API for exceptions?

[ITApps]

Hi,
looking for API for adding exceptions, is it exists ?

I'd like to add programmatically exceptions which are done by UI > Settings > Exception Configuration > Legacy Agent Exceptions > Add Rule

[susekar]

Hello @ITApps ,

Greetings for the day.

Based on internal documentation and support cases, there is currently no public-facing API endpoint available to programmatically manage (add, update, or insert) Legacy Agent Exceptions in Cortex XDR or XSIAM.

Key Details

Design Limitation
This functionality is intentionally designed to be managed exclusively through the Cortex XDR management console user interface to ensure centralized control and consistency.

New / Upcoming API
There is a dedicated Agent Exceptions API that has been released (or is scheduled for release depending on your tenant region), but its primary purpose is bulk data export, auditing, and environment cleanup rather than programmatically adding new rules.

Partial Alternatives
For simple hash allowlisting, some users have noted the core-add-exclusion command; however, it is limited in scope compared to the full Legacy Agent Exceptions module, which supports paths, signers, and specific protection modules.

Recommendation

If programmatic access is a mandatory business requirement for your organization, it is recommended to contact your Palo Alto Networks Account Team or Solutions Consultant to submit a formal Feature Request (FR).

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[ITApps]

Hello @susekar ,

thank you for the answer, I have two question:
- where can I get more info about Agent Exceptions API ?

- what is core-add-exclusion command ? 

[susekar]

Hello @ITApps ,

Thank you for your message.

You may review the latest updates in the official Palo Alto Networks Cortex XDR knowledge base documentation.

The core-add-exclusion command is an automation utility used within Cortex XSIAM and XSOAR playbooks. It is part of the Cortex Core (REST API) integration, which enables the automation engine to communicate with the Cortex server.

Primary Function:
This command is specifically designed for hash allowlisting.

If this information addresses your query, please let us know by clicking Like and selecting “Mark this as a Solution.”

Thanks & regards,
S. Subashkar Sekar