Cortex XDR API get_endpoints vs get_endpoint

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR API get_endpoints vs get_endpoint

L0 Member

Hello,

 

I've been using python script to get all endpoints /public_api/v1/endpoints/get_endpoints

(https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Endpoints).

 

Recently there was another business requirement to get OS type of all endpoints and /public_api/v1/endpoints/get_endpoint seems to have more data and contain fields I need  (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-Endpoint). Since there is a limit of 100 record per request I loop request till I get all data.

 

The problem is that APIs return different number of unique endpoints, first one returns about 7500 records, second one about 5000. Plus, when I retry query using second API results fluctuate a bit.

 

UPDATE:
I wasn't able to figure out why I don't get all data from /public_api/v1/endpoints/get_endpoint and decided to go with XQL query (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API-Reference/Running-XQL-Query-API...). Works fine and I'm able to get all my endpoints.

1 REPLY 1

L0 Member

The /public_api/v1/endpoints/get_endpoints and /public_api/v1/endpoints/get_endpoint APIs may have different underlying implementations or data consistency checks, which could explain the discrepancy in the number of records returned. One API might be using cached data, which can lead to stale or inconsistent results. If the data source is not perfectly synchronized between calls, the results may differ. The APIs might be designed to return different sets of data, with one being more comprehensive than the other. With limits on records per request, subsequent calls might be hitting different data snapshots. 

  • 554 Views
  • 1 replies
  • 0 Likes
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!