Cortex Core - Platform

Details

README

{
    "Core.CoreAsset": [
        {
            "asset_hierarchy": ["123"],
            "xdm__asset__type__category": "Policy",
            "xdm__asset__cloud__region": "Global",
            "xdm__asset__module_unstructured_fields": {},
            "xdm__asset__source": "XSIAM",
            "xdm__asset__id": "123",
            "xdm__asset__type__class": "Identity",
            "xdm__asset__normalized_fields": {},
            "xdm__asset__first_observed": 100000000,
            "xdm__asset__last_observed": 100000000,
            "xdm__asset__name": "Fake Name",
            "xdm__asset__type__name": "IAM",
            "xdm__asset__strong_id": "FAKE ID"
        }
    ]
}

Configuration parameters

• timeout — HTTP Timeout

Commands (40)

• core-add-assessment-profile

  Create new assessment profile.

• core-appsec-remediate-issue

  Create automated pull requests to fix multiple security issues in a single bulk operation.

• core-create-appsec-policy

  Creates a new AppSec policy in Cortex Platform with defined conditions, scope, and triggers for application security governance.

• core-create-endpoint-policy

  Creates a new endpoint policy and applies it to specified endpoints. Automatically handles priority conflicts by shifting existing policies when needed.

• core-create-windows-exploit-profile

  Creates a new Windows exploit profile.

• core-create-windows-malware-profile

  Creates a new windows malware profile.

• core-delete-endpoint-policy

  Deletes one or more existing endpoint policies from the policy table.

• core-delete-profile

  Deletes the provided profiles.

• core-enable-scanners

  Enable or disable scanners with the specified configuration.

• core-get-ai-model-activity

  Retrieves AI model activity information including usage statistics and inactive status.

• core-get-appsec-issues

  Retrieves application security issues based on specified filters.

• core-get-asset-coverage

  Retrieves a list of assets (e.g., Repositories, CI/CD Pipelines, Container Image Repositories) along with their scan coverage status.

• core-get-asset-coverage-histogram

  Calculates the distribution of values (counts and percentages) for specified categorical fields.

• core-get-asset-details

  Get asset information.

• core-get-case-extra-data

  Get extra data fields of a specific case, including issues and key artifacts.

• core-get-case-resolution-statuses

  Retrieves resolution status information for a specific case.

• core-get-cases

  Get case information based on the specified filters.

• core-get-endpoint-support-file

  Retrieves endpoint support files based on specified endpoint IDs.

• core-get-endpoint-update-version

  Retrieves endpoint update versions for the provided endpoint IDs.

• core-get-issue-recommendations

  Get comprehensive recommendations for an issue, including remediation steps, playbook suggestions, and recommended actions.

• core-get-issues

  Returns a list of issues and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

• core-get-vulnerabilities

  Retrieves vulnerabilities based on specified filters.

• core-list-brokers

  Retrieves information about broker VMs configured on the system.

• core-list-compliance-standards

  Create new assessment profile.

• core-list-endpoints

  Retrieves endpoints based on the provided filters.

• core-list-exception-rules

  Returns a list of exception rules and their metadata, which you can filter by built-in arguments. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

• core-list-findings

  Retrieves findings from the Cortex platform.

• core-list-scripts

  Gets a list of scripts available in the scripts library.

• core-list-system-users

  Returns a list users and their core properties within the system. Results are limited to 50.

• core-run-playbook

  Runs a playbook on specific issue IDs.

• core-run-script-agentix

  Run a script on endpoints.

• core-search-asset-groups

  Searches for asset groups from the Cortex platform using one or more filter criteria.

• core-search-assets

  Retrieves asset from the Cortex platform using optional filter criteria.

• core-send-endpoint-heartbeat

  Sends endpoint heartbeat.

• core-update-case

  Updates the properties of a case.

• core-update-endpoint-version

  Updates the version of the given endpoint to the target version supplied.

• core-update-issue

  Updates the properties of an issue. This command does not provide an explicit indication of success.

• core-update-windows-exploit-profile

  Updates the specified Windows exploit profile.

• core-update-windows-malware-profile

  Updates the specified Windows malware profile.

• core-xql-generic-query-platform

  Execute an XQL query and retrieve a link to the query in the query center. If set to wait for results, the command will be executed every 10 seconds until results are retrieved or until the timeout is reached.