The query is w.r.t API operation

[RamyashreeMada]

Hello,

Is the API function available to run the "File Search" operation? --> (“Incident Response --> Action Centre --> File Search- Sha256”). Did not find this option in the Cortex XDR API documentation, however, wanted to confirm and check if this can be achieved through API or not? 

[aspatil · Accepted solution]

Hi

Thank you for reaching out to the Live Community. Please allow me to address your questions.

Unfortunately there is no API for File Search. You can do it from Action Center if you have Host Insight License.
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Search-and-...

Assuming you wanted to pull a file into XSOAR for analysis, in that case you can use File Retrieval API. For more information, please refer below link:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Retrieve-File

Please mark the response as "Accept as Solution" if it answers your query.