Get Assets and Vulnerabilities from Cortex XDR via API

[dishank_08]

Hey Team, 
I wanted to fetch Assets and their vulnerabilities details from Cortex XDR.
Is there any REST endpoint available for the same? 
I tried searching the documentation but coundn't find it. (https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/API-Reference)

[jmazzeo]

Hi @dishank_08,

There is no specific API endpoint available for the assets and VA results.

But, you can run XQL queries using the API, querying the datasets "va_endpoints" or "host_inventory". There is the API reference guide: https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/ecc87ad01e173-start-an-xql-query

Using XQL Queries from the API Endpoint consumes Compute Units, keep an eye on that usage under Settings - Configurations - Data Management - Compute Units Usage

If this post answers your question, please mark it as the solution.

[dishank_08]

Thanks @jmazzeo.

I see along with "va_endpoints" there is "va_cves" dataset also available which seems related for all vulnerabilities in XDR. Does there any feature or permission/role requires to access these dataset or data?