Advanced Authentication Cortex API

[ianatgrafton]

Does anybody have any examples of how they have implemented Advanced Auth for the Cortex API

I only have PowerShell available examples using that that would be preferred, but I can probably interpret most scripting languages.

If not examples, maybe links to articles discussing the process to implement it more generally.
Cortex XDR 

[susekar]

Hello @ianatgrafton ,

Greetings for the day!

Implementing Advanced Authentication for the Cortex Public API requires specific cryptographic logic to prevent replay attacks. While official Knowledge Base articles primarily provide PowerShell examples for Standard authentication, the logic for Advanced authentication is documented in Python and can be translated to PowerShell using .NET classes.

Advanced Authentication Requirements:
Unlike Standard authentication, which passes the raw API key in the Authorization header, Advanced authentication requires a dynamic signature for every request. The following headers are mandatory:

x-xdr-auth-id: The API Key ID retrieved from the Cortex XDR console.
x-xdr-timestamp: The current UTC time in milliseconds.
x-xdr-nonce: A unique, randomly generated 64-character alphanumeric string.

Authorization: A SHA256 hex digest of the combined string: API_KEY + NONCE + TIMESTAMP.

---------

General Reference for Standard Auth (PowerShell):
For reference, the simpler Standard implementation looks like this:

$headers = @{
"x-xdr-auth-id" = "<API_ID>"
"Authorization" = "<API_KEY>" # Note: Raw key, no hashing
}

Invoke-RestMethod -Method 'Post' -Uri $url -Headers $headers -Body $jsonBody -ContentType "application/json"

Ref Article: (How to make a request to the Cortex XDR API using the PowerShell only)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kGi7CAE

If you feel this has answered your query, please let us know by clicking Like and "Mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar