topic Re: Download the freshly created xdr-distribution-file in Cortex XDR Discussions

Download the freshly created xdr-distribution-file

r_buchwalder — Tue, 24 Jan 2023 14:55:12 GMT

Hello

I'm looking for an autmoatisation, where I'm able to download the freshly created xdr-distribution-file.
In my Playbook I've created following steps:

xdr-get-distribution-versions
xdr-create-distribution
xdr-get-distribution-url

Now, the last step tells me an URL to download the xdr-file.
I would like to download that file to put it on out internal server for our client developers.
Does anyone have an Idea, how I may get that file?

thanks
roger

Re: Download the freshly created xdr-distribution-file

aleksandar.astardzhiev — Tue, 24 Jan 2023 15:33:59 GMT

Hi @r_buchwalder ,

Have you checked XDR API reference documentation - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API-Reference/Get-Distribution-URL

If I understand your question all information should be already there.

Just reading the docs it seems the flow should be as follow:

- Make Create distribution API call (Create Distributions • Cortex XDR API Reference • Reader • Palo Alto Networks documentation portal), which will return distribution ID

- Make Get Distribution Status API call providing the ID from previous call. This will tell you if package is ready for download or still creating. You probably need to loop this until status is ready

- Make Get Distribution URL API call providing the same ID. This will return URL from which you can then download the package.

Re: Download the freshly created xdr-distribution-file

r_buchwalder — Tue, 24 Jan 2023 15:39:27 GMT

Hello @aleksandar.astardzhiev

That is exactly what I did. But now, I would like to download that file in xsoar and put it on an smb share.

The URL I get need a Palo-Login...

Is there an automated way to get that file within xsoar?

tanks

R_buchwalder

Re: Download the freshly created xdr-distribution-file

timurphy — Tue, 24 Jan 2023 16:19:37 GMT

Hi @r_buchwalder,

The URL provided in the response from the "Get Distribution URL" API is signed and only lasts for a short amount of time. You can download the file by making a GET or POST request directly to that URL with the standard headers (Authorization, x-xdr-auth-id) as you would for any other XDR API call.

For example, here is how you can make such a request with curl to download the installation package from the distribution_url:

curl --location --request POST 'DISTRIBUTION_URL_GOES_HERE' \ --header 'Authorization: API_KEY_GOES_HERE' \ --header 'x-xdr-auth-id: API_KEY_ID_GOES_HERE' \ --output '/path/to/file.msi'

I hope this helps!

Regards,

Tim

Re: Download the freshly created xdr-distribution-file

r_buchwalder — Fri, 07 Jul 2023 14:28:38 GMT

Hello Tim

If I do that with the curl-trick; I get this as response:
{"reply": {"err_code": 401, "err_msg": "Public API request unauthorized", "err_extra": null}}
The key-ID and keys are all the same.

If I call the URL directly in a Browser, I get also a HTTP 401 error.

regards

rog