
          type: String
    - name: core-xql-generic-query-platform
      arguments:
      - description: XQL query string. By default up to 1000 results are returned. To retrieve more results, enter a custom limit in the query.
        name: query
        required: true
      - description: 'Time in relative date or range format (for example: "1 day", "3 weeks ago", "between 2021-01-01 12:34:56 +02:00 and 2021-02-01 12:34:56 +02:00"). The default is the last 24 hours.'
        name: timeframe
        defaultValue: "24 hours"
      - description: Whether to poll and return the query results instead of only returning a link to the query in the query center.
        name: wait_for_results
        auto: PREDEFINED
        predefined:
        - "true"
        - "false"
        defaultValue: "true"
      - description: Polling timeout in seconds when waiting for results. Default - 180 seconds.
        name: timeout_in_seconds
        defaultValue: 180
      description: |-
        Execute an XQL query and retrieve a link to the query in the query center.
        If set to wait for results, the command will be executed every 10 seconds until results are retrieved or until the timeout is reached.
      hidden: true
      outputs:
      - contextPath: GenericXQLQuery.execution_id
        description: An integer representing the unique ID of the XQL query execution.
        type: String
      - contextPath: GenericXQLQuery.status
        description: String representing the status of the Query; SUCCESS, FAIL, or PENDING.
        type: String
      - contextPath: GenericXQLQuery.error_details
        description: Error information in case of a failed query.
        type: String
      - contextPath: GenericXQLQuery.query_url
        description: URL to view the complete query results in the Query Center.
        type: String
      - contextPath: GenericXQLQuery.number_of_results
        description: Integer representing the number of results returned.
        type: Number
      - contextPath: GenericXQLQuery.results
        description: The output obtained from the query.
        type: List
      - contextPath: GenericXQLQuery.query_limit_modified
        description: Contains a message if the query's LIMIT clauses were automatically reduced to the maximum supported limit.
        type: String
    - arguments:
        - description: A comma separated list of case ids to retrieve resolution statuses for.
          isArray: false
          name: case_id
          required: true
      name: core-get-case-resolution-statuses
      description:  Retrieves resolution status information for a specific case.
      hidden: true
      outputs:
        - contextPath: Core.CaseResolutionStatus.category
          description: The category of the item (done, inProgress, pending, recommended).
          type: String
        - contextPath: Core.CaseResolutionStatus.itemType
          description: The type of item - "playbook" or "playbookTask".
          type: String
        - contextPath: Core.CaseResolutionStatus.id
          description: The unique identifier of the playbook or task.
          type: String
        - contextPath: Core.CaseResolutionStatus.name
          description: The name of the playbook or task.
          type: String
        - contextPath: Core.CaseResolutionStatus.description
          description: The description of the playbook or task.
          type: String
        - contextPath: Core.CaseResolutionStatus.status
          description: The execution/completion status.
          type: String
        - contextPath: Core.CaseResolutionStatus.type
          description: The type of the task (for playbookTask items).
          type: String
        - contextPath: Core.CaseResolutionStatus.issueIDs
          description: Array of issue IDs associated with the playbook or task.
          type: String
        - contextPath: Core.CaseResolutionStatus.playbookVersion
          description: The version number of the playbook.
          type: Number
        - contextPath: Core.CaseResolutionStatus.startedAt
          description: Timestamp when execution started (for done/inProgress playbooks).
          type: Number
        - contextPath: Core.CaseResolutionStatus.completedAt
          description: Timestamp when execution completed (for done playbooks).
          type: Number
        - contextPath: Core.CaseResolutionStatus.parentPlaybook.id
          description: The unique identifier of the parent playbook.
          type: String
        - contextPath: Core.CaseResolutionStatus.parentPlaybook.name
          description: The name of the parent playbook.
          type: String
        - contextPath: Core.CaseResolutionStatus.parentPlaybook.description
          description: The description of the parent playbook.
          type: String
        - contextPath: Core.CaseResolutionStatus.userInput
          description: User input parameters (for pending playbookTask items).
          type: Unknown
    - name: core-list-findings
      description: Retrieves findings from the Cortex platform.
      hidden: true
      arguments:
        - name: asset_id
          description: A comma-separated list of asset IDs to filter by.
          isArray: true
        - name: asset_name
          description: A comma-separated list of asset names to filter by.
          isArray: true
        - name: asset_category
          description: A comma-separated list of asset categories to filter by.
          isArray: true
          auto: PREDEFINED
          predefined:
            - Account
            - Agent
            - AI Pipeline Job
            - AI Workspace
            - API Endpoint
            - API Gateway
            - API Specification
            - Application
            - Audit Logs
            - Backup
            - Certificate
            - Certificate Management
            - CICD Instance
            - CICD Pipeline
            - Cloud Service Account
            - Configuration Management
            - Container Image
            - Container Image Repository
            - Container Instance
            - Container Registry
            - Database
            - Dataset
            - Device
            - Disk
            - Domain
            - Event Management
            - External Identity Provider
            - General Device
            - Human Identity
            - IaC Resource
            - IAM Access Keys
            - IAM Group
            - IAM Policy
            - Image Registry
            - Internet Gateway
            - Key Management
            - Kubernetes Cluster
            - Kubernetes Resource
            - Load Balancer
            - Logging And Monitoring
            - Model
            - Model Endpoint
            - Network Interface
            - Network Security
            - Notebook
            - Organization
            - Organizational Policy
            - Organizational Unit
            - Other
            - Policy Statement
            - Repository
            - Secret
            - Secret Management
            - Security Center
            - Security Group
            - Serverless Function
            - Service
            - Software Package
            - Storage Bucket
            - Subnet
            - Threat Detection
            - VCS Organization
            - Virtual Network
            - VM Image
            - VM Instance
            - Vulnerability Management
            - Web
        - name: asset_class
          description: A comma-separated list of asset classes to filter by.
          isArray: true
          auto: PREDEFINED
          predefined:
            - AI
            - API
            - Application
            - Code
            - Compute
            - Data
            - Device
            - External Surface
            - Identity
            - Management
            - Network
            - Organization
            - Other
            - Security Services
        - name: category
          description: A comma-separated list of finding categories to filter by.
          isArray: true
          auto: PREDEFINED
          predefined:
            - Configuration
            - Vulnerability
            - Malware
            - Identity
            - Data
            - Code
            - Posture
            - Brand protection
        - name: finding_source
          description: A comma-separated list of finding sources to filter by.
          isArray: true
          auto: PREDEFINED
          predefined:
            - Cortex agentless scanner
            - Cortex agent
            - Tenable
            - Qualys
            - Checkmarx
            - Veracode
            - Semgrep
            - Snyk
            - Github advanced security
            - Sonarqube
            - Zap
            - Nuclei
            - Mend
            - Blackduck
            - External code scanner
            - Cortex appsec
            - Cortex attack surface management
            - Cortex attack surface testing
            - Cortex network scanner
            - Cortex container registry scanner
            - Cortex serverless function scanner
            - Cortex cli scanner
            - Cortex data security
            - Rapid7 insightvm
            - Third party scanner
        - name: page
          description: Page number for pagination.
          defaultValue: "0"
        - name: page_size
          description: Number of findings to return per page.
          defaultValue: "100"
      outputs:
        - contextPath: Core.Finding.category
          description: The category of the finding (e.g., VULNERABILITY).
          type: String
        - contextPath: Core.Finding.name
          description: The name of the finding.
          type: String
        - contextPath: Core.Finding.description
          description: Detailed description of the finding.
          type: String
        - contextPath: Core.Finding.first_observed
          description: Timestamp when the finding was first observed (in milliseconds).
          type: Number
        - contextPath: Core.Finding.last_observed
          description: Timestamp when the finding was last observed (in milliseconds).
          type: Number
        - contextPath: Core.Finding.id
          description: The unique identifier of the finding.
          type: String
        - contextPath: Core.Finding.asset_id
          description: The unique identifier of the asset associated with the finding.
          type: String
        - contextPath: Core.Finding.asset_name
          description: The name of the asset associated with the finding.
          type: String
        - contextPath: Core.Finding.asset_class
          description: The class of the asset (e.g., Compute).
          type: String
        - contextPath: Core.Finding.asset_category
          description: The category of the asset (e.g., Container Instance).
          type: String
        - contextPath: Core.Finding.asset_type
          description: The type of the asset (e.g., Container Instance).
          type: String
        - contextPath: Core.Finding.asset_group_ids
          description: List of asset group IDs associated with the finding.
          type: Array
        - contextPath: Core.Finding.normalized_fields
          description: Normalized fields containing structured finding data (e.g., vulnerability details, software package info).
          type: Unknown
        - contextPath: Core.Finding.extended_fields
          description: Extended fields containing additional finding metadata and source-specific information.
          type: Unknown
        - contextPath: Core.FindingMetadata.filtered_count
          description: The total number of findings that match the filter criteria.
          type: Number
        - contextPath: Core.FindingMetadata.returned_count
          description: The actual number of findings returned in this response.
          type: Number
    - name: core-get-ai-model-activity
      description: Retrieves AI model activity information including usage statistics and inactive status.
      hidden: true
      arguments:
        - name: asset_id
          description: A comma-separated list of AI model asset IDs.
          required: true
          isArray: true
      outputs:
        - contextPath: Core.AIModelActivity.asset_id
          description: The unique identifier of the AI model asset.
          type: String
        - contextPath: Core.AIModelActivity.last_used
          description: The timestamp when the model was last used.
          type: Date
        - contextPath: Core.AIModelActivity.event_count
          description: The number of events associated with the model.
          type: Number
        - contextPath: Core.AIModelActivity.is_inactive
          description: Whether the model is currently inactive.
          type: Boolean
    - arguments:
        - description: The name of the profile.
          name: profile_name
          required: true
        - description: The description of the profile.
          name: profile_description
        - auto: PREDEFINED
          defaultValue: disabled
          description: Analyze ASP and ASPX files written to the file system, and quarantine them if found to be malicious.
          name: asp_aspx_files
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: disabled
          description: Breach & Attack Simulation (BAS) tool settings.
          name: breach_attack_simulation_tools_settings
          predefined:
            - enabled
            - disabled
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against UAC bypass mechanisms associated with process privilege elevation.
          name: uac_bypass_prevention
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: disabled
          description: Periodically scans endpoints and attached removable drives for dormant malware.
          name: on_demand_file_examination
          predefined:
            - disabled
            - enabled
        - auto: PREDEFINED
          defaultValue: enabled
          description: Locally scans endpoints and attached removable drives for dormant malware.
          name: end_user_initiated_local_scan
          predefined:
            - disabled
            - enabled
        - auto: PREDEFINED
          defaultValue: block
          description: Analyzes and halts ransomware-related encryption activity to prevent data loss.
          name: ransomware_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against cryptominers.
          name: cryptominers_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against tampering attempts, such as modification or termination of the Cortex XDR agent.
          name: anti_tampering_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against IIS-related attacks.
          name: iis_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against UEFI manipulation attempts.
          name: uefi_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against the connection of potentially malicious Human Interface Devices (HIDs).
          name: malicious_device_prevention
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: terminateSession
          description: Analyzes network packet data to detect malicious behavior.
          name: network_packet_inspection_engine
          predefined:
            - terminateSession
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against processes attempting to access or steal passwords and other sensitive credentials.
          name: credential_gathering_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against processes dropping malicious webshells.
          name: anti_webshell_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Analyzes and prevents malicious macros in Microsoft Office Word or Excel files from executing.
          name: office_files_with_macros_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Prevents evasive attacks using shellcodes to load malicious code.
          name: in_process_shellcode_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Analyzes and prevents malicious JScript files from running.
          name: jscript_file_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Prevents script-based malware attacks by blocking targeted processes from launching child processes.
          name: malicious_child_process_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Analyzes and prevents malicious VB files from running.
          name: vb_scripts_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Prevents attacks using built-in OS executables and administration utilities by monitoring endpoint activity for malicious causality chains.
          name: global_behavioral_threat_protection_rules
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Analyzes and prevents malicious PowerShell script files from running.
          name: powershell_script_files
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against financial and banking malware techniques.
          name: financial_malware_threat_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against security-bypass techniques.
          name: security_measures_bypass
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Provides runtime protection against the abuse of kernel drivers.
          name: dynamic_driver_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against malicious processes running at boot time.
          name: dynamic_kernel_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: enabled
          description: Prevents attacks using the Mimikatz tool to extract passwords from memory.
          name: password_theft_protection
          predefined:
            - disabled
            - enabled
        - auto: PREDEFINED
          defaultValue: block
          description: Analyzes and prevents malicious executable and DLL files from running.
          name: portable_executables_and_dll_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: enabled
          description: Configure agent automatic response actions to malicious causality chains.
          name: respond_to_malicious_causality_chains
          predefined:
            - disabled
            - enabled
      description: Creates a new windows malware profile.
      name: core-create-windows-malware-profile
      hidden: true
      outputs:
        - contextPath: Core.Profile.profile_id
          description: The ID of the created profile.
          type: String
    - arguments:
        - description: The ID of the profile.
          name: profile_id
          required: true
        - description: The new name for the profile.
          name: profile_name
        - description: The new description for the profile.
          name: profile_description
        - auto: PREDEFINED
          description: Analyzes ASP and ASPX files written to the file system and quarantines malicious files.
          name: asp_aspx_files
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Enables or disables Breach & Attack Simulation (BAS) tool settings.
          name: breach_attack_simulation_tools_settings
          predefined:
            - enabled
            - disabled
        - auto: PREDEFINED
          description: Protects against UAC bypass mechanisms associated with process privilege elevation.
          name: uac_bypass_prevention
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Periodically scans endpoints and attached removable drives for dormant malware.
          name: on_demand_file_examination
          predefined:
            - disabled
            - enabled
        - auto: PREDEFINED
          description: Locally scans endpoints and attached removable drives for dormant malware.
          name: end_user_initiated_local_scan
          predefined:
            - disabled
            - enabled
        - auto: PREDEFINED
          description: Targets encryption based activity associated with ransomware to analyze and halt ransomware before any data loss occurs.
          name: ransomware_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against cryptominers.
          name: cryptominers_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against tampering attempts, such as modification or termination of the Cortex XDR agent.
          name: anti_tampering_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against IIS-related attacks.
          name: iis_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against UEFI manipulation attempts.
          name: uefi_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against the connection of potentially malicious Human Interface Devices (HIDs).
          name: malicious_device_prevention
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Analyzes network packet data to detect malicious behavior.
          name: network_packet_inspection_engine
          predefined:
            - terminateSession
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against processes attempting to access or steal passwords and other sensitive credentials.
          name: credential_gathering_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against processes dropping malicious webshells.
          name: anti_webshell_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Analyzes and prevents malicious macros in Microsoft Office Word or Excel files from executing.
          name: office_files_with_macros_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Prevents evasive attacks using shellcodes to load malicious code.
          name: in_process_shellcode_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Analyzes and prevents malicious JScript files from running.
          name: jscript_file_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Prevents script-based malware attacks by blocking targeted processes from launching child processes.
          name: malicious_child_process_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Analyzes and prevents malicious VB files from running.
          name: vb_scripts_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Prevents attacks using built-in OS executables and administration utilities by monitoring endpoint activity for malicious causality chains.
          name: global_behavioral_threat_protection_rules
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Analyzes and prevents malicious PowerShell script files from running.
          name: powershell_script_files
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against financial and banking malware techniques.
          name: financial_malware_threat_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against security-bypass techniques.
          name: security_measures_bypass
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Provides runtime protection against the abuse of kernel drivers.
          name: dynamic_driver_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against malicious processes running at boot time.
          name: dynamic_kernel_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Prevents attacks using the Mimikatz tool to extract passwords from memory.
          name: password_theft_protection
          predefined:
            - disabled
            - enabled
        - auto: PREDEFINED
          description: Analyzes and prevents malicious executable and DLL files from running.
          name: portable_executables_and_dll_examination
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Configures automatic agent response actions for malicious causality chains.
          name: respond_to_malicious_causality_chains
          predefined:
            - disabled
            - enabled
      description: Updates the specified Windows malware profile.
      name: core-update-windows-malware-profile
      hidden: true
      outputs: []
    - arguments:
        - description: The profile name.
          name: profile_name
          required: true
        - description: The profile description.
          name: profile_description
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against browser exploits.
          name: browser_exploits_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against logical exploits.
          name: logical_exploits_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against known vulnerable processes.
          name: known_vulnerable_processes_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: block
          description: Protects against operating system exploits.
          name: operating_system_exploit_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          defaultValue: disabled
          description: Provides exploit protection for additional processes.
          name: exploit_protection_for_additional_processes
          predefined:
            - block
            - disabled
            - report
      description: Creates a new Windows exploit profile.
      name: core-create-windows-exploit-profile
      hidden: true
      outputs:
        - contextPath: Core.Profile.profile_id
          description: The ID of the created profile.
          type: String
    - arguments:
        - description: The profile ID.
          name: profile_id
          required: true
        - description: The profile name.
          name: profile_name
        - description: The profile description.
          name: profile_description
        - auto: PREDEFINED
          description: Protects against browser exploits.
          name: browser_exploits_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against logical exploits.
          name: logical_exploits_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against known vulnerable processes.
          name: known_vulnerable_processes_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Protects against operating system exploits.
          name: operating_system_exploit_protection
          predefined:
            - block
            - disabled
            - report
        - auto: PREDEFINED
          description: Provides exploit protection for additional processes.
          name: exploit_protection_for_additional_processes
          predefined:
            - block
            - disabled
            - report
      description: Updates the specified Windows exploit profile.
      name: core-update-windows-exploit-profile
      hidden: true
      outputs: []
    - arguments:
        - description: The IDs of the profiles.
          name: profile_ids
          required: true
          isArray: true
      description: Deletes the provided profiles.
      name: core-delete-profile
      hidden: true
      outputs: []
    - arguments:
        - description: Comma-separated list of broker VM names to filter by.
          name: broker_vm_names
          isArray: true
        - description: Maximum number of brokers to return.
          name: limit
          defaultValue: "50"
      name: core-list-brokers
      description: Retrieves information about broker VMs configured on the system.
      hidden: true
      outputs:
        - contextPath: Core.Broker.DEVICE_NAME
          description: The name of the broker VM device.
          type: String
        - contextPath: Core.Broker.APPS
          description: List of applications configured on the broker.
          type: Array
    - name: core-create-endpoint-policy
      description: Creates a new endpoint policy and applies it to specified endpoints. Automatically handles priority conflicts by shifting existing policies when needed.
      hidden: true
      arguments:
        - name: policy_name
          description: The name for the new endpoint policy.
          required: true
          type: String
        - name: target_endpoint_names
          description: A comma-separated list of endpoint names to apply the policy to.
          isArray: true
          type: String
        - name: target_endpoint_ids
          description: A comma-separated list of endpoint ids to apply the policy to. The policy will target these specific endpoints.
          isArray: true
          type: String
        - name: platform
          description: The platform type for the policy. Determines which operating system the policy applies to.
          required: true
          auto: PREDEFINED
          predefined:
            - windows
            - mac
            - linux
            - android
            - ios
            - serverless
          type: String
        - name: description
          description: Description of the policy's purpose and scope.
          type: String
        - name: priority
          description: The priority level for the policy (higher numbers indicate higher priority). If not specified, the system automatically assigns the highest priority available for the platform. If the specified priority already exists, existing policies will be shifted down automatically.
          type: Number
        - name: exploit_profile
          description: The name of the exploit protection profile to use. Default is "Default".
          defaultValue: "Default"
          type: String
        - name: malware_profile
          description: The name of the malware protection profile to use. Default is "Default".
          defaultValue: "Default"
          type: String
        - name: agent_settings_profile
          description: The name of the agent settings profile to use. Default is "Default".
          defaultValue: "Default"
          type: String
        - name: restrictions_profile
          description: The name of the restrictions profile to use. Default is "Default".
          defaultValue: "Default"
          type: String
        - name: exceptions_profile
          description: The name of the exceptions profile to use. Default is "Default (No Exceptions)".
          defaultValue: "Default (No Exceptions)"
          type: String
      outputs:
        - contextPath: Core.EndpointPolicy.PolicyName
          description: The name of the created policy.
          type: String
        - contextPath: Core.EndpointPolicy.Platform
          description: The platform type of the policy.
          type: String
        - contextPath: Core.EndpointPolicy.Priority
          description: The priority level assigned to the policy.
          type: Number
        - contextPath: Core.EndpointPolicy.TargetEndpoints
          description: The list of endpoint names targeted by the policy.
          type: Array
        - contextPath: Core.EndpointPolicy.ExploitProfile
          description: The exploit protection profile name.
          type: String
        - contextPath: Core.EndpointPolicy.MalwareProfile
          description: The malware protection profile name.
          type: String
        - contextPath: Core.EndpointPolicy.AgentSettingsProfile
          description: The agent settings profile name.
          type: String
        - contextPath: Core.EndpointPolicy.Description
          description: The policy description.
          type: String
    - name: core-delete-endpoint-policy
      description: Deletes one or more existing endpoint policies from the policy table.
      hidden: true
      arguments:
        - name: policy_name
          description: A comma-separated list of the policy names to delete. Either this or policy_id must be provided.
          type: String
          isArray: true
        - name: policy_id
          description: A comma-separated list of the policy IDs to delete. Either this or policy_name must be provided.
          type: String
          isArray: true
        - name: platform
          description: The platform type to narrow down the policy search. Required to identify the correct policy.
          required: true
          auto: PREDEFINED
          predefined:
            - windows
            - mac
            - linux
            - android
            - ios
            - serverless
          type: String
      outputs:
        - contextPath: Core.DeletedEndpointPolicy.PolicyName
          description: The name of the deleted policy.
          type: String
        - contextPath: Core.DeletedEndpointPolicy.PolicyID
          description: The ID of the deleted policy.
          type: String
        - contextPath: Core.DeletedEndpointPolicy.Platform
          description: The platform type of the deleted policy.
          type: String
        - contextPath: Core.DeletedEndpointPolicy.Priority
          description: The priority level of the deleted policy.
          type: Number
        - contextPath: Core.DeletedEndpointPolicy.Deleted
          description: Confirmation flag that the policy was deleted (always true).
          type: Boolean
  runonce: false
  script: "-"
  subtype: python3
  type: python
  dockerimage: demisto/google-cloud-storage:1.0.0.10120494
tests:
  - No tests
fromversion: 6.2.0
marketplaces:
- platform
supportedModules:
- xsiam
- agentix
- cloud
- cloud_posture
- cloud_runtime_security
- edr