XDR API for Policy Management

[RishitShah]

Is there an API in XDR for Policy Management?

I'm trying to get the list of policies, profiles and their rules.

There is /public_api/v1/endpoints/get_policy (Get Policy • Cortex XDR REST API • Reader • Palo Alto Networks documentation portal)

However, this just gives the Policy Name for a specific Endpoint.  

[jmazzeo]

Hi @RishitShah, thanks for reaching us using the Live Community.

The public API is limited for the information you need.

But, the console XDR console itself work with API calls to the backend, so you can pickup the API URL and headers from the requests when you access to any location.

For example, opening "Policy Rules" with the browser inspect enabled shows the following entry name:

If you select it, look at the headers and you can copy them to the platform needed to do the query. This a screenshot from my Postman, not all the headers are needed, you can play there:

You can do this same API workaround with any section of the console.

NOTE: this will work only if you have a current web session to the console.

If this works for you, please mark this question as the solution.

[RishitShah]

Hi @jmazzeo I tried the approach you suggested, however, in response I receive a Sign in Page.

[V.R800240]

I too got sign in Page, Any solution

[jmazzeo]

This is just a workaround, take a look at the headers I have used in my postman screenshot. Anyway many months an versions have been rolled out for the XDR product, I haven't tested it again.