Request for File Path Information in Cortex XDR Vulnerability Assessment Data

[Jeremy.Burdette]

I'm using the XDR API to retrieve vulnerability assessment data (specifically the va_cves and va_endpoints datasets) provided by Host Insights. I would like to know if the API—or any other Cortex API—can provide the file path information associated with each vulnerability on an endpoint.

Specifically

• Is there an endpoint in any of the Cortex APIs that indicates the file path (or location) of the vulnerable file or component?
• If not, are there plans to add this capability, or can you recommend a way to correlate vulnerabilities to file paths using Cortex XDR data?

This feature would be useful for endpoint investigations and remediation tracking.

Thanks in advance

[eluis]

Hi Jeremy.Burdette, 

You can retrieve the file path querying using XQL API, and it will cost you Computing Units (CUs)

Please check: 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Cortex-XDR-API-Overview

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/XQL-Query

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Compute-units-usa...

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis