topic Re: Initiate Script on Endpoint via API call in Cortex XDR Discussions

Initiate Script on Endpoint via API call

cnogawaterfront — Tue, 23 Jan 2024 16:39:36 GMT

Hi Everyone,

I've been running Powershell scripts on my endpoints from Action Center > Run Endpoint Script > Execute Commands in the XDR interface. It works well, however I need to specify a manual query to target the endpoints I want each time i.e. within a specific IP Range, 'Connected' vs 'Disconnected' etc. It gets cumbersome when having to re-run scripts several times or just pick out a few endpoints for testing.

Does anyone know if the API's allow you to run scripts? Ideally, could have a static set of parameters which includes the query to narrow down the endpoints. This way, could have several API links to kick off scripts with different target endpoint queries vs having to specify the query each time in the interface.

Also doesn't seem like you can save a manual query after you've built it, that would have been helpful as well.

Happy to hear any input you may have.

Thanks

Re: Initiate Script on Endpoint via API call

jmazzeo — Tue, 30 Jan 2024 14:01:06 GMT

Hi @cnogawaterfront, thanks for reaching us using the Live Community.

The API allows you to run scripts on endpoints, you need to upload the script to the console, get the script UUID, and also get the Endpoint IDs where you need to run it.

Here is the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Run-Script

You can combine it with the Get-Endpoint Api to obtain the endpoint_id value: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-Endpoint

Please let me know if this can work for you.

Re: Initiate Script on Endpoint via API call

cnogawaterfront — Fri, 09 Feb 2024 20:42:13 GMT

Hi Jmazzeo, I'm getting a 404 error with both of those links unfortunately. I was able to find this one:

https://cortex-panw.stoplight.io/docs/cortex-xdr/7223bea7d2bea-run-script

Looks like the same thing you were referring to. I hadn't thought to upload the script, I've just been running it from the endpoint machines. Thanks for the help.

Re: Initiate Script on Endpoint via API call

Sulivan — Mon, 17 Feb 2025 17:41:06 GMT

Hello @jmazzeo,

A follow-up question on this: is there a way to upload a script to the script library using API call?

I checked and there seems no API call for that in the official docs or did I miss it?

Thanks!

Re: Initiate Script on Endpoint via API call

jmazzeo — Wed, 19 Feb 2025 12:19:51 GMT

Hi!, no, there is no API to upload a script, you can call the scripts already uploaded to the console, or you can run snipped code using this API: https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/083859c8c6729-run-snippet-code-script

You can find in that section on the left side, all the APIs for the supported script actions.