API Cortex Disable Policy

[luismi.anton]

Dear all,

Does anyone knows the specific endpoint to disable Policy Rule through the API?

In the API Doc only shows get-policy associated to endpoint.

Thanks in advance!

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API-Reference/Get-Policy

[bbucao · Accepted solution]

Hi Luismi.Anton,

There is not an API for disabling policies, this must be done via the UI. If you are using specific policies temporarily, one possible workaround is to target endpoints for these policies based on the endpoint 'tags'. If the policies are configured in that way, you can effectively change the endpoints assigned policy via API by assigning or removing endpoint tags via API.

Thanks,
Ben

[luismi.anton]

Great!, thank you very match Bbucao!!

This policies are not temporarily, but if I remove one endpoint tag, in the future is possible to create again with the same API? or only is possible with de UI.

The concept is develop a button that triggers a query to the API for enable and disable policy...

[timurphy · Accepted solution]

Hi @luismi.anton,

Removing the endpoint tag will just remove that tag assignment from the specified endpoint(s). The tag will still be available for future assignment and will still be referenced in any Policy Rule(s), if they are configured to target endpoints with that tag. The endpoint which has the tag removed will no longer be governed by that particular policy and will be evaluated against the other policies' target criteria until one is matched.

Regards,

Tim

[luismi.anton]

Finally we´re able to do this implementation. Thanks at all folks!!!

[luismi.anton]

Hi Again Folks,

After assign a tag to a specific group via API, how can we confirm that all de endpoints presents on that group have that specific tag assigned?

Thank you very much.

[timurphy]

Hi @luismi.anton,

To verify the tag is present on the endpoints, you could validate in the console by navigating to Endpoints > Endpoint Groups and then right click the group name and select "View endpoints." In the resulting table, make sure the "Tags" column is shown by customizing the table layout using the ellipsis in the upper right corner. This will show all of the endpoint tags associated with the endpoints in your target group.

You could also return the information via the Get Endpoint API. Within the request body, you can specify filters and use the group_name field - this will return all endpoints in that group, and one of the properties returned in the response for each endpoint would be endpointTags.

I hope this helps!

Regards,

Tim