{ "openapi": "3.1.0", "x-hideTryItPanel": true, "info": { "title": "Vulnerability Management APIs", "version": "Cortex Cloud", "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" }, "description": "Managing vulnerabilities effectively is crucial to proactively maintaining the security, integrity, and availability of IT infrastructure. Cortex Cloud provides a comprehensive vulnerability management platform, helping you identify, assess, prioritize, and remediate security vulnerabilities across your entire IT infrastructure including endpoints, code, and cloud.\n\nThis API covers two capability areas:\n\n- **Vulnerability Management Policies** — create, read, update, and delete vulnerability management policies; trigger on-demand scans.\n- **Vulnerability Findings** — query per-asset CVE finding records (paginated or by ID) and perform bulk snapshot exports via XQL.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management." }, "servers": [ { "url": "https://{fqdn}", "description": "Tenant-specific API base URL", "variables": { "fqdn": { "description": "Tenant FQDN, e.g. `api-`", "default": "api-yourfqdn" } } } ], "security": [ { "ApiKeyAuth": [], "ApiKeyNonce": [] } ], "tags": [ { "name": "Vulnerability Management", "description": "Public APIs for vulnerability policy management" }, { "name": "Vulnerability Findings", "description": "vulnerability finding records (paginated or by ID)" }, { "name": "Vulnerability Findings Snapshot", "description": "Bulk export of vulnerability findings" }, { "name": "Bring Your Own Scanner", "description": "Import vulnerability findings from external scanners into Cortex vulnerability management. Use these endpoints to submit asset and CVE data from third-party scanners and to poll the status of async import jobs." } ], "paths": { "/public_api/uvm_public/v1/list_policies": { "post": { "summary": "Get Policies List", "description": "Retrieve a paginated list of vulnerability management policies with optional filtering and sorting capabilities. This endpoint allows you to search through policies based on various criteria such as name, status, priority, and other attributes.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Management" ], "operationId": "get_policies_list_public_api_uvm_public_v1_list_policies_post", "parameters": [ { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "default": "", "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } } ], "requestBody": { "description": "Request payload containing filter, sort, and pagination options for listing policies", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetDataRequest" } } }, "required": true }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetDataResponse" } } } }, "422": { "description": "Validation Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/public_api/uvm_public/v1/create_policy": { "post": { "summary": "Create Policy Public", "description": "Create a new vulnerability management policy for issue creation, kubernetes runtime protection, or prevention actions.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Management" ], "operationId": "create_policy_public_public_api_uvm_public_v1_create_policy_post", "parameters": [ { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "default": "", "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } } ], "requestBody": { "description": "Request payload containing the policy configuration to create", "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatePolicy" } } } }, "responses": { "201": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatePolicyResponse" } } } }, "422": { "description": "Validation Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/public_api/uvm_public/v1/update_policy/{id}": { "put": { "summary": "Update Policy", "description": "Update an existing vulnerability management policy by providing its unique identifier.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Management" ], "operationId": "update_policy_public_api_uvm_public_v1_update_policy__id__put", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid", "title": "Id" } }, { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "default": "", "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } } ], "requestBody": { "description": "Request payload containing the updated policy configuration", "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatePolicy" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreatePolicyResponse" } } } }, "422": { "description": "Validation Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/public_api/uvm_public/v1/get_policy/{id}": { "get": { "summary": "Get Policy By ID", "description": "Retrieve a specific vulnerability management policy by its unique identifier.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Management" ], "operationId": "get_policy_by_id_public_api_uvm_public_v1_get_policy__id__get", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid", "title": "Id" } }, { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "default": "", "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } } ], "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PolicyView" } } } }, "422": { "description": "Validation Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/public_api/uvm_public/v1/delete_policy/{id}": { "delete": { "summary": "Delete Policy", "tags": [ "Vulnerability Management" ], "description": "Delete an existing vulnerability management policy using a policy ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "delete_policy_public_api_uvm_public_v1_delete_policy__id__delete", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid", "title": "Id" } }, { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "default": "", "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } } ], "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "type": "boolean", "title": "Response Delete Policy Public Api Uvm Public V1 Delete Policy Id Delete" } } } }, "422": { "description": "Validation Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/public_api/vulnerability-management/v1/scan": { "post": { "summary": "Trigger Scan for an AssetId", "description": "Trigger On demand Scan based on AssetId on one of CORTEX_NETWORK_SCANNER, CORTEX_XDR_AGENT, CORTEX_XDR_AGENTLESS scanners.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Management" ], "operationId": "trigger_scan_public_api_vulnerability_management_v1_scan_post", "parameters": [ { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } } ], "requestBody": { "description": "Request payload containing the asset ID and scanner type for triggering a scan", "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScanRequest" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScanResponse" } } } }, "422": { "description": "Validation Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/public_api/vulnerability-management/v1/external-scans/assets": { "post": { "summary": "Submit assets and vulnerabilities from an external scanner", "description": "Imports asset and vulnerability data from a third-party scanner into Cortex vulnerability management.\n\nEach request must include at least one asset. Each asset can carry multiple CVE findings. The platform validates all input on receipt — if validation fails, a `422 Unprocessable Entity` response is returned with field-level error details.\n\nSuccessful requests are processed asynchronously. The response includes a `job_id` that can be polled using the [Get BYOS import job status](#operation/getByosImportJobStatus) endpoint, plus counts of accepted assets and vulnerabilities.\n\n**RBAC permission required:** `manage_vulnerabilities_action`\n\n**Required licenses:** Exposure Management; and either Cortex Cloud Runtime Security or Cortex Cloud Posture Management.\n\nWithin a single asset, each vulnerability_id must be unique. If duplicate vulnerability_id values are submitted for the same asset, the API returns 422 Unprocessable Entity with an error describing the duplicate.\n\n**Viewing imported findings:** After successful import, findings appear in the Cortex Cloud vulnerability management console under Vulnerability Findings, filtered by finding_sources = Third Party Scanner. The number of findings shown may be lower than the vulnerabilities_count returned by the import response, because the platform deduplicates findings by asset and CVE ID.\n\n**Rate limits:**\n- Maximum 10 requests per hour to this endpoint.\n- Maximum 10 jobs in PROCESSING state in any given hour. Additional submissions are rejected until active jobs complete.", "tags": [ "Bring Your Own Scanner" ], "operationId": "importVulnerableAssets", "parameters": [ { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "default": "", "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } } ], "requestBody": { "description": "Request payload containing scanner metadata and the list of assets with their vulnerability findings.", "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VulnerableAssetImportRequest" } } } }, "responses": { "201": { "description": "Assets accepted for asynchronous processing. The response includes import counts and the `job_id` for status polling.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VulnerableAssetImportResponse" } } } }, "422": { "description": "Validation Error — one or more request fields failed schema validation. Check the `detail` array for field-level error messages.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/public_api/vulnerability-management/v1/external-scans/assets/jobs/{job_id}": { "get": { "summary": "Poll the status of a BYOS import job", "description": "Returns the current status of an asynchronous BYOS import job.\n\nAfter submitting assets via the [Submit assets and vulnerabilities from an external scanner](#operation/importVulnerableAssets) endpoint, use the returned `job_id` to poll this endpoint until the job reaches a terminal state (`COMPLETED`, `FAILED`, or `COMPLETED_WITH_ERRORS`).\n\nPossible `job_status` values:\n- `INITIATED` — job received, not yet queued\n- `PROCESSING` — job is actively being processed\n- `COMPLETED` — all assets imported successfully\n- `COMPLETED_WITH_ERRORS` — import finished but some assets failed; check `error_log`\n- `FAILED` — job failed entirely; check `error_log` for details\n\n**Response codes:**\n- `200` — Job status retrieved successfully. The HTTP status reflects only the poll request itself; the *job's* outcome is in `job_status` (including the terminal `FAILED` and `COMPLETED_WITH_ERRORS` states).\n- `404` — `job_id` was not found.\n\n`422 Unprocessable Entity` is only returned by the upstream [Submit assets and vulnerabilities from an external scanner](#operation/importVulnerableAssets) endpoint when the request payload fails schema validation. A `422` therefore means the job was never created; a `FAILED` `job_status` returned in a `200` response means the job ran but could not complete — see `error_log` for details.\n\n**RBAC permission required:** `manage_vulnerabilities_action`\n\n**Required licenses:** Exposure Management; and either Cortex Cloud Runtime Security or Cortex Cloud Posture Management.\n\n**SLA timeout:** Jobs in PROCESSING state have a 24-hour SLA. After 24 hours, any job still in PROCESSING is guaranteed to transition to COMPLETED_WITH_ERRORS, which is a terminal state.\n\n**Rate limits:** Maximum 10 requests per minute.", "tags": [ "Bring Your Own Scanner" ], "operationId": "getByosImportJobStatus", "parameters": [ { "name": "x-xdr-auth-id", "in": "header", "required": true, "schema": { "anyOf": [ { "type": "integer" }, { "type": "string" } ], "default": "", "title": "X-Xdr-Auth-Id" } }, { "name": "Authorization", "in": "header", "required": true, "schema": { "type": "string", "default": "", "title": "Authorization" } }, { "name": "job_id", "in": "path", "required": true, "description": "The unique identifier of the BYOS import job, returned by the [Submit assets and vulnerabilities from an external scanner](#operation/importVulnerableAssets) endpoint.", "schema": { "type": "string", "title": "Job ID" } } ], "responses": { "200": { "description": "Job status retrieved successfully.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImportJobResponse" } } } }, "404": { "description": "Job not found — the specified `job_id` does not exist.", "content": { "application/json": { "schema": { "type": "object", "properties": { "detail": { "type": "string", "example": "Job with id 'a2b1aba2-37fe-4fb4-ba6d-829e8cf5d653' not found" } } } } } }, "422": { "description": "Validation Error — the `job_id` path parameter failed schema validation.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/HTTPValidationError" } } } } } } }, "/vulnerability-management/v1/vulnerability-finding/search": { "post": { "operationId": "getVulnerabilityFindings", "summary": "List vulnerability findings (paginated)", "description": "Returns paginated vulnerability findings — one record per CVE/asset pair.\nUse `next_page_token` from the response to fetch subsequent pages.\n\n**Pagination:** Control the number of records per page with the optional `page_size` field (default `1000`, maximum `10000`).\n\n**Rate limit:** Up to 1,000 requests per 24-hour rolling window. Exceeding this limit returns HTTP `429`.\n\n**Supported filter fields and filter types:**\n\nEach filter clause is an object with `SEARCH_FIELD`, `SEARCH_TYPE`, and `SEARCH_VALUE`. The `SEARCH_TYPE` values supported per field depend on the field's data type:\n\n| Filter field (`SEARCH_FIELD`) | Data type | Supported filter types (`SEARCH_TYPE`) |\n| --- | --- | --- |\n| `ASSET_NAME` | string | `EQ`, `NEQ`, `IN`, `NIN`, `CONTAINS`, `NCONTAINS`, `WILDCARD`, `WILDCARD_NOT` |\n| `ASSET_GROUP_IDS` | ID array | `ARRAY_OVERLAPS` |\n| `ASSET_CATEGORY` | string | `EQ`, `NEQ`, `IN`, `NIN` |\n| `CVE_ID` | string | `EQ`, `NEQ`, `IN`, `NIN`, `CONTAINS` |\n| `CVSS_SEVERITY` | enum string | `EQ`, `NEQ`, `IN`, `NIN` |\n| `PLATFORM_ID` | string | `EQ`, `NEQ`, `IN`, `NIN` |\n| `FIX_AVAILABLE` | boolean | `EQ` |\n| `PACKAGE_IN_USE` | boolean | `EQ` |\n| `HAS_KEV` | boolean | `EQ` |\n| `EXPLOIT_LEVEL` | enum string | `EQ`, `NEQ`, `IN`, `NIN` |\n| `EPSS_SCORE` | number (0–1) | `EQ`, `GT`, `GTE`, `LT`, `LTE`, `RANGE` |\n| `INTERNET_EXPOSED` | boolean | `EQ` |\n| `FIRST_OBSERVED` | timestamp (ms) | `GT`, `GTE`, `LT`, `LTE`, `RANGE`, `RELATIVE_TIMESTAMP` |\n| `LAST_OBSERVED` | timestamp (ms) | `GT`, `GTE`, `LT`, `LTE`, `RANGE`, `RELATIVE_TIMESTAMP` |\n\n**Sortable fields:** `EPSS_SCORE`, `CVSS_SCORE`, `CORTEX_VULNERABILITY_RISK_SCORE`.\n\n**Filter value reference:**\n\nWhen filtering on `CVSS_SEVERITY` or `EXPLOIT_LEVEL` with `SEARCH_TYPE` `EQ`, use the following `SEARCH_VALUE` values:\n\n- `CVSS_SEVERITY`: `SEV_070_CRITICAL`, `SEV_060_HIGH`, `SEV_050_MEDIUM`, `SEV_040_LOW`\n- `EXPLOIT_LEVEL`: `WEAPONIZED`, `POC`, `NONE`\n\n**Filtering on `ASSET_GROUP_IDS`:**\n\n`ASSET_GROUP_IDS` is an array field, so it only supports the `ARRAY_OVERLAPS` filter type. Supply `SEARCH_VALUE` as a list of numeric asset-group IDs; the clause matches a finding when the asset belongs to any of the listed groups. To match findings that do **not** belong to any of the listed groups, wrap the clause in a `NOT` block instead of an `AND` block.\n\nExample (match any of the groups):\n\n```json\n{ \"filter\": { \"AND\": [ { \"SEARCH_FIELD\": \"ASSET_GROUP_IDS\", \"SEARCH_TYPE\": \"ARRAY_OVERLAPS\", \"SEARCH_VALUE\": [1, 2, 3] } ] } }\n```\n\nExample (exclude the groups):\n\n```json\n{ \"filter\": { \"NOT\": { \"SEARCH_FIELD\": \"ASSET_GROUP_IDS\", \"SEARCH_TYPE\": \"ARRAY_OVERLAPS\", \"SEARCH_VALUE\": [1, 2, 3] } } }\n```\n\nNote: Response payloads return normalized severity strings (for example, `HIGH` or `LOW`) that are not valid filter inputs. Always use the `SEV_0xx_*` values above when filtering by `CVSS_SEVERITY`.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Findings" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetVulnerabilityFindingsRequest" }, "examples": { "last_observed_sort_cvss": { "summary": "Filter by last observed (relative timestamp) and sort by CVSS score", "value": { "request_data": { "filter": { "AND": [ { "SEARCH_FIELD": "LAST_OBSERVED", "SEARCH_TYPE": "RELATIVE_TIMESTAMP", "SEARCH_VALUE": 2592000000 } ] }, "sort": [ { "FIELD": "CVSS_SCORE", "ORDER": "DESC" } ] } } }, "critical_severity": { "summary": "Filter by critical CVSS severity", "value": { "request_data": { "filter": { "AND": [ { "SEARCH_FIELD": "CVSS_SEVERITY", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "SEV_070_CRITICAL" } ] } } } }, "epss_kev_sort": { "summary": "Filter by EPSS score >= 0.7 and has KEV, sort by EPSS score", "value": { "request_data": { "filter": { "AND": [ { "SEARCH_FIELD": "EPSS_SCORE", "SEARCH_TYPE": "GTE", "SEARCH_VALUE": 0.7 }, { "SEARCH_FIELD": "HAS_KEV", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": true } ] }, "sort": [ { "FIELD": "EPSS_SCORE", "ORDER": "DESC" } ] } } }, "pagination_next_page": { "summary": "Paginate internet-exposed findings using next_page_token", "value": { "request_data": { "filter": { "AND": [ { "SEARCH_FIELD": "INTERNET_EXPOSED", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": true } ] }, "next_page_token": "eyJsYXN0X2VsZW1lbnQiOiAxMjM0fQ==" } } }, "asset_category_multi_filter": { "summary": "Multiple filters: VM Instance assets with fix available and high CVSS severity", "value": { "request_data": { "filter": { "AND": [ { "SEARCH_FIELD": "ASSET_CATEGORY", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "VM Instance" }, { "SEARCH_FIELD": "FIX_AVAILABLE", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": true }, { "SEARCH_FIELD": "CVSS_SEVERITY", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "SEV_060_HIGH" } ] }, "sort": [ { "FIELD": "CVSS_SCORE", "ORDER": "DESC" } ] } } }, "exploit_level_weaponized": { "summary": "Filter by weaponized exploit level", "value": { "request_data": { "filter": { "AND": [ { "SEARCH_FIELD": "EXPLOIT_LEVEL", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "WEAPONIZED" } ] } } } } } } } }, "responses": { "200": { "description": "Successful response with vulnerability findings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetVulnerabilityFindingsResponse" }, "examples": { "with_next_page": { "summary": "Response with more pages available", "value": { "reply": { "data": [ { "cortex_vulnerability_risk_score": null, "asset_name": "SNMP Server at 89.170.90.209:161", "cve_id": "CVE-2025-20169", "cve_description": "A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. \r\nThis vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.", "epss_score": 0.00368, "cvss_score": 7.7, "cvss_severity": "HIGH", "fix_versions": [], "fix_date": null, "published_date": 1738713600000, "cve_risk_factors": [ "Attack vector: network", "High severity", "Attack complexity: low", "DoS - High" ], "affected_software": null, "has_kev": null, "exploitable": false, "exploit_level": "NONE", "asset_type": "SERVICE", "asset_category": "Service", "has_issue": false, "ipv4_addresses": [ "89.170.90.209" ], "ipv6_addresses": [], "operating_system": null, "os_family": null, "location": null, "internet_exposed": true, "provider": "ON_PREM", "finding_sources": [ "CORTEX_ATTACK_SURFACE_MANAGEMENT" ], "first_observed": 1764890719158, "last_observed": 1764715866000, "source_tags": [ "asm.attribution.organization_names:[Parameter FAKE_2332423424]" ], "layer_id": null, "image": null, "origin_package_name": null, "package_file_creation_time": null, "package_licenses": [], "package_version": null, "package_purl": null, "package_type": null, "cve_publish_date": 1738713600000, "platform_id": "c273519c3b61adfb7dc46547fbcbfa32", "asset_id": "fef704015fd52a8495025f830b7483988d170f93b5807617761e4af827275a83", "fix_available": false, "package_in_use": null, "file_path": null, "package_symbols": [], "package_author": null, "application_version": null, "asset_type_class": "External Surface", "type_id": "140000000", "derived_from_base_image": null, "is_derived": false, "image_name": null, "asset_group_ids": [], "volume_asset_id": null, "is_root": null, "volume_path": null, "partition_id": null, "partition_id_type": null, "disk_name": null, "remediation": null, "issue_id": null } ], "filter_count": 342, "total_count": 10500, "next_page_token": "eyJsYXN0X2VsZW1lbnQiOiA1Njc4fQ==" } } }, "last_page": { "summary": "Final page — no next_page_token", "value": { "reply": { "data": [ { "cortex_vulnerability_risk_score": null, "asset_name": "SNMP Server at 89.170.90.209:161", "cve_id": "CVE-2025-20169", "cve_description": "A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. \r\nThis vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.", "epss_score": 0.00368, "cvss_score": 7.7, "cvss_severity": "HIGH", "fix_versions": [], "fix_date": null, "published_date": 1738713600000, "cve_risk_factors": [ "Attack vector: network", "High severity", "Attack complexity: low", "DoS - High" ], "affected_software": null, "has_kev": null, "exploitable": false, "exploit_level": "NONE", "asset_type": "SERVICE", "asset_category": "Service", "has_issue": false, "ipv4_addresses": [ "89.170.90.209" ], "ipv6_addresses": [], "operating_system": null, "os_family": null, "location": null, "internet_exposed": true, "provider": "ON_PREM", "finding_sources": [ "CORTEX_ATTACK_SURFACE_MANAGEMENT" ], "first_observed": 1764890719158, "last_observed": 1764715866000, "source_tags": [ "asm.attribution.organization_names:[Parameter FAKE_2332423424]" ], "layer_id": null, "image": null, "origin_package_name": null, "package_file_creation_time": null, "package_licenses": [], "package_version": null, "package_purl": null, "package_type": null, "cve_publish_date": 1738713600000, "platform_id": "c273519c3b61adfb7dc46547fbcbfa32", "asset_id": "fef704015fd52a8495025f830b7483988d170f93b5807617761e4af827275a83", "fix_available": false, "package_in_use": null, "file_path": null, "package_symbols": [], "package_author": null, "application_version": null, "asset_type_class": "External Surface", "type_id": "140000000", "derived_from_base_image": null, "is_derived": false, "image_name": null, "asset_group_ids": [], "volume_asset_id": null, "is_root": null, "volume_path": null, "partition_id": null, "partition_id_type": null, "disk_name": null, "remediation": null, "issue_id": null } ], "filter_count": 342, "total_count": 10500 } } } } } } }, "400": { "description": "Invalid filter parameters or expired page token.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindingsErrorResponse" }, "examples": { "expired_token": { "summary": "Page token has expired", "value": { "reply": { "err_code": 400, "err_msg": "Token Expired" } } }, "invalid_filter": { "summary": "Invalid filter field", "value": { "reply": { "err_code": 400, "err_msg": "Invalid filter parameters" } } } } } } }, "429": { "description": "Rate limit exceeded. This endpoint allows up to 1,000 requests per 24-hour rolling window.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindingsErrorResponse" } } } } } } }, "/vulnerability-management/v1/vulnerability-finding/{platform_id}": { "post": { "operationId": "getVulnerabilityFindingById", "summary": "Get a single vulnerability finding by platform ID", "description": "Returns the vulnerability finding record for the given `platform_id`.\nReturns HTTP 404 when no matching finding exists.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Findings" ], "parameters": [ { "$ref": "#/components/parameters/PlatformId" } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "description": "Empty body — no request parameters required." } } } }, "responses": { "200": { "description": "Vulnerability finding record.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetVulnerabilityFindingByIdResponse" }, "examples": { "found": { "summary": "Finding returned successfully", "value": { "reply": { "data": [ { "cortex_vulnerability_risk_score": null, "asset_name": "SNMP Server at 89.170.90.209:161", "cve_id": "CVE-2025-20169", "cve_description": "A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on an affected device.\r\n\r\nThis vulnerability is due to improper error handling when parsing SNMP requests. An attacker could exploit this vulnerability by sending a crafted SNMP request to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly, resulting in a DoS condition. \r\nThis vulnerability affects SNMP versions 1, 2c, and 3. To exploit this vulnerability through SNMP v2c or earlier, the attacker must know a valid read-write or read-only SNMP community string for the affected system. To exploit this vulnerability through SNMP v3, the attacker must have valid SNMP user credentials for the affected system.", "epss_score": 0.00368, "cvss_score": 7.7, "cvss_severity": "HIGH", "fix_versions": [], "fix_date": null, "published_date": 1738713600000, "cve_risk_factors": [ "Attack vector: network", "High severity", "Attack complexity: low", "DoS - High" ], "affected_software": null, "has_kev": null, "exploitable": false, "exploit_level": "NONE", "asset_type": "SERVICE", "asset_category": "Service", "has_issue": false, "ipv4_addresses": [ "89.170.90.209" ], "ipv6_addresses": [], "operating_system": null, "os_family": null, "location": null, "internet_exposed": true, "provider": "ON_PREM", "finding_sources": [ "CORTEX_ATTACK_SURFACE_MANAGEMENT" ], "first_observed": 1764890719158, "last_observed": 1764715866000, "source_tags": [ "asm.attribution.organization_names:[Parameter FAKE_2332423424]" ], "layer_id": null, "image": null, "origin_package_name": null, "package_file_creation_time": null, "package_licenses": [], "package_version": null, "package_purl": null, "package_type": null, "cve_publish_date": 1738713600000, "platform_id": "c273519c3b61adfb7dc46547fbcbfa32", "asset_id": "fef704015fd52a8495025f830b7483988d170f93b5807617761e4af827275a83", "fix_available": false, "package_in_use": null, "file_path": null, "package_symbols": [], "package_author": null, "application_version": null, "asset_type_class": "External Surface", "type_id": "140000000", "derived_from_base_image": null, "is_derived": false, "image_name": null, "asset_group_ids": [], "volume_asset_id": null, "is_root": null, "volume_path": null, "partition_id": null, "partition_id_type": null, "disk_name": null, "remediation": null, "issue_id": null } ] } } } } } } }, "400": { "description": "Missing or invalid platform_id.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindingsErrorResponse" }, "examples": { "missing_id": { "summary": "platform_id not provided", "value": { "reply": { "err_code": 400, "err_msg": "platform_id is missing" } } } } } } }, "404": { "description": "No finding found for the given platform_id.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindingsErrorResponse" }, "examples": { "not_found": { "summary": "Finding not found", "value": { "reply": { "err_code": 404, "err_msg": "No data found" } } } } } } } } } }, "/vulnerability-management/v1/vulnerability-finding/snapshot": { "post": { "operationId": "getVulnerabilityFindingsSnapshot", "summary": "Bulk export vulnerability findings snapshot", "description": "Executes an XQL query against the `uvm_findings` dataset and returns results as a newline-delimited JSON (NDJSON) stream for large result sets.\n\n**Response variants:**\n- **Stream** (`application/x-ndjson`) — large result sets; each line is a `VulnerabilityFinding` JSON object\n- **Inline** (`application/json`) — small result sets returned directly\n\n**Rate limit:** Up to 10 requests per 24-hour rolling window. Exceeding this limit returns HTTP `429`.\n\n**Supported request fields and filter types:**\n\nThe snapshot export accepts an optional per-field `filter` block in addition to `timeframe` and `limit`. All parameters are supplied inside `request_data`:\n\n| Request field | Data type | Description |\n| --- | --- | --- |\n| `filter` | filter block | Optional. An `AND`/`OR` group of clauses, each with `SEARCH_FIELD`, `SEARCH_TYPE`, and `SEARCH_VALUE`. Only the fields listed below may be used. |\n| `timeframe.from` + `timeframe.to` | timestamp (ms) | Optional absolute time window. Both bounds are required together. When omitted, the server default lookback window is used. |\n| `limit` | integer | Optional maximum number of rows to return. Omit for the full dataset. |\n\n**Supported filter fields and filter types:**\n\nThe snapshot `filter` block uses the same supported filter fields and filter types as the **List vulnerability findings (paginated)** endpoint, except that field names for the snapshot endpoint are lowercase (for example, `cve_id`, `cvss_severity`). Any field not supported is rejected with HTTP `400`.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Vulnerability Findings Snapshot" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "description": "Top-level request envelope.", "properties": { "request_data": { "$ref": "#/components/schemas/GetVulnerabilityFindingsSnapshotRequest" } } }, "examples": { "default_full_snapshot": { "summary": "Full snapshot, No Limit", "value": { "request_data": { "timeframe": { "from": 15989076874, "to": 1771482089874 } } } }, "limited_uncompressed": { "summary": "First 5000 rows", "value": { "request_data": { "limit": 5000 } } }, "absolute_timeframe": { "summary": "Snapshot for an absolute time window", "value": { "request_data": { "timeframe": { "from": 15989076787, "to": 1771482089874 }, "limit": 10000 } } } } } } }, "responses": { "200": { "description": "Newline-delimited JSON stream response. Body is a newline-delimited stream of `VulnerabilityFinding` JSON objects.", "content": { "application/x-ndjson": { "schema": { "type": "string", "format": "binary", "description": "Newline-delimited JSON stream. Each line is a self-contained `VulnerabilityFinding` JSON object." }, "examples": { "ndjson_stream": { "summary": "Two sample NDJSON lines (large result set)", "value": "{\"platform_id\":\"abc123\",\"asset_name\":\"prod-web-01\",\"cve_id\":\"CVE-2024-12345\",\"cvss_severity\":\"CRITICAL\",\"epss_score\":0.87,\"first_observed\":1700000000000,\"last_observed\":1710000000000}\n{\"platform_id\":\"xyz789\",\"asset_name\":\"db-server-02\",\"cve_id\":\"CVE-2023-99999\",\"cvss_severity\":\"HIGH\",\"epss_score\":0.12,\"first_observed\":1705000000000,\"last_observed\":1710000000000}" } } } } }, "400": { "description": "Invalid request parameters, or the feature is disabled.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindingsErrorResponse" }, "examples": { "feature_disabled": { "summary": "Feature flag is off", "value": { "error": { "message": "Invalid Request" } } }, "invalid_params": { "summary": "Bad request parameters", "value": { "error": { "message": "Invalid request parameters" } } } } } } }, "408": { "description": "Request timed out waiting for response.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindingsErrorResponse" }, "examples": { "timeout": { "summary": "Query timed out", "value": { "error": { "message": "Timed out waiting for results. Please try again later." } } } } } } }, "429": { "description": "Rate limit exceeded. This endpoint allows up to 10 requests per 24-hour rolling window.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/FindingsErrorResponse" } } } } } } } }, "components": { "parameters": { "PlatformId": { "name": "platform_id", "in": "path", "required": true, "description": "Unique platform identifier for a vulnerability finding.", "schema": { "type": "string", "example": "abc123def456" } } }, "schemas": { "ADVANCED_IP_MATCH_RANGE": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "ADVANCED_IP_MATCH_RANGE", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "$ref": "#/components/schemas/FromTo_IPv4Address_" }, { "$ref": "#/components/schemas/FromTo_IPv6Address_" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "ADVANCED_IP_MATCH_RANGE" }, "ADVANCED_NIP_MATCH_RANGE": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "ADVANCED_NIP_MATCH_RANGE", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "$ref": "#/components/schemas/FromTo_IPv4Address_" }, { "$ref": "#/components/schemas/FromTo_IPv6Address_" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "ADVANCED_NIP_MATCH_RANGE" }, "AND-Input": { "properties": { "AND": { "items": { "oneOf": [ { "oneOf": [ { "$ref": "#/components/schemas/EQ" }, { "$ref": "#/components/schemas/NEQ" }, { "$ref": "#/components/schemas/IS_NOT" }, { "$ref": "#/components/schemas/IN" }, { "$ref": "#/components/schemas/NIN" }, { "$ref": "#/components/schemas/CONTAINS" }, { "$ref": "#/components/schemas/NCONTAINS" }, { "$ref": "#/components/schemas/CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/NOT_CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/GT" }, { "$ref": "#/components/schemas/LT" }, { "$ref": "#/components/schemas/GTE" }, { "$ref": "#/components/schemas/LTE" }, { "$ref": "#/components/schemas/IS_EMPTY" }, { "$ref": "#/components/schemas/NIS_EMPTY" }, { "$ref": "#/components/schemas/WILDCARD" }, { "$ref": "#/components/schemas/WILDCARD_NOT" }, { "$ref": "#/components/schemas/LIKE_ANY" }, { "$ref": "#/components/schemas/RELATIVE_TIMESTAMP" }, { "$ref": "#/components/schemas/RANGE" }, { "$ref": "#/components/schemas/REGEX" }, { "$ref": "#/components/schemas/REGEX_NOT" }, { "$ref": "#/components/schemas/ADVANCED_IP_MATCH_RANGE" }, { "$ref": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE" } ], "discriminator": { "propertyName": "SEARCH_TYPE", "mapping": { "ADVANCED_IP_MATCH_RANGE": "#/components/schemas/ADVANCED_IP_MATCH_RANGE", "ADVANCED_NIP_MATCH_RANGE": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE", "CONTAINS": "#/components/schemas/CONTAINS", "CONTAINS_IN_LIST": "#/components/schemas/CONTAINS_IN_LIST", "EQ": "#/components/schemas/EQ", "GT": "#/components/schemas/GT", "GTE": "#/components/schemas/GTE", "IN": "#/components/schemas/IN", "IS_EMPTY": "#/components/schemas/IS_EMPTY", "IS_NOT": "#/components/schemas/IS_NOT", "LIKE_ANY": "#/components/schemas/LIKE_ANY", "LT": "#/components/schemas/LT", "LTE": "#/components/schemas/LTE", "NCONTAINS": "#/components/schemas/NCONTAINS", "NEQ": "#/components/schemas/NEQ", "NIN": "#/components/schemas/NIN", "NIS_EMPTY": "#/components/schemas/NIS_EMPTY", "NOT_CONTAINS_IN_LIST": "#/components/schemas/NOT_CONTAINS_IN_LIST", "RANGE": "#/components/schemas/RANGE", "REGEX": "#/components/schemas/REGEX", "REGEX_NOT": "#/components/schemas/REGEX_NOT", "RELATIVE_TIMESTAMP": "#/components/schemas/RELATIVE_TIMESTAMP", "WILDCARD": "#/components/schemas/WILDCARD", "WILDCARD_NOT": "#/components/schemas/WILDCARD_NOT" } } }, { "$ref": "#/components/schemas/OR-Input" }, { "$ref": "#/components/schemas/AND-Input" }, { "$ref": "#/components/schemas/EMPTY" } ] }, "type": "array", "title": "And" } }, "type": "object", "required": [ "AND" ], "title": "AND" }, "AND-Output": { "properties": { "AND": { "items": { "oneOf": [ { "oneOf": [ { "$ref": "#/components/schemas/EQ" }, { "$ref": "#/components/schemas/NEQ" }, { "$ref": "#/components/schemas/IS_NOT" }, { "$ref": "#/components/schemas/IN" }, { "$ref": "#/components/schemas/NIN" }, { "$ref": "#/components/schemas/CONTAINS" }, { "$ref": "#/components/schemas/NCONTAINS" }, { "$ref": "#/components/schemas/CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/NOT_CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/GT" }, { "$ref": "#/components/schemas/LT" }, { "$ref": "#/components/schemas/GTE" }, { "$ref": "#/components/schemas/LTE" }, { "$ref": "#/components/schemas/IS_EMPTY" }, { "$ref": "#/components/schemas/NIS_EMPTY" }, { "$ref": "#/components/schemas/WILDCARD" }, { "$ref": "#/components/schemas/WILDCARD_NOT" }, { "$ref": "#/components/schemas/LIKE_ANY" }, { "$ref": "#/components/schemas/RELATIVE_TIMESTAMP" }, { "$ref": "#/components/schemas/RANGE" }, { "$ref": "#/components/schemas/REGEX" }, { "$ref": "#/components/schemas/REGEX_NOT" }, { "$ref": "#/components/schemas/ADVANCED_IP_MATCH_RANGE" }, { "$ref": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE" } ], "discriminator": { "propertyName": "SEARCH_TYPE", "mapping": { "ADVANCED_IP_MATCH_RANGE": "#/components/schemas/ADVANCED_IP_MATCH_RANGE", "ADVANCED_NIP_MATCH_RANGE": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE", "CONTAINS": "#/components/schemas/CONTAINS", "CONTAINS_IN_LIST": "#/components/schemas/CONTAINS_IN_LIST", "EQ": "#/components/schemas/EQ", "GT": "#/components/schemas/GT", "GTE": "#/components/schemas/GTE", "IN": "#/components/schemas/IN", "IS_EMPTY": "#/components/schemas/IS_EMPTY", "IS_NOT": "#/components/schemas/IS_NOT", "LIKE_ANY": "#/components/schemas/LIKE_ANY", "LT": "#/components/schemas/LT", "LTE": "#/components/schemas/LTE", "NCONTAINS": "#/components/schemas/NCONTAINS", "NEQ": "#/components/schemas/NEQ", "NIN": "#/components/schemas/NIN", "NIS_EMPTY": "#/components/schemas/NIS_EMPTY", "NOT_CONTAINS_IN_LIST": "#/components/schemas/NOT_CONTAINS_IN_LIST", "RANGE": "#/components/schemas/RANGE", "REGEX": "#/components/schemas/REGEX", "REGEX_NOT": "#/components/schemas/REGEX_NOT", "RELATIVE_TIMESTAMP": "#/components/schemas/RELATIVE_TIMESTAMP", "WILDCARD": "#/components/schemas/WILDCARD", "WILDCARD_NOT": "#/components/schemas/WILDCARD_NOT" } } }, { "$ref": "#/components/schemas/OR-Output" }, { "$ref": "#/components/schemas/AND-Output" }, { "$ref": "#/components/schemas/EMPTY" } ] }, "type": "array", "title": "And" } }, "type": "object", "required": [ "AND" ], "title": "AND" }, "ActionCategory": { "type": "string", "enum": [ "BLOCK", "CREATE_ISSUE" ], "title": "ActionCategory" }, "BlockBuild": { "properties": { "action_type": { "type": "string", "const": "BLOCK_BUILD", "title": "Action Type", "default": "BLOCK_BUILD" }, "take_action": { "type": "boolean", "title": "Take Action", "default": true }, "category": { "type": "string", "const": "BLOCK", "title": "Category", "default": "BLOCK" } }, "type": "object", "title": "BlockBuild" }, "BlockDeploy": { "properties": { "action_type": { "type": "string", "const": "BLOCK_DEPLOY", "title": "Action Type", "default": "BLOCK_DEPLOY" }, "take_action": { "type": "boolean", "title": "Take Action", "default": true }, "category": { "type": "string", "const": "BLOCK", "title": "Category", "default": "BLOCK" } }, "type": "object", "title": "BlockDeploy" }, "CONTAINS": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "CONTAINS", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "CONTAINS" }, "CONTAINS_IN_LIST": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "CONTAINS_IN_LIST", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "CONTAINS_IN_LIST" }, "CreateIssue": { "properties": { "action_type": { "type": "string", "const": "CREATE_ISSUE", "title": "Action Type", "default": "CREATE_ISSUE" }, "name": { "type": "string", "title": "Name" }, "take_action": { "type": "boolean", "title": "Take Action", "default": true }, "category": { "type": "string", "const": "CREATE_ISSUE", "title": "Category", "default": "CREATE_ISSUE" } }, "type": "object", "title": "CreateIssue" }, "CreatePolicy": { "properties": { "name": { "type": "string", "title": "Name" }, "description": { "type": "string", "title": "Description" }, "priority": { "type": "integer", "title": "Priority" }, "status": { "allOf": [ { "$ref": "#/components/schemas/PolicyStatus" } ], "default": "DISABLED" }, "match_criteria": { "anyOf": [ { "$ref": "#/components/schemas/AND-Input" }, { "$ref": "#/components/schemas/OR-Input" }, { "$ref": "#/components/schemas/EMPTY" } ], "title": "Match Criteria" }, "exclusion_criteria": { "anyOf": [ { "$ref": "#/components/schemas/EMPTY" }, { "$ref": "#/components/schemas/AND-Input" }, { "$ref": "#/components/schemas/OR-Input" } ], "title": "Exclusion Criteria" }, "action": { "items": { "anyOf": [ { "$ref": "#/components/schemas/BlockBuild" }, { "$ref": "#/components/schemas/BlockDeploy" }, { "$ref": "#/components/schemas/CreateIssue" } ] }, "type": "array", "title": "Action" }, "action_category": { "$ref": "#/components/schemas/ActionCategory" }, "issue_type": { "type": "string", "title": "Issue Type" }, "severity": { "allOf": [ { "$ref": "#/components/schemas/IssueSeverity" } ], "title": "Severity" }, "asset_group_scope": { "items": { "type": "integer" }, "type": "array", "title": "Asset Group Scope" }, "policy_type": { "allOf": [ { "$ref": "#/components/schemas/PolicyType" } ], "default": "STANDARD_POLICY" } }, "type": "object", "required": [ "name", "priority", "match_criteria", "action", "action_category", "asset_group_scope" ], "title": "CreatePolicy" }, "CreatePolicyResponse": { "properties": { "id": { "type": "string", "format": "uuid", "title": "Id" } }, "type": "object", "required": [ "id" ], "title": "CreatePolicyResponse" }, "EMPTY": { "properties": {}, "additionalProperties": false, "type": "object", "title": "EMPTY" }, "EQ": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "EQ", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "type": "string" }, { "type": "integer" }, { "type": "number" }, { "type": "boolean" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "EQ" }, "Filter-Input": { "properties": { "filter": { "anyOf": [ { "$ref": "#/components/schemas/AND-Input" }, { "$ref": "#/components/schemas/OR-Input" }, { "$ref": "#/components/schemas/EMPTY" } ], "title": "Filter" }, "sort": { "items": { "$ref": "#/components/schemas/Sort" }, "type": "array", "title": "Sort" }, "paging": { "allOf": [ { "$ref": "#/components/schemas/Page" } ], "title": "Paging" }, "locked": { "anyOf": [ { "$ref": "#/components/schemas/AND-Input" }, { "$ref": "#/components/schemas/OR-Input" }, { "$ref": "#/components/schemas/EMPTY" } ], "title": "Locked", "description": "\nFilter passed in from the application that is not intended to be modified by the user.\nBe aware that this field is not guaranteed to not be modified by the user.\n " } }, "type": "object", "title": "Filter" }, "FromTo_IPv4Address_": { "properties": { "from": { "type": "string", "format": "ipv4", "title": "From" }, "to": { "type": "string", "format": "ipv4", "title": "To" } }, "type": "object", "required": [ "from", "to" ], "title": "FromTo[IPv4Address]" }, "FromTo_IPv6Address_": { "properties": { "from": { "type": "string", "format": "ipv6", "title": "From" }, "to": { "type": "string", "format": "ipv6", "title": "To" } }, "type": "object", "required": [ "from", "to" ], "title": "FromTo[IPv6Address]" }, "FromTo_float_": { "properties": { "from": { "type": "number", "title": "From" }, "to": { "type": "number", "title": "To" } }, "type": "object", "required": [ "from", "to" ], "title": "FromTo[float]" }, "FromTo_int_": { "properties": { "from": { "type": "integer", "title": "From" }, "to": { "type": "integer", "title": "To" } }, "type": "object", "required": [ "from", "to" ], "title": "FromTo[int]" }, "GT": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "GT", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "type": "integer" }, { "type": "number" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "GT" }, "GTE": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "GTE", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "type": "integer" }, { "type": "number" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "GTE" }, "GetDataRequest": { "properties": { "filter_data": { "$ref": "#/components/schemas/Filter-Input" } }, "type": "object", "required": [ "filter_data" ], "title": "GetDataRequest" }, "GetDataResponse": { "properties": { "DATA": { "items": {}, "type": "array", "title": "Data" }, "FILTER_COUNT": { "type": "integer", "minimum": 0, "title": "Filter Count" }, "TOTAL_COUNT": { "type": "integer", "minimum": 0, "title": "Total Count" } }, "type": "object", "required": [ "DATA", "FILTER_COUNT", "TOTAL_COUNT" ], "title": "GetDataResponse" }, "AssetInfo": { "type": "object", "title": "AssetInfo", "description": "Information about an asset with vulnerabilities.", "required": [ "vulnerabilities", "last_seen" ], "properties": { "ipv4": { "type": "array", "items": { "type": "string", "format": "ipv4" }, "title": "IPv4", "description": "IPv4 addresses used to identify this asset in the source system." }, "vulnerabilities": { "type": "array", "items": { "$ref": "#/components/schemas/VulnerabilityInfo" }, "title": "Vulnerabilities", "description": "All vulnerabilities related to this asset." }, "origin_asset_id": { "type": "string", "title": "Origin Asset ID", "description": "Unique ID generated by the source system. Used as a uniqueness constraint for future matching." }, "asset_name": { "type": "string", "title": "Asset Name", "description": "Friendly name of the asset. If omitted, the platform may auto-generate a name from the FQDN, IPv4, or IPv6 address." }, "ipv6": { "type": "array", "items": { "type": "string", "format": "ipv6" }, "title": "IPv6", "description": "IPv6 addresses used to identify this asset in the source system." }, "fqdn": { "type": "array", "items": { "type": "string" }, "title": "FQDN", "description": "FQDNs used to identify this asset in the source system." }, "mac_address": { "type": "string", "title": "MAC Address", "description": "MAC address assigned to the asset in the source system." }, "origin_tags": { "type": "array", "items": { "type": "string" }, "title": "Origin Tags", "description": "Tags from the origin system. Stored in the platform tags field to allow ingesting additional asset context. Parsed as key/value pairs separated by colons.", "example": [ "env:perf-test", "batch:stress" ] }, "last_seen": { "type": "integer", "title": "Last Seen", "description": "Timestamp in milliseconds since epoch time (Unix time). Must be within the last 30 days from the current time. Older or future timestamps are rejected with HTTP 422." }, "os_name": { "type": "string", "title": "OS Name", "description": "Operating system name of the asset." }, "product": { "type": "string", "title": "Product", "description": "Product name installed on the asset." }, "vendor": { "type": "string", "title": "Vendor", "description": "Vendor of the product installed on the asset." }, "version": { "type": "string", "title": "Version", "description": "Version of the product installed on the asset." } } }, "ImportJobResponse": { "type": "object", "title": "ImportJobResponse", "description": "Status and metadata for a BYOS import job.", "required": [ "job_id", "created_timestamp", "job_status" ], "properties": { "job_id": { "type": "string", "title": "Job ID", "description": "Unique job ID. Use this value with the Get BYOS Import Job Status endpoint to poll for completion." }, "created_timestamp": { "type": "string", "format": "date-time", "title": "Created Timestamp", "description": "ISO 8601 timestamp of when the job was received." }, "job_status": { "description": "Current status of the import job.", "allOf": [ { "$ref": "#/components/schemas/ImportJobStatus" } ] }, "last_updated": { "type": "string", "format": "date-time", "title": "Last Updated", "description": "ISO 8601 timestamp of when the job was last updated." }, "error_log": { "type": [ "string", "null" ], "title": "Error Log", "description": "Error details if the job failed or completed with errors. May be `null` when there is no error." } } }, "ImportJobStatus": { "type": "string", "title": "ImportJobStatus", "description": "Possible status values for a BYOS import job.", "enum": [ "INITIATED", "PROCESSING", "COMPLETED", "COMPLETED_WITH_ERRORS", "FAILED" ] }, "VulnerabilityInfo": { "type": "object", "title": "VulnerabilityInfo", "description": "Information about a vulnerability attached to an asset.", "required": [ "vulnerability_id", "last_seen" ], "properties": { "vulnerability_id": { "type": "string", "title": "Vulnerability ID", "description": "CVE ID for the vulnerability. Typically follows the canonical CVE format (for example, `CVE-2024-12345`), but the API does not enforce this format and accepts any non-empty string identifier." }, "last_seen": { "type": "integer", "title": "Last Seen", "description": "Timestamp in milliseconds since epoch time (Unix time). Must be within the last 30 days from the current time. Older or future timestamps are rejected with HTTP 422." }, "port": { "type": "integer", "title": "Port", "description": "Port used for remote scanning. Must be a positive integer less than 65,535.", "minimum": 1, "maximum": 65534 }, "protocol": { "type": "string", "enum": [ "TCP", "UDP" ], "title": "Protocol", "description": "Network protocol used during scanning." }, "raw_output": { "type": "string", "maxLength": 2000, "title": "Raw Output", "description": "Additional output from the scanner. Maximum 2,000 characters." }, "confidence": { "type": "string", "enum": [ "Potential", "Confirmed" ], "title": "Confidence", "description": "Confidence level of the vulnerability finding." }, "description": { "type": "string", "title": "Description", "description": "Description of the vulnerability." }, "evidence": { "type": "string", "title": "Evidence", "description": "Evidence supporting the vulnerability finding." }, "scan_name": { "type": "string", "title": "Scan Name", "description": "Name of the scan that detected this vulnerability." }, "cve_id": { "type": "array", "items": { "type": "string" }, "title": "CVE ID", "description": "List of CVE IDs associated with this vulnerability." } } }, "VulnerableAssetImportRequest": { "type": "object", "title": "VulnerableAssetImportRequest", "description": "Request body for importing vulnerable assets from an external scanner.", "required": [ "vendor", "product", "assets" ], "properties": { "vendor": { "type": "string", "title": "Vendor", "description": "Vulnerability scanner vendor. Examples: `TENABLE`, `QUALYS`, `RAPID7_VM`, `RAPID7_CLOUD`." }, "product": { "type": "string", "title": "Product", "description": "Product name associated with the vulnerabilities." }, "version": { "type": "string", "title": "Version", "description": "Product version, used for `(vendor, product, version)` CVE mapping." }, "assets": { "type": "array", "minItems": 1, "items": { "$ref": "#/components/schemas/AssetInfo" }, "title": "Assets", "description": "List of assets with their vulnerability findings. Must contain at least one asset." } } }, "VulnerableAssetImportResponse": { "type": "object", "title": "VulnerableAssetImportResponse", "description": "Response for a successful vulnerable asset import. Returns counts and the async job identifier needed to poll for completion.", "required": [ "assets_count", "vulnerabilities_count", "job_id", "job_status" ], "properties": { "assets_count": { "type": "integer", "title": "Assets Count", "description": "Total number of assets accepted in the import request.", "example": 2 }, "vulnerabilities_count": { "type": "integer", "title": "Vulnerabilities Count", "description": "Total number of vulnerabilities accepted across all assets in the import request.", "example": 4 }, "job_id": { "type": "string", "format": "uuid", "title": "Job ID", "description": "Unique identifier for the async import job. Use this value with the Get BYOS Import Job Status endpoint to poll for completion.", "example": "a2b1aba2-37fe-4fb4-ba6d-829e8cf5d653" }, "job_status": { "description": "Initial status of the import job. Will be `INITIATED` immediately after a successful POST.", "allOf": [ { "$ref": "#/components/schemas/ImportJobStatus" } ] } } }, "HTTPValidationError": { "properties": { "detail": { "items": { "$ref": "#/components/schemas/ValidationError" }, "type": "array", "title": "Detail" } }, "type": "object", "title": "HTTPValidationError" }, "IN": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "IN", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "items": { "type": "string" }, "type": "array" }, { "items": { "type": "integer" }, "type": "array" }, { "items": { "type": "number" }, "type": "array" }, { "items": { "type": "boolean" }, "type": "array" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "IN" }, "IS_EMPTY": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "IS_EMPTY", "title": "Search Type" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE" ], "title": "IS_EMPTY" }, "IS_NOT": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "IS_NOT", "title": "Search Type" }, "SEARCH_VALUE": { "type": "boolean", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "IS_NOT" }, "IssueSeverity": { "type": "string", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO", "UNKNOWN", "USE_CVE_SEVERITY" ], "title": "IssueSeverity" }, "LIKE_ANY": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "LIKE_ANY", "title": "Search Type" }, "SEARCH_VALUE": { "items": { "type": "string" }, "type": "array", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "LIKE_ANY" }, "LT": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "LT", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "type": "integer" }, { "type": "number" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "LT" }, "LTE": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "LTE", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "type": "integer" }, { "type": "number" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "LTE" }, "NCONTAINS": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "NCONTAINS", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "NCONTAINS" }, "NEQ": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "NEQ", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "type": "string" }, { "type": "integer" }, { "type": "number" }, { "type": "boolean" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "NEQ" }, "NIN": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "NIN", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "items": { "type": "string" }, "type": "array" }, { "items": { "type": "integer" }, "type": "array" }, { "items": { "type": "number" }, "type": "array" }, { "items": { "type": "boolean" }, "type": "array" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "NIN" }, "NIS_EMPTY": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "NIS_EMPTY", "title": "Search Type" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE" ], "title": "NIS_EMPTY" }, "NOT_CONTAINS_IN_LIST": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "NOT_CONTAINS_IN_LIST", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "NOT_CONTAINS_IN_LIST" }, "OR-Input": { "properties": { "OR": { "items": { "oneOf": [ { "oneOf": [ { "$ref": "#/components/schemas/EQ" }, { "$ref": "#/components/schemas/NEQ" }, { "$ref": "#/components/schemas/IS_NOT" }, { "$ref": "#/components/schemas/IN" }, { "$ref": "#/components/schemas/NIN" }, { "$ref": "#/components/schemas/CONTAINS" }, { "$ref": "#/components/schemas/NCONTAINS" }, { "$ref": "#/components/schemas/CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/NOT_CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/GT" }, { "$ref": "#/components/schemas/LT" }, { "$ref": "#/components/schemas/GTE" }, { "$ref": "#/components/schemas/LTE" }, { "$ref": "#/components/schemas/IS_EMPTY" }, { "$ref": "#/components/schemas/NIS_EMPTY" }, { "$ref": "#/components/schemas/WILDCARD" }, { "$ref": "#/components/schemas/WILDCARD_NOT" }, { "$ref": "#/components/schemas/LIKE_ANY" }, { "$ref": "#/components/schemas/RELATIVE_TIMESTAMP" }, { "$ref": "#/components/schemas/RANGE" }, { "$ref": "#/components/schemas/REGEX" }, { "$ref": "#/components/schemas/REGEX_NOT" }, { "$ref": "#/components/schemas/ADVANCED_IP_MATCH_RANGE" }, { "$ref": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE" } ], "discriminator": { "propertyName": "SEARCH_TYPE", "mapping": { "ADVANCED_IP_MATCH_RANGE": "#/components/schemas/ADVANCED_IP_MATCH_RANGE", "ADVANCED_NIP_MATCH_RANGE": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE", "CONTAINS": "#/components/schemas/CONTAINS", "CONTAINS_IN_LIST": "#/components/schemas/CONTAINS_IN_LIST", "EQ": "#/components/schemas/EQ", "GT": "#/components/schemas/GT", "GTE": "#/components/schemas/GTE", "IN": "#/components/schemas/IN", "IS_EMPTY": "#/components/schemas/IS_EMPTY", "IS_NOT": "#/components/schemas/IS_NOT", "LIKE_ANY": "#/components/schemas/LIKE_ANY", "LT": "#/components/schemas/LT", "LTE": "#/components/schemas/LTE", "NCONTAINS": "#/components/schemas/NCONTAINS", "NEQ": "#/components/schemas/NEQ", "NIN": "#/components/schemas/NIN", "NIS_EMPTY": "#/components/schemas/NIS_EMPTY", "NOT_CONTAINS_IN_LIST": "#/components/schemas/NOT_CONTAINS_IN_LIST", "RANGE": "#/components/schemas/RANGE", "REGEX": "#/components/schemas/REGEX", "REGEX_NOT": "#/components/schemas/REGEX_NOT", "RELATIVE_TIMESTAMP": "#/components/schemas/RELATIVE_TIMESTAMP", "WILDCARD": "#/components/schemas/WILDCARD", "WILDCARD_NOT": "#/components/schemas/WILDCARD_NOT" } } }, { "$ref": "#/components/schemas/OR-Input" }, { "$ref": "#/components/schemas/AND-Input" }, { "$ref": "#/components/schemas/EMPTY" } ] }, "type": "array", "title": "Or" } }, "type": "object", "required": [ "OR" ], "title": "OR" }, "OR-Output": { "properties": { "OR": { "items": { "oneOf": [ { "oneOf": [ { "$ref": "#/components/schemas/EQ" }, { "$ref": "#/components/schemas/NEQ" }, { "$ref": "#/components/schemas/IS_NOT" }, { "$ref": "#/components/schemas/IN" }, { "$ref": "#/components/schemas/NIN" }, { "$ref": "#/components/schemas/CONTAINS" }, { "$ref": "#/components/schemas/NCONTAINS" }, { "$ref": "#/components/schemas/CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/NOT_CONTAINS_IN_LIST" }, { "$ref": "#/components/schemas/GT" }, { "$ref": "#/components/schemas/LT" }, { "$ref": "#/components/schemas/GTE" }, { "$ref": "#/components/schemas/LTE" }, { "$ref": "#/components/schemas/IS_EMPTY" }, { "$ref": "#/components/schemas/NIS_EMPTY" }, { "$ref": "#/components/schemas/WILDCARD" }, { "$ref": "#/components/schemas/WILDCARD_NOT" }, { "$ref": "#/components/schemas/LIKE_ANY" }, { "$ref": "#/components/schemas/RELATIVE_TIMESTAMP" }, { "$ref": "#/components/schemas/RANGE" }, { "$ref": "#/components/schemas/REGEX" }, { "$ref": "#/components/schemas/REGEX_NOT" }, { "$ref": "#/components/schemas/ADVANCED_IP_MATCH_RANGE" }, { "$ref": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE" } ], "discriminator": { "propertyName": "SEARCH_TYPE", "mapping": { "ADVANCED_IP_MATCH_RANGE": "#/components/schemas/ADVANCED_IP_MATCH_RANGE", "ADVANCED_NIP_MATCH_RANGE": "#/components/schemas/ADVANCED_NIP_MATCH_RANGE", "CONTAINS": "#/components/schemas/CONTAINS", "CONTAINS_IN_LIST": "#/components/schemas/CONTAINS_IN_LIST", "EQ": "#/components/schemas/EQ", "GT": "#/components/schemas/GT", "GTE": "#/components/schemas/GTE", "IN": "#/components/schemas/IN", "IS_EMPTY": "#/components/schemas/IS_EMPTY", "IS_NOT": "#/components/schemas/IS_NOT", "LIKE_ANY": "#/components/schemas/LIKE_ANY", "LT": "#/components/schemas/LT", "LTE": "#/components/schemas/LTE", "NCONTAINS": "#/components/schemas/NCONTAINS", "NEQ": "#/components/schemas/NEQ", "NIN": "#/components/schemas/NIN", "NIS_EMPTY": "#/components/schemas/NIS_EMPTY", "NOT_CONTAINS_IN_LIST": "#/components/schemas/NOT_CONTAINS_IN_LIST", "RANGE": "#/components/schemas/RANGE", "REGEX": "#/components/schemas/REGEX", "REGEX_NOT": "#/components/schemas/REGEX_NOT", "RELATIVE_TIMESTAMP": "#/components/schemas/RELATIVE_TIMESTAMP", "WILDCARD": "#/components/schemas/WILDCARD", "WILDCARD_NOT": "#/components/schemas/WILDCARD_NOT" } } }, { "$ref": "#/components/schemas/OR-Output" }, { "$ref": "#/components/schemas/AND-Output" }, { "$ref": "#/components/schemas/EMPTY" } ] }, "type": "array", "title": "Or" } }, "type": "object", "required": [ "OR" ], "title": "OR" }, "Page": { "properties": { "from": { "type": "integer", "minimum": 0, "title": "From" }, "to": { "type": "integer", "minimum": 1, "title": "To" } }, "type": "object", "required": [ "from", "to" ], "title": "Page" }, "PolicyStatus": { "type": "string", "enum": [ "ENABLED", "DISABLED" ], "title": "PolicyStatus" }, "PolicyType": { "type": "string", "enum": [ "GLOBAL_EXCLUSION", "STANDARD_POLICY" ], "title": "PolicyType" }, "PolicyView": { "properties": { "PRIORITY": { "type": "integer", "title": "Priority" }, "ID": { "type": "string", "format": "uuid", "title": "Id" }, "NAME": { "type": "string", "title": "Name" }, "STATUS": { "type": "string", "title": "Status" }, "MATCH_CRITERIA": { "anyOf": [ { "$ref": "#/components/schemas/EMPTY" }, { "$ref": "#/components/schemas/AND-Output" }, { "$ref": "#/components/schemas/OR-Output" } ], "title": "Match Criteria" }, "EXCLUSIONS": { "anyOf": [ { "$ref": "#/components/schemas/EMPTY" }, { "$ref": "#/components/schemas/AND-Output" }, { "$ref": "#/components/schemas/OR-Output" } ], "title": "Exclusions" }, "SEVERITY": { "allOf": [ { "$ref": "#/components/schemas/IssueSeverity" } ], "title": "Severity" }, "OPEN_ISSUES": { "type": "integer", "title": "Open Issues" }, "ESTIMATED_MATCH_COUNT": { "type": "integer", "title": "Estimated Match Count" }, "DESCRIPTION": { "type": "string", "title": "Description" }, "MODIFIED_BY": { "type": "string", "title": "Modified By" }, "MODIFIED_TIMESTAMP": { "type": "string", "format": "date-time", "title": "Modified Timestamp" }, "ACTION": { "items": { "anyOf": [ { "$ref": "#/components/schemas/BlockBuild" }, { "$ref": "#/components/schemas/BlockDeploy" }, { "$ref": "#/components/schemas/CreateIssue" } ] }, "type": "array", "title": "Action" }, "ACTION_CATEGORY": { "$ref": "#/components/schemas/ActionCategory" }, "ASSET_GROUP_SCOPE": { "items": { "type": "integer" }, "type": "array", "title": "Asset Group Scope" }, "POLICY_TYPE": { "allOf": [ { "$ref": "#/components/schemas/PolicyType" } ], "default": "STANDARD_POLICY" } }, "type": "object", "required": [ "PRIORITY", "ID", "NAME", "STATUS", "MATCH_CRITERIA", "EXCLUSIONS", "OPEN_ISSUES", "ESTIMATED_MATCH_COUNT", "DESCRIPTION", "MODIFIED_BY", "MODIFIED_TIMESTAMP", "ACTION", "ACTION_CATEGORY" ], "title": "PolicyView" }, "RANGE": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "RANGE", "title": "Search Type" }, "SEARCH_VALUE": { "anyOf": [ { "$ref": "#/components/schemas/FromTo_int_" }, { "$ref": "#/components/schemas/FromTo_float_" } ], "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "RANGE" }, "ScanRequest": { "description": "Request model for triggering a vulnerability scan", "properties": { "asset_id": { "type": "string", "minLength": 1, "title": "Asset Id", "description": "The unique identifier of the asset to scan" }, "scanner_type": { "allOf": [ { "$ref": "#/components/schemas/ScannerType" } ], "description": "The type of scanner to use for the scan" }, "cve_id": { "type": "string", "title": "Cve Id", "description": "CVE identifier (e.g., 'CVE-2024-1234'). Required when scanner_type is CORTEX_NETWORK_SCANNER, optional for other scanner types." }, "scan_target": { "type": "string", "enum": [ "CONTAINER", "HOST", "IMAGE" ], "title": "Scan Target", "description": "Scan Target (e.g., 'CONTAINER' or 'HOST' or 'IMAGE'). Required when scanner_type is CORTEX_XDR_AGENT and its Linux endpoint, optional for other scanner types." } }, "type": "object", "required": [ "asset_id", "scanner_type" ], "title": "ScanRequest" }, "ScanResponse": { "description": "Response model for scan trigger operation", "properties": { "message": { "type": "string", "title": "Message" }, "scan_id": { "type": "integer", "title": "Scan Id" } }, "type": "object", "required": [ "message" ], "title": "ScanResponse" }, "ScannerType": { "description": "Type of vulnerability scanner", "type": "string", "enum": [ "CORTEX_NETWORK_SCANNER", "CORTEX_XDR_AGENT", "CORTEX_XDR_AGENTLESS" ], "title": "ScannerType" }, "REGEX": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "REGEX", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "REGEX" }, "REGEX_NOT": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "REGEX_NOT", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "REGEX_NOT" }, "RELATIVE_TIMESTAMP": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "RELATIVE_TIMESTAMP", "title": "Search Type" }, "SEARCH_VALUE": { "type": "integer", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "RELATIVE_TIMESTAMP", "description": "The value is after or equal to the server time minus the SEARCH_VALUE.\n\nThe server uses its current UTC time in milliseconds when evaluating.\nThis means repeated evaluation of the same message can\ntheoretically produce different results if they fall within\na millisecond window." }, "Sort": { "properties": { "FIELD": { "type": "string", "title": "Field" }, "ORDER": { "type": "string", "enum": [ "ASC", "DESC" ], "title": "Order" } }, "type": "object", "required": [ "FIELD", "ORDER" ], "title": "Sort" }, "ValidationError": { "properties": { "loc": { "items": { "anyOf": [ { "type": "string" }, { "type": "integer" } ] }, "type": "array", "title": "Location" }, "msg": { "type": "string", "title": "Message" }, "type": { "type": "string", "title": "Error Type" } }, "type": "object", "required": [ "loc", "msg", "type" ], "title": "ValidationError" }, "WILDCARD": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "WILDCARD", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "WILDCARD" }, "WILDCARD_NOT": { "properties": { "SEARCH_FIELD": { "type": "string", "title": "Search Field" }, "SEARCH_TYPE": { "type": "string", "const": "WILDCARD_NOT", "title": "Search Type" }, "SEARCH_VALUE": { "type": "string", "title": "Search Value" } }, "type": "object", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "title": "WILDCARD_NOT" }, "FilterTriplet": { "type": "object", "description": "A single filter condition consisting of a field name, comparison operator, and value.", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "properties": { "SEARCH_FIELD": { "type": "string", "description": "Field name to filter on." }, "SEARCH_TYPE": { "type": "string", "description": "Comparison operator.", "enum": [ "EQ", "NEQ", "GTE", "LTE", "CONTAINS", "NOT_CONTAINS", "IN", "NOT_IN", "RELATIVE_TIMESTAMP" ] }, "SEARCH_VALUE": { "description": "Value to compare against. Type depends on the field.", "oneOf": [ { "type": "string" }, { "type": "number" }, { "type": "boolean" }, { "type": "array", "items": { "type": "string" } } ] } } }, "FilterBlock": { "type": "object", "description": "Logical filter block. Supports AND / OR connectors with a list of `FilterTriplet` objects.", "properties": { "AND": { "type": "array", "items": { "$ref": "#/components/schemas/FilterTriplet" } }, "OR": { "type": "array", "items": { "$ref": "#/components/schemas/FilterTriplet" } } } }, "FindingsSortObject": { "type": "object", "description": "Sort criterion for vulnerability findings.", "required": [ "FIELD", "ORDER" ], "properties": { "FIELD": { "type": "string", "description": "Field to sort by. Allowed values: `EPSS_SCORE`, `CVSS_SCORE`, `CORTEX_VULNERABILITY_RISK_SCORE`.", "example": "CVSS_SCORE" }, "ORDER": { "type": "string", "enum": [ "ASC", "DESC" ], "example": "DESC" } } }, "VulnerabilityFinding": { "type": "object", "description": "A single vulnerability finding record representing one CVE on one asset. Only publicly allowed fields are returned.", "properties": { "platform_id": { "type": "string", "description": "Unique platform identifier for this finding.", "example": "c273519c3b61adfb7dc46547fbcbfa32" }, "asset_id": { "type": "string", "description": "Unique asset identifier (SHA-256 hash).", "example": "fef704015fd52a8495025f830b7483988d170f93b5807617761e4af827275a83" }, "asset_name": { "type": "string", "description": "Name of the affected asset.", "example": "SNMP Server at 89.170.90.209:161" }, "asset_type": { "type": "string", "description": "Type of the asset (e.g. SERVICE, HOST).", "example": "SERVICE" }, "asset_type_class": { "type": "string", "description": "High-level classification of the asset type.", "example": "External Surface" }, "asset_category": { "type": "string", "description": "Category of the asset (e.g. Cloud, Service, Endpoint).", "example": "Service" }, "asset_group_ids": { "type": "array", "items": { "type": "string" }, "description": "Asset group identifiers the asset belongs to.", "example": [] }, "type_id": { "type": "string", "description": "Internal numeric type identifier for the asset.", "example": "140000000" }, "cve_id": { "type": "string", "description": "CVE identifier.", "example": "CVE-2025-20169" }, "cve_description": { "type": "string", "description": "Full description of the CVE vulnerability.", "example": "A vulnerability in the SNMP subsystem of Cisco IOS Software..." }, "cve_publish_date": { "type": "integer", "format": "int64", "description": "Unix timestamp (milliseconds) when the CVE was published.", "example": 1738713600000 }, "published_date": { "type": "integer", "format": "int64", "description": "Unix timestamp (milliseconds) when the finding was published.", "example": 1738713600000 }, "cvss_score": { "type": "number", "format": "float", "description": "CVSS base score (0–10).", "example": 7.7 }, "cvss_severity": { "type": "string", "description": "CVSS severity rating.", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW", "INFORMATIONAL", "UNKNOWN" ], "example": "HIGH" }, "epss_score": { "type": "number", "format": "float", "description": "EPSS probability score (0–1).", "example": 0.00368 }, "cortex_vulnerability_risk_score": { "type": "number", "format": "float", "nullable": true, "description": "Cortex-computed composite risk score for this finding. Null if not yet calculated.", "example": null }, "cve_risk_factors": { "type": "array", "items": { "type": "string" }, "description": "List of risk factor labels associated with the CVE.", "example": [ "Attack vector: network", "High severity", "Attack complexity: low", "DoS - High" ] }, "has_kev": { "type": "boolean", "description": "Whether the CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog.", "example": false }, "exploitable": { "type": "boolean", "description": "Whether the vulnerability is considered exploitable.", "example": false }, "exploit_level": { "type": "string", "description": "Exploit maturity level.", "enum": [ "WEAPONIZED", "POC", "NO_KNOWN_EXPLOIT", "NONE", "UNKNOWN" ], "example": "NONE" }, "fix_available": { "type": "boolean", "description": "Whether a fix is available for this finding.", "example": false }, "fix_versions": { "type": "array", "items": { "type": "string" }, "description": "List of versions that contain a fix for this CVE.", "example": [] }, "fix_date": { "type": "integer", "format": "int64", "nullable": true, "description": "Unix timestamp (milliseconds) when a fix became available. Null if no fix date is known.", "example": null }, "affected_software": { "type": "string", "nullable": true, "description": "Name of the affected software component. Null if not applicable.", "example": null }, "internet_exposed": { "type": "boolean", "description": "Whether the asset is exposed to the internet.", "example": true }, "ipv4_addresses": { "type": "array", "items": { "type": "string" }, "description": "IPv4 addresses associated with the asset.", "example": [ "89.170.90.209" ] }, "ipv6_addresses": { "type": "array", "items": { "type": "string" }, "description": "IPv6 addresses associated with the asset.", "example": [] }, "operating_system": { "type": "string", "nullable": true, "description": "Operating system of the asset. Null if not detected.", "example": null }, "os_family": { "type": "string", "nullable": true, "description": "OS family of the asset (e.g. Windows, Linux). Null if not detected.", "example": null }, "location": { "type": "string", "nullable": true, "description": "Geographic or logical location of the asset. Null if not available.", "example": null }, "provider": { "type": "string", "description": "Infrastructure provider for the asset (e.g. ON_PREM, AWS, GCP, AZURE).", "example": "ON_PREM" }, "finding_sources": { "type": "array", "items": { "type": "string" }, "description": "List of sources that detected this finding.", "example": [ "CORTEX_ATTACK_SURFACE_MANAGEMENT" ] }, "source_tags": { "type": "array", "items": { "type": "string" }, "description": "Tags applied by the detection source.", "example": [ "asm.attribution.organization_names:[Acme Corp]" ] }, "has_issue": { "type": "boolean", "description": "Whether an issue has been raised for this finding.", "example": false }, "issue_id": { "type": "string", "nullable": true, "description": "Identifier of the associated issue, if any.", "example": null }, "remediation": { "type": "string", "nullable": true, "description": "Remediation guidance for this finding. Null if not available.", "example": null }, "package_in_use": { "type": "boolean", "nullable": true, "description": "Whether the affected package is actively in use on the asset. Null if not applicable.", "example": null }, "package_version": { "type": "string", "nullable": true, "description": "Version of the affected package. Null if not applicable.", "example": null }, "package_type": { "type": "string", "nullable": true, "description": "Type of the affected package (e.g. npm, pip, deb). Null if not applicable.", "example": null }, "package_purl": { "type": "string", "nullable": true, "description": "Package URL (PURL) for the affected package. Null if not applicable.", "example": null }, "package_licenses": { "type": "array", "items": { "type": "string" }, "description": "Licenses associated with the affected package.", "example": [] }, "package_author": { "type": "string", "nullable": true, "description": "Author of the affected package. Null if not applicable.", "example": null }, "package_symbols": { "type": "array", "items": { "type": "string" }, "description": "Symbols exported by the affected package.", "example": [] }, "package_file_creation_time": { "type": "integer", "format": "int64", "nullable": true, "description": "Unix timestamp (milliseconds) when the package file was created. Null if not applicable.", "example": null }, "origin_package_name": { "type": "string", "nullable": true, "description": "Name of the originating package. Null if not applicable.", "example": null }, "file_path": { "type": "string", "nullable": true, "description": "File path of the affected package on the asset. Null if not applicable.", "example": null }, "application_version": { "type": "string", "nullable": true, "description": "Version of the affected application. Null if not applicable.", "example": null }, "image": { "type": "string", "nullable": true, "description": "Container image identifier. Null if not a container finding.", "example": null }, "image_name": { "type": "string", "nullable": true, "description": "Container image name. Null if not a container finding.", "example": null }, "layer_id": { "type": "string", "nullable": true, "description": "Container image layer identifier. Null if not a container finding.", "example": null }, "derived_from_base_image": { "type": "boolean", "nullable": true, "description": "Whether the finding originates from a base image layer. Null if not applicable.", "example": null }, "is_derived": { "type": "boolean", "description": "Whether this finding is derived from another finding.", "example": false }, "is_root": { "type": "boolean", "nullable": true, "description": "Whether this is a root-level finding. Null if not applicable.", "example": null }, "volume_asset_id": { "type": "string", "nullable": true, "description": "Asset ID of the associated volume. Null if not applicable.", "example": null }, "volume_path": { "type": "string", "nullable": true, "description": "Path within the volume. Null if not applicable.", "example": null }, "partition_id": { "type": "string", "nullable": true, "description": "Partition identifier. Null if not applicable.", "example": null }, "partition_id_type": { "type": "string", "nullable": true, "description": "Type of the partition identifier. Null if not applicable.", "example": null }, "disk_name": { "type": "string", "nullable": true, "description": "Disk name associated with the finding. Null if not applicable.", "example": null }, "first_observed": { "type": "integer", "format": "int64", "description": "Unix timestamp (milliseconds) when the finding was first observed.", "example": 1764890719158 }, "last_observed": { "type": "integer", "format": "int64", "description": "Unix timestamp (milliseconds) when the finding was last observed.", "example": 1764715866000 } } }, "GetVulnerabilityFindingsRequest": { "type": "object", "description": "Request body for paginated vulnerability findings search.", "properties": { "filter": { "allOf": [ { "$ref": "#/components/schemas/FilterBlock" } ], "description": "Optional filter block. Filterable fields: `ASSET_NAME`, `ASSET_GROUP_IDS`, `ASSET_CATEGORY`, `CVE_ID`, `CVSS_SEVERITY`, `PLATFORM_ID`, `FIX_AVAILABLE`, `PACKAGE_IN_USE`, `HAS_KEV`, `EXPLOIT_LEVEL`, `EPSS_SCORE`, `INTERNET_EXPOSED`, `FIRST_OBSERVED`, `LAST_OBSERVED`." }, "sort": { "type": "array", "items": { "$ref": "#/components/schemas/FindingsSortObject" }, "description": "Optional sort criteria. Sortable fields: `EPSS_SCORE`, `CVSS_SCORE`, `CORTEX_VULNERABILITY_RISK_SCORE`." }, "page_size": { "type": "integer", "minimum": 1, "maximum": 10000, "default": 1000, "description": "Number of records to return per page. Defaults to `1000`; the maximum allowed value is `10000`. Requests exceeding the maximum return HTTP `400`.", "example": 1000 }, "next_page_token": { "type": "string", "description": "Opaque token returned by a previous response to fetch the next page. Omit on the first request.", "example": "eyJsYXN0X2VsZW1lbnQiOiAxMjM0fQ==" } } }, "GetVulnerabilityFindingsResponse": { "type": "object", "description": "Paginated response containing vulnerability findings.", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/VulnerabilityFinding" } }, "filter_count": { "type": "integer", "description": "Total number of findings matching the applied filter.", "example": 342 }, "total_count": { "type": "integer", "description": "Total number of findings across all filters.", "example": 10500 }, "next_page_token": { "type": "string", "description": "Present only when additional pages exist. Pass this value as `next_page_token` in the next request.", "example": "eyJsYXN0X2VsZW1lbnQiOiA1Njc4fQ==" } } } } }, "GetVulnerabilityFindingByIdResponse": { "type": "object", "description": "Response containing a single vulnerability finding by platform ID.", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "array", "minItems": 1, "maxItems": 1, "items": { "$ref": "#/components/schemas/VulnerabilityFinding" } } } } } }, "TimeframeAbsolute": { "type": "object", "description": "Absolute time range (both fields required together).", "required": [ "from", "to" ], "properties": { "from": { "type": "integer", "format": "int64", "description": "Start of the timeframe as a Unix timestamp in **milliseconds**.", "example": 15989076 }, "to": { "type": "integer", "format": "int64", "description": "End of the timeframe as a Unix timestamp in **milliseconds**.", "example": 1771482089874 } } }, "GetVulnerabilityFindingsSnapshotRequest": { "type": "object", "description": "Request parameters for the vulnerability findings snapshot export.", "properties": { "filter": { "type": "object", "description": "Optional filter block. An `AND`/`OR` group of clauses, each with `SEARCH_FIELD` (lowercase), `SEARCH_TYPE`, and `SEARCH_VALUE`. Only the allow-listed snapshot fields may be used." }, "limit": { "type": "integer", "description": "Maximum number of rows to return. Omit for the full dataset.", "example": 10000 }, "timeframe": { "allOf": [ { "$ref": "#/components/schemas/TimeframeAbsolute" } ], "description": "Optional XQL timeframe using an absolute range (`from` + `to`). When omitted the server's default lookback window is used." } } }, "FindingsErrorResponse": { "type": "object", "description": "Standard error response for vulnerability findings endpoints.", "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "integer", "example": 400 }, "err_msg": { "type": "string", "example": "Invalid filter parameters" }, "err_extra": { "type": "string", "example": "Field 'unknown_field' is not allowed" } } } } } } } }