Cortex XDR - IR

Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.

Category

Endpoint

Pack

CortexXDR

Configuration parameters

• isFetch — Fetch incidents
• incidentFetchInterval — Incidents Fetch Interval
• incidentType — Incident type
• url — Server URL (copy URL from XDR) (required)
• apikey_id_creds —
• apikey_creds —
• dont_format_sublists — Remove legacy incident fields
• mirror_direction — Incident Mirroring Direction
• close_xsoar_incident — Close Mirrored XSOAR Incident
• close_xdr_incident — Close Mirrored Cortex XDR Incident
• xdr_delay — XDR mirroring delay in minutes
• custom_xsoar_to_xdr_close_reason_mapping — Custom close-reason mapping (XSOAR -> XDR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
• custom_xdr_to_xsoar_close_reason_mapping — Custom close-reason mapping (XDR -> XSOAR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
• apikey_id — API Key ID
• apikey — API Key
• timeout — HTTP Timeout
• max_fetch — Maximum number of incidents per fetch
• starred — Only fetch starred incidents
• starred_incidents_fetch_window — Starred incidents fetch window
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
• sync_owners — Sync Incident Owners
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• prevent_only — Prevent Only Mode
• status — Incident Statuses to Fetch
• exclude_fields — Minimize Incident Information
• excluded_alert_fields — Minimize Alert Information
• close_alerts_in_xdr — Close all related alerts in XDR

Commands (109)

• endpoint — Returns information about an endpoint.
• get-mapping-fields — Gets mapping fields from remote incident. Note: This method will not update the current incident. It's here for debugging purposes.
• get-modified-remote-data — Gets the list of incidents that were modified since the last update. Note: This method is here for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since version 6.1.
• get-remote-data — Gets remote data from a remote incident. Note: This method will not update the current incident. It's here for debugging purposes.
• xdr-action-status-get — Retrieves the status of the requested actions according to the action ID.
• xdr-allowlist-files — Adds requested files to the allow list if they are not already on the block list or allow list.
• xdr-api-key-delete — Deletes the specified API keys.
• xdr-api-key-list — Gets a list of existing API keys.
• xdr-asset-group-create — Creates an asset group.
• xdr-asset-group-delete — Deletes an asset group.
• xdr-asset-group-list — Returns a list of asset groups.
• xdr-asset-group-update — Updates an asset group.
• xdr-asset-list — Returns a list of assets.
• xdr-asset-schema-field-options-get — Gets the enum values of a specified field in the asset schema.
• xdr-asset-schema-get — Gets the schema of the asset inventory.
• xdr-automation-playbook-create — Creates or updates an automation playbook.
• xdr-automation-playbook-delete — Deletes an automation playbook.
• xdr-automation-playbook-get — Gets an automation playbook.
• xdr-automation-script-create — Creates or updates an automation script.
• xdr-automation-script-delete — Deletes an automation script.
• xdr-automation-script-get — Gets an automation script.
• xdr-bioc-create — Creates a new BIOC.
• xdr-bioc-delete — Deletes a BIOC.
• xdr-bioc-list — Returns a list of BIOCs.
• xdr-bioc-update — Updates an existing BIOC.
• xdr-blacklist-files — Deprecated. Use `xdr-blocklist-files` instead.
• xdr-blocklist-files — Block lists requested files which have not already been block listed or added to allow lists.
• xdr-case-artifact-list — Retrieves a list of artifacts for a specific case.
• xdr-case-list — Returns a list of cases based on the specified filters.
• xdr-case-update — Updates an existing case with the specified details.
• xdr-correlation-rule-create — Creates a new correlation rule.
• xdr-correlation-rule-delete — Deletes correlation rules.
• xdr-correlation-rule-list — Returns a list of correlation rules.
• xdr-correlation-rule-update — Updates an existing correlation rule.
• xdr-create-distribution — Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.
• xdr-delete-endpoints — Deletes selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.
• xdr-endpoint-alias-change — Gets a list of endpoints according to the passed filters, and changes their alias name. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported).
• xdr-endpoint-isolate — Isolates the specified endpoint.
• xdr-endpoint-scan — Deprecated. Use `xdr-endpoint-scan-execute` instead.
• xdr-endpoint-scan-abort — Cancels the scan of selected endpoints. A scan can only be aborted if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Note that scanning all of the endpoints may cause performance issues and latency.
• xdr-endpoint-scan-execute — Runs a scan on a selected endpoint. To scan all endpoints, run this command with argument all=true. Note: Scanning all the endpoints may cause performance issues and latency.
• xdr-endpoint-tag-add — Adds a tag to specified endpoint_ids.
• xdr-endpoint-tag-remove — Removes a tag from specified endpoint_ids.
• xdr-endpoint-triage — Initiates a forensics triage on the specified endpoints. You must have Cortex XDR with the Forensics add-on. The agent also must have the Forensics License enabled.
• xdr-endpoint-triage-preset-list — Gets a list of available triage presets.
• xdr-endpoint-unisolate — Reverses the isolation of an endpoint.
• xdr-file-delete-script-execute — Initiates a new endpoint script execution to delete the specified file.
• xdr-file-exist-script-execute — Initiates a new endpoint script execution to check if the file exists.
• xdr-file-quarantine — Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
• xdr-file-restore — Restores a quarantined file on requested endpoints.
• xdr-file-retrieve — Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.
• xdr-get-alerts — This command is deprecated, please use xdr-issue-list instead. Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.
• xdr-get-audit-agent-reports — Gets agent event reports. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of reports from the start of the result set (start by counting from 0).
• xdr-get-audit-management-logs — Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).
• xdr-get-cloud-original-alerts — This command is deprecated. Returns information about each alert ID.
• xdr-get-contributing-event — Retrieves contributing events for a specific correlation alert.
• xdr-get-create-distribution-status — Gets the status of the installation package.
• xdr-get-distribution-url — Gets the distribution URL for downloading the installation package.
• xdr-get-distribution-versions — Gets a list of all the agent versions to use for creating a distribution list.
• xdr-get-endpoint-device-control-violations — Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.
• xdr-get-endpoints — Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set. (Start by counting from 0).
• xdr-get-endpoints-by-status — Returns the number of the connected\disconnected endpoints.
• xdr-get-incident-extra-data — This command is deprecated. Use "xdr-case-list extra_data=true" instead. Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.
• xdr-get-incidents — This command is deprecated please use xdr-case-list instead. Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created. If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.
• xdr-get-policy — Gets the policy name for a specific endpoint.
• xdr-get-quarantine-status — Retrieves the quarantine status for a selected file.
• xdr-get-script-code — Gets the code of a specific script in the script library.
• xdr-get-script-execution-result-files — Gets the files retrieved from a specific endpoint during a script execution.
• xdr-get-script-execution-results — Retrieve the results of a script execution action.
• xdr-get-script-execution-status — Retrieves the status of a script execution action.
• xdr-get-script-metadata — Gets the full definition of a specific script in the scripts library.
• xdr-get-scripts — Gets a list of scripts available in the scripts library.
• xdr-get-tenant-info — Provides information about the tenant.
• xdr-healthcheck-run — Runs a system health check on the Cortex XDR environment.
• xdr-insert-cef-alerts — This command is deprecated. Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.
• xdr-insert-parsed-alert — This command is deprecated. Uploads an alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.
• xdr-isolate-endpoint — Deprecated. Use `xdr-endpoint-isolate` instead.
• xdr-issue-create — Creates a new issue. Issues with an 'INFO' severity level are not displayed in the UI.
• xdr-issue-list — Retrieve issues based on filters. Issues with an 'INFO' severity level are filtered out.
• xdr-issue-update — Updates an existing issue.
• xdr-kill-process-script-execute — Initiates a new endpoint script execution kill process.
• xdr-list-risky-hosts — Retrieve the risk score of a specific host or list of hosts with the highest risk score in the environment along with the reason affecting each score.
• xdr-list-risky-users — Retrieve the risk score of a specific user or list of users with the highest risk score in the environment along with the reason affecting each score.
• xdr-list-roles — Retrieve information about one or more roles created in the environment.
• xdr-list-user-groups — Retrieve a list of the current user emails associated with one or more user groups in the environment.
• xdr-list-users — Retrieve a list of the current users in the environment.
• xdr-quarantine-files — Deprecated. Use `xdr-file-quarantine` instead.
• xdr-remove-allowlist-files — Removes requested files from allow list.
• xdr-remove-blocklist-files — Removes requested files from the block list.
• xdr-remove-user-role — Remove one or more users from a role.
• xdr-replace-featured-field — Replace the featured hosts\users\IP addresses\active directory groups listed in your environment.
• xdr-restore-file — Deprecated. Use `xdr-file-restore` instead.
• xdr-retrieve-file-details — View the file retrieved by the xdr-retrieve-files command according to the action ID. Before running this command, you can use the xdr-action-status-get command to check if this action completed successfully.
• xdr-retrieve-files — Deprecated. Use `xdr-file-retrieve` instead.
• xdr-run-script — Deprecated. Run xdr-script-run instead.
• xdr-run-script-delete-file — Deprecated. Use `xdr-file-delete-script-execute` instead.
• xdr-run-script-execute-commands — Deprecated. Use `xdr-script-commands-execute` instead.
• xdr-run-script-file-exists — Deprecated. Use `xdr-file-exist-script-execute` instead.
• xdr-run-script-kill-process — Deprecated. Use `xdr-kill-process-script-execute` instead.
• xdr-run-snippet-code-script — Deprecated. Use `xdr-snippet-code-script-execute` instead.
• xdr-script-commands-execute — Initiates a new endpoint script execution of shell commands.
• xdr-script-run — Initiates a new endpoint script execution action using a script from the script library and returns the results.
• xdr-set-user-role — Add one or more users to a role.
• xdr-snippet-code-script-execute — Initiates a new endpoint script execution action using the provided snippet code.
• xdr-unisolate-endpoint — Deprecated. Use `xdr-endpoint-unisolate` instead.
• xdr-update-alert — This command is deprecated, please use xdr-issue-update instead. Update one or more alerts with the provided arguments. Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.
• xdr-update-incident — This command is deprecated please use xdr-case-update instead. Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.
• xdr-vulnerability-details-get — Gets vulnerability details by ID.
• xdr-whitelist-files — Deprecated. Use `xdr-allowlist-files` instead.