Help with XDR Rest query

S.Bossi — Fri, 13 Dec 2024 20:55:00 GMT

Hi,

I'm trying to query the Cortex REST API using this doc - https://live.paloaltonetworks.com/t5/cortex-xdr-articles/cortex-xdr-and-xsiam-postman-api-collection/ta-p/443667, but I keep receiving a

"Public API request unauthorized" message. I tried opening a ticket, but apparently
that's not allowed for this level of question. Any suggestions? My environment settings
are set in Postman. 

Re: Help with XDR Rest query

maximk — Sat, 14 Dec 2024 23:22:53 GMT

Try starting with something simple: standard API key token with relevant permissions and its ID.

In powershell a simple working query can look like:

$api_key_id = ""
$api_key = ""

$headers=@{}
$headers.Add("x-xdr-auth-id", $api_key_id)
$headers.Add("Authorization", $api_key)
$headers.Add("Accept", "application/json")

$response = Invoke-WebRequest -Uri 'https://api-<your_tenanant>.xdr.<your_region>.paloaltonetworks.com/public_api/v1/healthcheck' -Method GET -Headers $headers -ErrorVariable ProcessError
$response

topic Help with XDR Rest query in Cortex XDR Discussions

Help with XDR Rest query

Re: Help with XDR Rest query