topic Re: API Cortex Disable Policy in Cortex XDR Discussions

API Cortex Disable Policy

luismi.anton — Tue, 28 Feb 2023 14:05:22 GMT

Dear all,

Does anyone knows the specific endpoint to disable Policy Rule through the API?

In the API Doc only shows get-policy associated to endpoint.

Thanks in advance!

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API-Reference/Get-Policy

Re: API Cortex Disable Policy

bbucao — Tue, 28 Feb 2023 14:52:10 GMT

Hi Luismi.Anton,

There is not an API for disabling policies, this must be done via the UI. If you are using specific policies temporarily, one possible workaround is to target endpoints for these policies based on the endpoint 'tags'. If the policies are configured in that way, you can effectively change the endpoints assigned policy via API by assigning or removing endpoint tags via API.

Thanks,
Ben

Re: API Cortex Disable Policy

luismi.anton — Tue, 28 Feb 2023 16:24:08 GMT

Great!, thank you very match Bbucao!!

This policies are not temporarily, but if I remove one endpoint tag, in the future is possible to create again with the same API? or only is possible with de UI.

The concept is develop a button that triggers a query to the API for enable and disable policy...

Re: API Cortex Disable Policy

timurphy — Tue, 28 Feb 2023 16:54:49 GMT

Hi @luismi.anton,

Removing the endpoint tag will just remove that tag assignment from the specified endpoint(s). The tag will still be available for future assignment and will still be referenced in any Policy Rule(s), if they are configured to target endpoints with that tag. The endpoint which has the tag removed will no longer be governed by that particular policy and will be evaluated against the other policies' target criteria until one is matched.

Regards,

Tim

Re: API Cortex Disable Policy

luismi.anton — Thu, 02 Mar 2023 11:19:34 GMT

Finally we´re able to do this implementation. Thanks at all folks!!!

Re: API Cortex Disable Policy

luismi.anton — Fri, 10 Mar 2023 13:20:11 GMT

Hi Again Folks,

After assign a tag to a specific group via API, how can we confirm that all de endpoints presents on that group have that specific tag assigned?

Thank you very much.

Re: API Cortex Disable Policy

timurphy — Fri, 10 Mar 2023 15:39:00 GMT

Hi @luismi.anton,

To verify the tag is present on the endpoints, you could validate in the console by navigating to Endpoints > Endpoint Groups and then right click the group name and select "View endpoints." In the resulting table, make sure the "Tags" column is shown by customizing the table layout using the ellipsis in the upper right corner. This will show all of the endpoint tags associated with the endpoints in your target group.

You could also return the information via the Get Endpoint API. Within the request body, you can specify filters and use the group_name field - this will return all endpoints in that group, and one of the properties returned in the response for each endpoint would be endpointTags.

I hope this helps!

Regards,

Tim