Cortex XDR API get_endpoints vs get_endpoint

A.Tskhe624154 — Tue, 28 May 2024 07:18:22 GMT

Hello,

I've been using python script to get all endpoints /public_api/v1/endpoints/get_endpoints

(https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Endpoints).

Recently there was another business requirement to get OS type of all endpoints and /public_api/v1/endpoints/get_endpoint seems to have more data and contain fields I need (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-Endpoint). Since there is a limit of 100 record per request I loop request till I get all data.

The problem is that APIs return different number of unique endpoints, first one returns about 7500 records, second one about 5000. Plus, when I retry query using second API results fluctuate a bit.

UPDATE:
I wasn't able to figure out why I don't get all data from /public_api/v1/endpoints/get_endpoint and decided to go with XQL query (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API-Reference/Running-XQL-Query-APIs). Works fine and I'm able to get all my endpoints.

Re: Cortex XDR API get_endpoints vs get_endpoint

robert2003b — Tue, 28 May 2024 09:12:24 GMT

The /public_api/v1/endpoints/get_endpoints and /public_api/v1/endpoints/get_endpoint APIs may have different underlying implementations or data consistency checks, which could explain the discrepancy in the number of records returned. One API might be using cached data, which can lead to stale or inconsistent results. If the data source is not perfectly synchronized between calls, the results may differ. The APIs might be designed to return different sets of data, with one being more comprehensive than the other. With limits on records per request, subsequent calls might be hitting different data snapshots.

topic Re: Cortex XDR API get_endpoints vs get_endpoint in Cortex XDR Discussions

Cortex XDR API get_endpoints vs get_endpoint

Re: Cortex XDR API get_endpoints vs get_endpoint