topic Re: Get Assets and Vulnerabilities from Cortex XDR via API in Cortex XDR Discussions

Get Assets and Vulnerabilities from Cortex XDR via API

dishank_08 — Mon, 09 Jun 2025 06:23:24 GMT

Hey Team,
I wanted to fetch Assets and their vulnerabilities details from Cortex XDR.
Is there any REST endpoint available for the same?
I tried searching the documentation but coundn't find it. (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/API-Reference)

Re: Get Assets and Vulnerabilities from Cortex XDR via API

jmazzeo — Tue, 10 Jun 2025 15:47:07 GMT

Hi @dishank_08,

There is no specific API endpoint available for the assets and VA results.

But, you can run XQL queries using the API, querying the datasets "va_endpoints" or "host_inventory". There is the API reference guide: https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/ecc87ad01e173-start-an-xql-query

Using XQL Queries from the API Endpoint consumes Compute Units, keep an eye on that usage under Settings - Configurations - Data Management - Compute Units Usage

If this post answers your question, please mark it as the solution.

Re: Get Assets and Vulnerabilities from Cortex XDR via API

dishank_08 — Thu, 12 Jun 2025 05:51:17 GMT

Thanks @jmazzeo.

I see along with "va_endpoints" there is "va_cves" dataset also available which seems related for all vulnerabilities in XDR. Does there any feature or permission/role requires to access these dataset or data?