{ "info": { "_postman_id": "0192b022-f04d-4b33-9725-c77abd13213c", "name": "Palo Alto Networks Cortex XDR REST API", "description": "REST API for the Cortex XDR extended detection and response platform. Provides programmatic access to incidents, alerts, endpoints, scripts, XQL queries, and audit logs. Cortex XDR correlates data from network, endpoint, cloud, and third-party sources to detect and investigate threats. Authentication uses a custom HMAC-SHA256 scheme: generate an API key ID and secret from the Cortex XDR settings, then sign each request using the x-xdr-auth-id, x-xdr-nonce, x-xdr-timestamp, and x-xdr-hmac-v2 headers. All API endpoints use POST with JSON request bodies containing a request_data object for filters and parameters.\n\nContact Support:\n Name: Palo Alto Networks Developer Support", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json", "createdAt": "2026-06-05T13:18:52.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "lastUpdatedBy": "35240", "uid": "35240-0192b022-f04d-4b33-9725-c77abd13213c" }, "item": [ { "name": "incidents", "item": [ { "name": "get_incidents", "item": [ { "name": "Palo Alto Networks List Incidents", "id": "ad363491-92b1-48eb-b949-97f41e3ab2c1", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incidents", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incidents" ] }, "description": "Returns a list of incidents matching the specified filter criteria. Incidents group related alerts into a unified investigation context. Supports filtering by incident ID, status, severity, and creation time." }, "response": [ { "id": "8a1155a8-e2f1-40c1-b0e3-2de71bd44365", "name": "Incidents returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incidents", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incidents" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"total_count\": \"\",\n \"result_count\": \"\",\n \"incidents\": [\n {\n \"incident_id\": \"\",\n \"incident_name\": \"\",\n \"description\": \"\",\n \"status\": \"resolved_duplicate\",\n \"severity\": \"unknown\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"alert_count\": \"\",\n \"low_severity_alert_count\": \"\",\n \"med_severity_alert_count\": \"\",\n \"high_severity_alert_count\": \"\",\n \"critical_severity_alert_count\": \"\",\n \"user_count\": \"\",\n \"host_count\": \"\",\n \"creation_time\": \"\",\n \"modification_time\": \"\",\n \"detection_time\": \"\",\n \"starred\": \"\",\n \"xdr_url\": \"\",\n \"rule_based_score\": \"\",\n \"manual_score\": \"\"\n },\n {\n \"incident_id\": \"\",\n \"incident_name\": \"\",\n \"description\": \"\",\n \"status\": \"resolved_threat_handled\",\n \"severity\": \"critical\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"alert_count\": \"\",\n \"low_severity_alert_count\": \"\",\n \"med_severity_alert_count\": \"\",\n \"high_severity_alert_count\": \"\",\n \"critical_severity_alert_count\": \"\",\n \"user_count\": \"\",\n \"host_count\": \"\",\n \"creation_time\": \"\",\n \"modification_time\": \"\",\n \"detection_time\": \"\",\n \"starred\": \"\",\n \"xdr_url\": \"\",\n \"rule_based_score\": \"\",\n \"manual_score\": \"\"\n }\n ]\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-8a1155a8-e2f1-40c1-b0e3-2de71bd44365" }, { "id": "b091cf3d-7b4d-4ed6-bed0-59a0122dd3ec", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incidents", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incidents" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-b091cf3d-7b4d-4ed6-bed0-59a0122dd3ec" }, { "id": "a5105cd2-620b-4ec7-8f02-babbda095b08", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incidents", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incidents" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-a5105cd2-620b-4ec7-8f02-babbda095b08" }, { "id": "bd7abfd7-1a6b-4ee8-b01f-b2f3c897426d", "name": "Insufficient permissions for the requested operation.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incidents", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incidents" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-bd7abfd7-1a6b-4ee8-b01f-b2f3c897426d" }, { "id": "08a2458d-bee3-4073-ad36-df315c0ed744", "name": "An internal server error occurred.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"lte\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incidents", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incidents" ] } }, "status": "Internal Server Error", "code": 500, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-08a2458d-bee3-4073-ad36-df315c0ed744" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-ad363491-92b1-48eb-b949-97f41e3ab2c1" } ], "id": "80a8ffec-d677-41fa-85da-9a69969fd63f", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-80a8ffec-d677-41fa-85da-9a69969fd63f" }, { "name": "get_incident_extra_data", "item": [ { "name": "Palo Alto Networks Get Incident Details", "id": "cc494496-24b4-4734-bcab-0dd5a4e5d9a2", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"alerts_limit\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incident_extra_data", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incident_extra_data" ] }, "description": "Returns detailed information about a specific incident including all associated alerts, network artifacts, file artifacts, and endpoint details." }, "response": [ { "id": "a83bf40d-7b91-4df4-8a72-f7a0010ebabf", "name": "Incident details returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"alerts_limit\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incident_extra_data", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incident_extra_data" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"incident\": {\n \"incident_id\": \"\",\n \"incident_name\": \"\",\n \"description\": \"\",\n \"status\": \"under_investigation\",\n \"severity\": \"low\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"alert_count\": \"\",\n \"low_severity_alert_count\": \"\",\n \"med_severity_alert_count\": \"\",\n \"high_severity_alert_count\": \"\",\n \"critical_severity_alert_count\": \"\",\n \"user_count\": \"\",\n \"host_count\": \"\",\n \"creation_time\": \"\",\n \"modification_time\": \"\",\n \"detection_time\": \"\",\n \"starred\": \"\",\n \"xdr_url\": \"\",\n \"rule_based_score\": \"\",\n \"manual_score\": \"\",\n \"network_artifacts\": {},\n \"file_artifacts\": {},\n \"hosts\": [\n \"\",\n \"\"\n ],\n \"users\": [\n \"\",\n \"\"\n ],\n \"incident_sources\": [\n \"\",\n \"\"\n ],\n \"mitre_tactics_ids_and_names\": [\n \"\",\n \"\"\n ],\n \"mitre_techniques_ids_and_names\": [\n \"\",\n \"\"\n ]\n },\n \"alerts\": {\n \"total_count\": \"\",\n \"data\": [\n {\n \"alert_id\": \"\",\n \"detection_timestamp\": \"\",\n \"name\": \"\",\n \"category\": \"\",\n \"description\": \"\",\n \"host_ip\": [\n \"\",\n \"\"\n ],\n \"host_name\": \"\",\n \"user_name\": \"\",\n \"mac\": [\n \"\",\n \"\"\n ],\n \"source\": \"\",\n \"action\": \"\",\n \"action_pretty\": \"\",\n \"severity\": \"low\",\n \"matching_status\": \"\",\n \"alert_type\": \"\",\n \"resolution_status\": \"\",\n \"resolution_comment\": \"\"\n },\n {\n \"alert_id\": \"\",\n \"detection_timestamp\": \"\",\n \"name\": \"\",\n \"category\": \"\",\n \"description\": \"\",\n \"host_ip\": [\n \"\",\n \"\"\n ],\n \"host_name\": \"\",\n \"user_name\": \"\",\n \"mac\": [\n \"\",\n \"\"\n ],\n \"source\": \"\",\n \"action\": \"\",\n \"action_pretty\": \"\",\n \"severity\": \"high\",\n \"matching_status\": \"\",\n \"alert_type\": \"\",\n \"resolution_status\": \"\",\n \"resolution_comment\": \"\"\n }\n ]\n },\n \"network_artifacts\": {},\n \"file_artifacts\": {}\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-a83bf40d-7b91-4df4-8a72-f7a0010ebabf" }, { "id": "c0a1bd00-4494-4c0e-83cc-e766d5f18dd8", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"alerts_limit\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incident_extra_data", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incident_extra_data" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-c0a1bd00-4494-4c0e-83cc-e766d5f18dd8" }, { "id": "c8d9fa23-f0e4-40bd-b4a9-8f2529ab528a", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"alerts_limit\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incident_extra_data", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incident_extra_data" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-c8d9fa23-f0e4-40bd-b4a9-8f2529ab528a" }, { "id": "21c5044e-7519-44d0-9aa8-15b4f44068cd", "name": "The requested resource was not found.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"alerts_limit\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/get_incident_extra_data", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "get_incident_extra_data" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-21c5044e-7519-44d0-9aa8-15b4f44068cd" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-cc494496-24b4-4734-bcab-0dd5a4e5d9a2" } ], "id": "6a0a91be-ebce-42ee-ad4d-cdbaa68eff81", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-6a0a91be-ebce-42ee-ad4d-cdbaa68eff81" }, { "name": "update_incident", "item": [ { "name": "Palo Alto Networks Update Incident", "id": "31756aca-b1b3-4450-a485-8874081c6f79", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"status\": \"resolved_threat_handled\",\n \"severity\": \"medium\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"resolve_comment\": \"\",\n \"add_comment\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/update_incident", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "update_incident" ] }, "description": "Updates the status, severity, assignee, or other mutable fields of a specific incident. Only the fields provided in the request body are modified." }, "response": [ { "id": "914ab62e-2339-42d9-826c-e0ee8f7910f5", "name": "Incident updated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"status\": \"resolved_threat_handled\",\n \"severity\": \"medium\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"resolve_comment\": \"\",\n \"add_comment\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/update_incident", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "update_incident" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": \"\"\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-914ab62e-2339-42d9-826c-e0ee8f7910f5" }, { "id": "7d41efc0-5f38-4a53-b477-21bae9f9ee61", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"status\": \"resolved_threat_handled\",\n \"severity\": \"medium\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"resolve_comment\": \"\",\n \"add_comment\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/update_incident", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "update_incident" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-7d41efc0-5f38-4a53-b477-21bae9f9ee61" }, { "id": "a766b8a3-3128-4e8f-94f6-8d282dbe3d6a", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"status\": \"resolved_threat_handled\",\n \"severity\": \"medium\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"resolve_comment\": \"\",\n \"add_comment\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/update_incident", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "update_incident" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-a766b8a3-3128-4e8f-94f6-8d282dbe3d6a" }, { "id": "8d985e69-ee5e-4952-bd3f-ed1e20ab3aab", "name": "The requested resource was not found.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"incident_id\": \"\",\n \"status\": \"resolved_threat_handled\",\n \"severity\": \"medium\",\n \"assigned_user_mail\": \"\",\n \"assigned_user_pretty_name\": \"\",\n \"resolve_comment\": \"\",\n \"add_comment\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/incidents/update_incident", "host": [ "{{baseUrl}}" ], "path": [ "incidents", "update_incident" ] } }, "status": "Not Found", "code": 404, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-8d985e69-ee5e-4952-bd3f-ed1e20ab3aab" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-31756aca-b1b3-4450-a485-8874081c6f79" } ], "id": "a11448cb-f8de-4ac2-85d5-a51c12ccbd38", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-a11448cb-f8de-4ac2-85d5-a51c12ccbd38" } ], "id": "68f65766-0c52-413a-91c4-c91498e6ed1c", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-68f65766-0c52-413a-91c4-c91498e6ed1c" }, { "name": "alerts", "item": [ { "name": "get_alerts", "item": [ { "name": "Palo Alto Networks Get Alerts", "id": "ea4f3160-ec02-404b-a0ec-cc324333e92b", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/alerts/get_alerts", "host": [ "{{baseUrl}}" ], "path": [ "alerts", "get_alerts" ] }, "description": "Returns alerts matching the specified filter criteria. Alerts represent individual detections from endpoint, network, or cloud data sources. Supports filtering by alert ID, severity, category, and timestamp." }, "response": [ { "id": "b1179f8f-1c4c-4b5b-a2b6-a348e79125fc", "name": "Alerts returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/alerts/get_alerts", "host": [ "{{baseUrl}}" ], "path": [ "alerts", "get_alerts" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"total_count\": \"\",\n \"result_count\": \"\",\n \"alerts\": [\n {\n \"alert_id\": \"\",\n \"detection_timestamp\": \"\",\n \"name\": \"\",\n \"category\": \"\",\n \"description\": \"\",\n \"host_ip\": [\n \"\",\n \"\"\n ],\n \"host_name\": \"\",\n \"user_name\": \"\",\n \"mac\": [\n \"\",\n \"\"\n ],\n \"source\": \"\",\n \"action\": \"\",\n \"action_pretty\": \"\",\n \"severity\": \"low\",\n \"matching_status\": \"\",\n \"alert_type\": \"\",\n \"resolution_status\": \"\",\n \"resolution_comment\": \"\"\n },\n {\n \"alert_id\": \"\",\n \"detection_timestamp\": \"\",\n \"name\": \"\",\n \"category\": \"\",\n \"description\": \"\",\n \"host_ip\": [\n \"\",\n \"\"\n ],\n \"host_name\": \"\",\n \"user_name\": \"\",\n \"mac\": [\n \"\",\n \"\"\n ],\n \"source\": \"\",\n \"action\": \"\",\n \"action_pretty\": \"\",\n \"severity\": \"unknown\",\n \"matching_status\": \"\",\n \"alert_type\": \"\",\n \"resolution_status\": \"\",\n \"resolution_comment\": \"\"\n }\n ]\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-b1179f8f-1c4c-4b5b-a2b6-a348e79125fc" }, { "id": "2e9cf1f7-1c7e-4a7b-b484-3cbd821ec538", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/alerts/get_alerts", "host": [ "{{baseUrl}}" ], "path": [ "alerts", "get_alerts" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-2e9cf1f7-1c7e-4a7b-b484-3cbd821ec538" }, { "id": "1a90f83e-7670-4acd-9df6-ca19a2f00d4c", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/alerts/get_alerts", "host": [ "{{baseUrl}}" ], "path": [ "alerts", "get_alerts" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-1a90f83e-7670-4acd-9df6-ca19a2f00d4c" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-ea4f3160-ec02-404b-a0ec-cc324333e92b" } ], "id": "3b522ae8-3443-4cd8-9ec1-28075c1efd73", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-3b522ae8-3443-4cd8-9ec1-28075c1efd73" } ], "id": "0ad78009-2f2d-4636-82e9-924723dcedf4", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-0ad78009-2f2d-4636-82e9-924723dcedf4" }, { "name": "endpoints", "item": [ { "name": "get_endpoints", "item": [ { "name": "Palo Alto Networks List Endpoints", "id": "170f4bc2-7957-41fe-b778-f8bfd36aff4e", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/get_endpoints", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "get_endpoints" ] }, "description": "Returns a list of endpoints enrolled in Cortex XDR. Supports filtering by endpoint ID, hostname, IP address, operating system, and protection status." }, "response": [ { "id": "9caf7378-67fd-4cc2-a863-b1d3f4cf06cc", "name": "Endpoints returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/get_endpoints", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "get_endpoints" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"total_count\": \"\",\n \"result_count\": \"\",\n \"endpoints\": [\n {\n \"endpoint_id\": \"\",\n \"endpoint_name\": \"\",\n \"endpoint_type\": \"WORKSTATION\",\n \"endpoint_status\": \"CONNECTED\",\n \"os_type\": \"AGENT_OS_MAC\",\n \"ip\": [\n \"\",\n \"\"\n ],\n \"users\": [\n \"\",\n \"\"\n ],\n \"domain\": \"\",\n \"alias\": \"\",\n \"first_seen\": \"\",\n \"last_seen\": \"\",\n \"content_version\": \"\",\n \"installation_package\": \"\",\n \"active_directory\": \"\",\n \"install_date\": \"\",\n \"endpoint_version\": \"\",\n \"is_isolated\": \"PENDING_ISOLATION\",\n \"isolation_reason\": \"\",\n \"scan_status\": \"SCAN_STATUS_DONE\",\n \"group_name\": [\n \"\",\n \"\"\n ]\n },\n {\n \"endpoint_id\": \"\",\n \"endpoint_name\": \"\",\n \"endpoint_type\": \"LAPTOP\",\n \"endpoint_status\": \"UNINSTALLED\",\n \"os_type\": \"AGENT_OS_MAC\",\n \"ip\": [\n \"\",\n \"\"\n ],\n \"users\": [\n \"\",\n \"\"\n ],\n \"domain\": \"\",\n \"alias\": \"\",\n \"first_seen\": \"\",\n \"last_seen\": \"\",\n \"content_version\": \"\",\n \"installation_package\": \"\",\n \"active_directory\": \"\",\n \"install_date\": \"\",\n \"endpoint_version\": \"\",\n \"is_isolated\": \"PENDING_ISOLATION\",\n \"isolation_reason\": \"\",\n \"scan_status\": \"SCAN_STATUS_DONE\",\n \"group_name\": [\n \"\",\n \"\"\n ]\n }\n ]\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-9caf7378-67fd-4cc2-a863-b1d3f4cf06cc" }, { "id": "c0c3eb39-2a6b-428b-ab52-2704c8a5edcf", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/get_endpoints", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "get_endpoints" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-c0c3eb39-2a6b-428b-ab52-2704c8a5edcf" }, { "id": "714ace67-7146-4efd-9073-59b812a0359c", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/get_endpoints", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "get_endpoints" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-714ace67-7146-4efd-9073-59b812a0359c" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-170f4bc2-7957-41fe-b778-f8bfd36aff4e" } ], "id": "ca8d710a-f8d5-4de0-9187-cbee8feedf26", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-ca8d710a-f8d5-4de0-9187-cbee8feedf26" }, { "name": "isolate", "item": [ { "name": "Palo Alto Networks Isolate Endpoints", "id": "da954a75-63e5-4426-b437-b49c3c566f44", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/isolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "isolate" ] }, "description": "Isolates one or more endpoints from the network, preventing all inbound and outbound communications except to the Cortex XDR service. Use endpoint IDs, IP addresses, or hostnames to identify targets." }, "response": [ { "id": "f6dfbcdb-6a6c-4f92-858a-380b5995e289", "name": "Endpoint isolation initiated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/isolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "isolate" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"action_id\": \"\",\n \"status\": \"\",\n \"endpoints_count\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-f6dfbcdb-6a6c-4f92-858a-380b5995e289" }, { "id": "31017a57-2ea9-4083-a72e-fc4310956fd3", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/isolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "isolate" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-31017a57-2ea9-4083-a72e-fc4310956fd3" }, { "id": "bd71c337-d395-44e9-90db-2f3b3d9abc50", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/isolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "isolate" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-bd71c337-d395-44e9-90db-2f3b3d9abc50" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-da954a75-63e5-4426-b437-b49c3c566f44" } ], "id": "72a0eeba-881a-49cd-a53b-33b1b2411a1c", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-72a0eeba-881a-49cd-a53b-33b1b2411a1c" }, { "name": "unisolate", "item": [ { "name": "Palo Alto Networks Unisolate Endpoints", "id": "9b6b9056-ee6a-4141-ac12-07e9d34d3541", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/unisolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "unisolate" ] }, "description": "Removes network isolation from one or more endpoints, restoring full network connectivity. Use this endpoint after an investigation is complete and the threat has been remediated." }, "response": [ { "id": "71660eb9-f29e-4e36-bb3e-a8d46717790d", "name": "Endpoint unisolation initiated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/unisolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "unisolate" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"action_id\": \"\",\n \"status\": \"\",\n \"endpoints_count\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-71660eb9-f29e-4e36-bb3e-a8d46717790d" }, { "id": "6638de71-9925-4fcf-9342-629f5a76d6a8", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/unisolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "unisolate" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-6638de71-9925-4fcf-9342-629f5a76d6a8" }, { "id": "81be9481-363b-4ace-bb9e-000ea1b6da34", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id\": \"\",\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/unisolate", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "unisolate" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-81be9481-363b-4ace-bb9e-000ea1b6da34" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-9b6b9056-ee6a-4141-ac12-07e9d34d3541" } ], "id": "c1641f3e-4ea4-42aa-acfe-490b9a425b66", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-c1641f3e-4ea4-42aa-acfe-490b9a425b66" }, { "name": "scan", "item": [ { "name": "Palo Alto Networks Scan Endpoints", "id": "28fc6621-6c90-4c12-b2eb-97ea72ecef13", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"neq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/scan", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "scan" ] }, "description": "Initiates a malware scan on one or more endpoints. The scan runs the Cortex XDR agent's local analysis engine to detect and quarantine malicious files." }, "response": [ { "id": "3846ca5a-20bd-46d6-9258-90bbc299e46f", "name": "Endpoint scan initiated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"neq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/scan", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "scan" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"action_id\": \"\",\n \"status\": \"\",\n \"endpoints_count\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-3846ca5a-20bd-46d6-9258-90bbc299e46f" }, { "id": "17851db0-e071-4bdb-9a95-481136940d88", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"neq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/scan", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "scan" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-17851db0-e071-4bdb-9a95-481136940d88" }, { "id": "6e1ee263-5e1c-4ff4-8c69-0ec54beca2fb", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"endpoint_id_list\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"neq\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"eq\",\n \"value\": \"\"\n }\n ]\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/endpoints/scan", "host": [ "{{baseUrl}}" ], "path": [ "endpoints", "scan" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-6e1ee263-5e1c-4ff4-8c69-0ec54beca2fb" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-28fc6621-6c90-4c12-b2eb-97ea72ecef13" } ], "id": "c3827669-24cf-4f9d-ab87-4c3e1ed7ee71", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-c3827669-24cf-4f9d-ab87-4c3e1ed7ee71" } ], "id": "7245beec-9f6d-4e92-886a-40144a3214a7", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-7245beec-9f6d-4e92-886a-40144a3214a7" }, { "name": "scripts", "item": [ { "name": "run_script", "item": [ { "name": "Palo Alto Networks Execute Script on Endpoints", "id": "57b47ba6-bf82-4e19-9b0c-fa8b20233eba", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"script_uid\": \"\",\n \"endpoint_ids\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"in\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ],\n \"parameters_values\": {\n \"cillum5be\": true\n },\n \"timeout\": 600\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/run_script", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "run_script" ] }, "description": "Executes a script from the script library on one or more endpoints. Scripts can perform remediation actions, collect forensic data, or run custom commands. Returns an action ID for polling execution status." }, "response": [ { "id": "b0b014a3-2ec0-4a2d-a8f6-c41c3fb94612", "name": "Script execution initiated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"script_uid\": \"\",\n \"endpoint_ids\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"in\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ],\n \"parameters_values\": {\n \"cillum5be\": true\n },\n \"timeout\": 600\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/run_script", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "run_script" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"action_id\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-b0b014a3-2ec0-4a2d-a8f6-c41c3fb94612" }, { "id": "7aa509bd-82e3-49cc-beb1-183b9d9f2fcd", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"script_uid\": \"\",\n \"endpoint_ids\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"in\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ],\n \"parameters_values\": {\n \"cillum5be\": true\n },\n \"timeout\": 600\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/run_script", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "run_script" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-7aa509bd-82e3-49cc-beb1-183b9d9f2fcd" }, { "id": "4b59e227-0692-4427-84a2-ba558012a1a9", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"script_uid\": \"\",\n \"endpoint_ids\": [\n \"\",\n \"\"\n ],\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"in\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n }\n ],\n \"parameters_values\": {\n \"cillum5be\": true\n },\n \"timeout\": 600\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/run_script", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "run_script" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-4b59e227-0692-4427-84a2-ba558012a1a9" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-57b47ba6-bf82-4e19-9b0c-fa8b20233eba" } ], "id": "e51b11e7-373c-44ed-afba-6a6fbf06b308", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-e51b11e7-373c-44ed-afba-6a6fbf06b308" }, { "name": "get_script_execution_results", "item": [ { "name": "Palo Alto Networks Get Script Execution Results", "id": "4000aee2-fba6-4acc-b55c-64bcdc8a4c0f", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"action_id\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/get_script_execution_results", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "get_script_execution_results" ] }, "description": "Retrieves the execution results and output for a previously initiated script run identified by the action ID." }, "response": [ { "id": "a380c723-f3e8-4303-9a9f-8f547a01f7fb", "name": "Script execution results returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"action_id\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/get_script_execution_results", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "get_script_execution_results" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"action_id\": \"\",\n \"status\": \"PENDING\",\n \"results\": [\n {\n \"endpoint_id\": \"\",\n \"endpoint_name\": \"\",\n \"endpoint_status\": \"\",\n \"domain\": \"\",\n \"ip_address\": \"\",\n \"is_isolated\": \"\",\n \"standard_output\": \"\",\n \"standard_error\": \"\",\n \"retrieved_files\": \"\",\n \"return_value\": \"\"\n },\n {\n \"endpoint_id\": \"\",\n \"endpoint_name\": \"\",\n \"endpoint_status\": \"\",\n \"domain\": \"\",\n \"ip_address\": \"\",\n \"is_isolated\": \"\",\n \"standard_output\": \"\",\n \"standard_error\": \"\",\n \"retrieved_files\": \"\",\n \"return_value\": \"\"\n }\n ]\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-a380c723-f3e8-4303-9a9f-8f547a01f7fb" }, { "id": "b3413746-d4fe-46e9-bdf9-b0f1cdfff722", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"action_id\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/get_script_execution_results", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "get_script_execution_results" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-b3413746-d4fe-46e9-bdf9-b0f1cdfff722" }, { "id": "8096b0f3-d8fd-44aa-8c43-3d027574b9fe", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"action_id\": \"\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/scripts/get_script_execution_results", "host": [ "{{baseUrl}}" ], "path": [ "scripts", "get_script_execution_results" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-8096b0f3-d8fd-44aa-8c43-3d027574b9fe" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-4000aee2-fba6-4acc-b55c-64bcdc8a4c0f" } ], "id": "de0631f4-ced2-4b1d-8698-34816d5ab4dd", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-de0631f4-ced2-4b1d-8698-34816d5ab4dd" } ], "id": "2167e5db-21ba-450a-aaad-d83694cb20cf", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-2167e5db-21ba-450a-aaad-d83694cb20cf" }, { "name": "xql", "item": [ { "name": "start_xql_query", "item": [ { "name": "Palo Alto Networks Execute XQL Query", "id": "fa910a4e-8f05-46ee-8e31-623261247c0d", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query\": \"\",\n \"timeframe\": {\n \"relativeTime\": \"\",\n \"startTime\": \"\",\n \"endTime\": \"\"\n },\n \"max_results\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/start_xql_query", "host": [ "{{baseUrl}}" ], "path": [ "xql", "start_xql_query" ] }, "description": "Initiates an XQL (Extended Query Language) query against the Cortex XDR data lake. XQL is a domain-specific language for querying endpoint, network, and cloud telemetry data. Returns a query ID for retrieving results asynchronously." }, "response": [ { "id": "2907b64a-1d53-4e95-a88d-36bf97f3d243", "name": "XQL query initiated successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query\": \"\",\n \"timeframe\": {\n \"relativeTime\": \"\",\n \"startTime\": \"\",\n \"endTime\": \"\"\n },\n \"max_results\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/start_xql_query", "host": [ "{{baseUrl}}" ], "path": [ "xql", "start_xql_query" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": \"\"\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-2907b64a-1d53-4e95-a88d-36bf97f3d243" }, { "id": "715dcc62-544d-421a-842d-d239d6fe2c00", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query\": \"\",\n \"timeframe\": {\n \"relativeTime\": \"\",\n \"startTime\": \"\",\n \"endTime\": \"\"\n },\n \"max_results\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/start_xql_query", "host": [ "{{baseUrl}}" ], "path": [ "xql", "start_xql_query" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-715dcc62-544d-421a-842d-d239d6fe2c00" }, { "id": "7f80ead1-8870-4fb4-a35b-25d94f2a3fc1", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query\": \"\",\n \"timeframe\": {\n \"relativeTime\": \"\",\n \"startTime\": \"\",\n \"endTime\": \"\"\n },\n \"max_results\": 1000\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/start_xql_query", "host": [ "{{baseUrl}}" ], "path": [ "xql", "start_xql_query" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-7f80ead1-8870-4fb4-a35b-25d94f2a3fc1" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-fa910a4e-8f05-46ee-8e31-623261247c0d" } ], "id": "55d384ac-58ab-4d29-a388-9fa90141d79d", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-55d384ac-58ab-4d29-a388-9fa90141d79d" }, { "name": "get_query_results", "item": [ { "name": "Palo Alto Networks Get XQL Query Results", "id": "4f193e19-4251-4ae2-8714-2b41328376f4", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query_id\": \"\",\n \"pending_duration\": 0,\n \"max_results\": 1000,\n \"format\": \"json_simple\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/get_query_results", "host": [ "{{baseUrl}}" ], "path": [ "xql", "get_query_results" ] }, "description": "Retrieves the results of an XQL query previously initiated via the start_xql_query endpoint. Poll this endpoint until the status is SUCCESS or FAILED." }, "response": [ { "id": "4c7308fa-953e-405e-bd9a-b043b242747a", "name": "XQL query results returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query_id\": \"\",\n \"pending_duration\": 0,\n \"max_results\": 1000,\n \"format\": \"json_simple\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/get_query_results", "host": [ "{{baseUrl}}" ], "path": [ "xql", "get_query_results" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"status\": \"CANCELED\",\n \"number_of_results\": \"\",\n \"query_cost\": {\n \"mollitc81\": \"\",\n \"ullamco2\": \"\",\n \"eiusmodd2\": \"\"\n },\n \"remaining_quota\": \"\",\n \"results\": {\n \"data\": [\n {\n \"in2\": \"occaecat esse\",\n \"do_\": \"aliqui\",\n \"nostrud0_8\": \"cillum minim id\"\n },\n {\n \"enim7c\": -82997859.8867029\n }\n ]\n }\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-4c7308fa-953e-405e-bd9a-b043b242747a" }, { "id": "064b9d69-9943-490a-80dc-9a67c50acd27", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query_id\": \"\",\n \"pending_duration\": 0,\n \"max_results\": 1000,\n \"format\": \"json_simple\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/get_query_results", "host": [ "{{baseUrl}}" ], "path": [ "xql", "get_query_results" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-064b9d69-9943-490a-80dc-9a67c50acd27" }, { "id": "4824ddbe-2718-4952-8e47-8d227f278462", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"query_id\": \"\",\n \"pending_duration\": 0,\n \"max_results\": 1000,\n \"format\": \"json_simple\"\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/xql/get_query_results", "host": [ "{{baseUrl}}" ], "path": [ "xql", "get_query_results" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-4824ddbe-2718-4952-8e47-8d227f278462" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-4f193e19-4251-4ae2-8714-2b41328376f4" } ], "id": "47ae117c-14e6-42f1-a39a-3263a2b700d3", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-47ae117c-14e6-42f1-a39a-3263a2b700d3" } ], "id": "ffdb7cde-2c2a-4f45-8f8c-9cea73b78267", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-ffdb7cde-2c2a-4f45-8f8c-9cea73b78267" }, { "name": "audit", "item": [ { "name": "get_audit_management_logs", "item": [ { "name": "Palo Alto Networks Get Audit Management Logs", "id": "72197146-2cff-4673-acce-c6281b5d8531", "protocolProfileBehavior": { "disableBodyPruning": true }, "request": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/audit/get_audit_management_logs", "host": [ "{{baseUrl}}" ], "path": [ "audit", "get_audit_management_logs" ] }, "description": "Retrieves audit management logs recording administrative actions performed in the Cortex XDR console. Includes user logins, policy changes, and configuration modifications." }, "response": [ { "id": "58989a02-9df8-404c-8829-7c89bb8e4e18", "name": "Audit management logs returned successfully.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/audit/get_audit_management_logs", "host": [ "{{baseUrl}}" ], "path": [ "audit", "get_audit_management_logs" ] } }, "status": "OK", "code": 200, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"total_count\": \"\",\n \"result_count\": \"\",\n \"data\": [\n {\n \"timestamp\": \"\",\n \"actor_primary_username\": \"\",\n \"actor_email\": \"\",\n \"actor_type\": \"API\",\n \"sub_type\": \"\",\n \"result\": \"FAIL\",\n \"reason\": \"\",\n \"ip\": \"\",\n \"description\": \"\"\n },\n {\n \"timestamp\": \"\",\n \"actor_primary_username\": \"\",\n \"actor_email\": \"\",\n \"actor_type\": \"API\",\n \"sub_type\": \"\",\n \"result\": \"SUCCESS\",\n \"reason\": \"\",\n \"ip\": \"\",\n \"description\": \"\"\n }\n ]\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-58989a02-9df8-404c-8829-7c89bb8e4e18" }, { "id": "74310120-15e7-4048-a909-97662de706c9", "name": "Malformed request body or invalid parameters.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/audit/get_audit_management_logs", "host": [ "{{baseUrl}}" ], "path": [ "audit", "get_audit_management_logs" ] } }, "status": "Bad Request", "code": 400, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-74310120-15e7-4048-a909-97662de706c9" }, { "id": "fc7723a0-2d1f-434a-bc84-cd7fea8c2cd9", "name": "Missing or invalid authentication headers.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/audit/get_audit_management_logs", "host": [ "{{baseUrl}}" ], "path": [ "audit", "get_audit_management_logs" ] } }, "status": "Unauthorized", "code": 401, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-fc7723a0-2d1f-434a-bc84-cd7fea8c2cd9" }, { "id": "ad4a6bb3-5bac-46c1-98bf-27e400b8a86d", "name": "Insufficient permissions for the requested operation.", "originalRequest": { "method": "POST", "header": [ { "key": "Content-Type", "value": "application/json" }, { "key": "Accept", "value": "application/json" }, { "description": "Added as a part of security scheme: apikey", "key": "x-xdr-hmac-v2", "value": "" } ], "body": { "mode": "raw", "raw": "{\n \"request_data\": {\n \"filters\": [\n {\n \"field\": \"\",\n \"operator\": \"gte\",\n \"value\": \"\"\n },\n {\n \"field\": \"\",\n \"operator\": \"contains\",\n \"value\": \"\"\n }\n ],\n \"search_from\": 0,\n \"search_to\": 100,\n \"sort\": {\n \"field\": \"\",\n \"keyword\": \"desc\"\n }\n }\n}", "options": { "raw": { "headerFamily": "json", "language": "json" } } }, "url": { "raw": "{{baseUrl}}/audit/get_audit_management_logs", "host": [ "{{baseUrl}}" ], "path": [ "audit", "get_audit_management_logs" ] } }, "status": "Forbidden", "code": 403, "_postman_previewlanguage": "json", "header": [ { "key": "Content-Type", "value": "application/json" } ], "cookie": [], "responseTime": null, "body": "{\n \"reply\": {\n \"err_code\": \"\",\n \"err_msg\": \"\",\n \"err_extra\": \"\"\n }\n}", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-ad4a6bb3-5bac-46c1-98bf-27e400b8a86d" } ], "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-72197146-2cff-4673-acce-c6281b5d8531" } ], "id": "828fa967-06f7-440c-9af5-1f7bccd5c644", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-828fa967-06f7-440c-9af5-1f7bccd5c644" } ], "id": "abd79718-7765-4f0e-84a7-cc804e386390", "createdAt": "2026-06-05T13:18:53.000Z", "updatedAt": "2026-06-05T13:18:53.000Z", "uid": "35240-abd79718-7765-4f0e-84a7-cc804e386390" } ], "auth": { "type": "apikey", "apikey": [ { "key": "key", "value": "x-xdr-hmac-v2", "type": "string" }, { "key": "value", "value": "{{apiKey}}", "type": "string" }, { "key": "in", "value": "header", "type": "string" } ] }, "variable": [ { "key": "fqdn", "value": "example.xdr.us.paloaltonetworks.com" }, { "key": "baseUrl", "value": "https://api-{{fqdn}}/public_api/v1" } ] }