topic Cortex XDR File Retrieval in Automation/API Discussions

Cortex XDR File Retrieval

YAlhazmi — Wed, 05 May 2021 22:01:08 GMT

Hello everyone,

The file retrieval API is failing with the following error, anyone has been through this before?

"err_code": 500,
"err_msg": "An error occurred while processing XDR public API - endpoints",
"err_extra": "can't create group action id for FILES_RETRIEVAL"

Re: Cortex XDR File Retrieval

YAlhazmi — Thu, 06 May 2021 10:53:02 GMT

For those who face the same issue. The API expects an endpoint ID instead of an endpoint name. To get an endpoint ID, you have to first call /public_api/v1/endpoints/get_endpoint/ and supply the hostname. You can then use the endpoint ID from the response to create the File Retrieval request.