The query is w.r.t API operation

RamyashreeMada — Tue, 22 Aug 2023 05:01:55 GMT

Hello,

Is the API function available to run the "File Search" operation? --> (“Incident Response --> Action Centre --> File Search- Sha256”). Did not find this option in the Cortex XDR API documentation, however, wanted to confirm and check if this can be achieved through API or not?

Re: The query is w.r.t API operation

aspatil — Tue, 22 Aug 2023 09:44:28 GMT

Thank you for reaching out to the Live Community. Please allow me to address your questions.

Unfortunately there is no API for File Search. You can do it from Action Center if you have Host Insight License.
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Search-and-Destroy-Malicious-Files

Assuming you wanted to pull a file into XSOAR for analysis, in that case you can use File Retrieval API. For more information, please refer below link:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Retrieve-File

Please mark the response as "Accept as Solution" if it answers your query.

topic The query is w.r.t API operation in Cortex XDR Discussions

The query is w.r.t API operation

Re: The query is w.r.t API operation