Request for File Path Information in Cortex XDR Vulnerability Assessment Data

Jeremy.Burdette — Wed, 06 Aug 2025 18:01:33 GMT

I'm using the XDR API to retrieve vulnerability assessment data (specifically the va_cves and va_endpoints datasets) provided by Host Insights. I would like to know if the API—or any other Cortex API—can provide the file path information associated with each vulnerability on an endpoint.

Specifically

Is there an endpoint in any of the Cortex APIs that indicates the file path (or location) of the vulnerable file or component?
If not, are there plans to add this capability, or can you recommend a way to correlate vulnerabilities to file paths using Cortex XDR data?

This feature would be useful for endpoint investigations and remediation tracking.

Thanks in advance

Re: Request for File Path Information in Cortex XDR Vulnerability Assessment Data

eluis — Mon, 11 Aug 2025 12:02:52 GMT

Hi Jeremy.Burdette,

You can retrieve the file path querying using XQL API, and it will cost you Computing Units (CUs)

Please check:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Cortex-XDR-API-Overview

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/XQL-Query

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Compute-units-usage

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

topic Re: Request for File Path Information in Cortex XDR Vulnerability Assessment Data in Cortex XDR Discussions

Request for File Path Information in Cortex XDR Vulnerability Assessment Data

Re: Request for File Path Information in Cortex XDR Vulnerability Assessment Data