{ "openapi": "3.0.0", "x-hideTryItPanel": true, "info": { "version": "Cortex XDR 5.x", "title": "Cloud Onboarding APIs", "description": "Public APIs for cloud onboarding and instance management.\n\nThe following API categories are included:\n- **Cloud instance management**: These APIs enable you to create a cloud instance in *pending* state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XDR and you can enable, disable, or delete them. You can also edit the cloud instance configuration.\n- **Cloud account management**: The cloud account APIs allow you to manage accounts within a specific cloud instance. You can have multiple cloud accounts within one cloud instance. Use these APIs to get the cloud accounts in the specified cloud instance and to enable or disable cloud accounts.\n- **Outpost management**: Use these APIs to create or edit templates for onboarding outposts. \n- **General**: These APIs are for general management.\n\n**Required licenses:** Requires the Cortex Cloud Posture Management add-on.", "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" }, "license": { "name": "Proprietary", "url": "https://www.paloaltonetworks.com/legal" } }, "servers": [ { "url": "https://api-yourfqdn", "description": "" } ], "security": [], "paths": { "/public_api/v1/cloud_onboarding/create_instance_template": { "post": { "summary": "Create a cloud onboarding integration template", "operationId": "postCreateInstanceTemplate", "description": "Create a template to facilitate the seamless setup of CSP data in Cortex.\nDefine the scope and specify the scan mode. For full control of the setup, you can use the advanced settings. Based on the onboarding settings, Cortex generates an authentication template to establish trust to the CSP and grant permissions to Cortex. Cortex Cloud creates an instance in *pending* state.\nThe API returns a link to download the template from the Cortex tenant.\n\n**Note:** If the template execution in the CSP fails, there is currently no manual execution of the template by API. You must perform manual execution in the UI.\n\nFor scope modifications, the parameters are CSP-specific. For AWS, use `accounts`, for GCP, use `projects`, and for Azure, use `subscriptions`.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateInstanceTemplateRequestData" }, "examples": { "AWS, Managed scan, region excluded, audit logs enabled with custom collection": { "value": { "request_data": { "scope": "ACCOUNT", "scan_mode": "MANAGED", "instance_name": "AWS 1 Instance", "scope_modifications": { "regions": { "enabled": true, "type": "EXCLUDE", "regions": [ "us-east-1" ] } }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": true, "registry_scanning": false, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true }, "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED" } }, "cloud_provider": "AWS", "cloud_partition": "COMMERCIAL" } } }, "OCI, custom log collection with specified regions": { "value": { "request_data": { "scope": "ACCOUNT", "instance_name": "test-oci-instance-01", "scan_mode": "OUTPOST", "scan_env_id": "acafb912391c44f59a01b6512317abf9", "cloud_provider": "OCI", "scope_modifications": { "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-phoenix-1", "us-ashburn-1" ] } }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": true, "registry_scanning": false, "serverless_scanning": false, "agentless_disk_scanning": true }, "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "CUSTOM", "custom_collectors": [ { "region": "us-phoenix-1", "bucket_name": "prod-audit-logs-bucket", "compartment_ocid": "ocid1.compartment.oc1..xxxxxxxxxxxxxx" }, { "region": "us-ashburn-1", "bucket_name": "dr-audit-logs-bucket", "compartment_ocid": "ocid1.compartment.oc1..yyyyyyyyyyyyyy" } ] } } } } }, "AWS, Organization scope, automated audit logs with data events": { "value": { "request_data": { "scope": "ORGANIZATION", "scan_mode": "MANAGED", "instance_name": "AWS Org Instance", "cloud_provider": "AWS", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED", "data_events": true } }, "scope_modifications": { "organizational_units": { "enabled": true, "type": "EXCLUDE", "organizational_unit_ids": [ "ou-ab12-xxxxxxxx" ] }, "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-east-1", "us-west-2", "eu-west-1" ] } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ECR" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": true, "automation": true, "automation_log_level": "Verbose" } } } }, "AWS GOV, Account scope, BYOB Control Tower audit logs": { "value": { "request_data": { "scope": "ORGANIZATION", "scan_mode": "MANAGED", "instance_name": "AWS GOV Org Instance", "cloud_provider": "AWS", "cloud_partition": "GOV", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "CUSTOM", "is_control_tower_byob": true } }, "scope_modifications": { "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-gov-east-1", "us-gov-west-1" ] } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": false, "registry_scanning": true, "registry_scanning_options": { "type": "ECR" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": false, "automation": false } } } }, "Azure, Tenant scope, managed scan, all capabilities": { "value": { "request_data": { "scope": "ORGANIZATION", "scan_mode": "MANAGED", "instance_name": "Azure Tenant Instance", "cloud_provider": "AZURE", "cloud_partition": "COMMERCIAL", "account_details": { "organization_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" }, "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED" } }, "scope_modifications": { "management_groups": { "enabled": true, "type": "EXCLUDE", "management_group_ids": [ "mg-sandbox" ] }, "regions": { "enabled": false, "type": null, "regions": null } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": true, "automation": true, "automation_log_level": "Debug" } } } }, "Azure GOV, Subscription scope, no DSPM": { "value": { "request_data": { "scope": "ACCOUNT", "scan_mode": "MANAGED", "instance_name": "Azure GOV Subscription Instance", "cloud_provider": "AZURE", "cloud_partition": "GOV", "account_details": { "organization_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" }, "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED" } }, "scope_modifications": { "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "usgovvirginia", "usgovtexas" ] } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": false, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": false, "automation": false } } } }, "GCP, Organization scope, managed scan, with Google Workspace": { "value": { "request_data": { "scope": "ORGANIZATION", "scan_mode": "MANAGED", "instance_name": "GCP Org Instance", "cloud_provider": "GCP", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true } }, "scope_modifications": { "folders": { "enabled": true, "type": "EXCLUDE", "folder_ids": [ "123456789012" ] }, "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-central1", "europe-west1", "asia-east1" ] } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": true, "automation": true, "automation_log_level": "OFF" }, "gcp_workspace": { "enabled": true, "customer_ids": [ "C0xxxxxxxxx" ] } } } }, "GCP, Project scope, outpost scan, specific projects included": { "value": { "request_data": { "scope": "ACCOUNT", "scan_mode": "OUTPOST", "scan_env_id": "acafb912391c44f59a01b6512317abf9", "instance_name": "GCP Project Outpost Instance", "cloud_provider": "GCP", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true } }, "scope_modifications": { "projects": { "enabled": true, "type": "INCLUDE", "project_ids": [ "my-project-prod", "my-project-staging" ] }, "regions": { "enabled": false, "type": null, "regions": null } }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": false, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": false, "automation": false } } } }, "OCI, Organization scope, managed scan, custom audit log collectors": { "value": { "request_data": { "scope": "ORGANIZATION", "scan_mode": "MANAGED", "instance_name": "OCI Org Instance", "cloud_provider": "OCI", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "CUSTOM", "custom_collectors": [ { "region": "us-ashburn-1", "bucket_name": "prod-audit-logs", "compartment_ocid": "ocid1.compartment.oc1..xxxxxxxxxxxxxx" }, { "region": "eu-frankfurt-1", "bucket_name": "eu-audit-logs", "compartment_ocid": "ocid1.compartment.oc1..yyyyyyyyyyyyyy" } ] } }, "scope_modifications": { "compartments": { "enabled": true, "type": "EXCLUDE", "compartment_ids": [ "ocid1.compartment.oc1..zzzzzzzzzzzzzz" ] }, "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-ashburn-1", "eu-frankfurt-1" ] } }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": false, "agentless_disk_scanning": true, "kubernetes_security": false, "automation": false } } } }, "Alibaba Cloud, Account scope, managed scan, agentless disk scanning only": { "value": { "request_data": { "scope": "ACCOUNT", "scan_mode": "MANAGED", "instance_name": "Alibaba Cloud Account Instance", "cloud_provider": "ALIBABA_CLOUD", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "scope_modifications": { "accounts": { "enabled": true, "type": "INCLUDE", "account_ids": [ "1234567890123456" ] }, "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "cn-hangzhou", "cn-shanghai" ] } }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": false, "registry_scanning": false, "serverless_scanning": false, "agentless_disk_scanning": true } } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateInstanceResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud instance management" ] } }, "/public_api/v1/cloud_onboarding/get_instance_details": { "post": { "summary": "Get cloud instance details", "operationId": "postGetInstanceDetails", "description": "Get the configuration details of the specified cloud instance.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetInstanceRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetInstanceDetailsResponse" }, "examples": { "Example 1": { "value": { "reply": { "id": "e21d20cc3cad49d79fffa968c64d688d", "collector": "AWS", "instance_name": "AWS-1", "scope": "ACCOUNT", "tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "status": "ENABLED", "cloud_provider": "AWS", "scan": { "scan_method": "MANAGED" }, "security_capabilities": [ { "name": "PERMISSIONS", "description": "Permissions", "status": 1 }, { "name": "DISCOVERY", "description": "Discovery Engine", "status": 0 }, { "name": "ADS", "description": "Agentless Disk Scanning", "status": 2 }, { "name": "DSPM", "description": "Data Security Scanning", "status": 2 }, { "name": "AUDIT_LOGS", "description": "Audit Logs", "status": 2 }, { "name": "REGISTRY", "description": "Registry Scanning", "status": 2 }, { "name": "SERVERLESS", "description": "Serverless Scanning", "status": 2 }, { "name": "IDENTITY_SECURITY", "description": "Identity Security", "status": 0 }, { "name": "AUTOMATION", "description": "Automation", "status": 2 }, { "name": "KUBERNETES_SECURITY", "description": "Kubernetes Security", "status": 2 } ], "upgrade_available": true, "cloud_partition": "COMMERCIAL", "collection_configuration": "{\"audit_logs\": {\"enabled\": false, \"data_events\": false}}", "additional_capabilities": "{\"automation\": false, \"xsiam_analytics\": false, \"registry_scanning\": false, \"kubernetes_security\": false, \"serverless_scanning\": false, \"automation_log_level\": \"OFF\", \"agentless_disk_scanning\": false, \"registry_scanning_options\": {\"type\": \"ALL\"}, \"data_security_posture_management\": false}" } } } } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud instance management" ] } }, "/public_api/v1/cloud_onboarding/get_instances": { "post": { "summary": "Get all or filtered cloud instances", "operationId": "postGetInstances", "description": "Get the configuration details of all or filtered cloud instances. You can use a filter to exclude instances in a PENDING state.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListInstancesRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetInstancesResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud instance management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/edit_instance": { "post": { "summary": "Edit a cloud instance", "operationId": "postEditInstance", "description": "Edit the configuration settings of the specified cloud instance. After editing, there is a notice in the UI that there are pending changes. The changes are applied after you execute the template in the CSP after editing. \n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EditInstanceRequestData" }, "examples": { "AWS GOV": { "value": { "request_data": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "scan_env_id": "", "instance_name": "AWS GOV Instance Updated", "cloud_provider": "AWS", "cloud_partition": "GOV", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED", "data_events": true } }, "scope_modifications": { "accounts": { "enabled": true, "type": "EXCLUDE", "account_ids": [ "sample-account-1" ] }, "regions": { "enabled": false, "type": null, "regions": null } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": false, "automation": false, "registry_scanning_options": { "type": "ALL" } } } } }, "AWS COMMERCIAL, update org-level scope and enable automation": { "value": { "request_data": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "scan_env_id": "", "instance_name": "AWS Org Instance Updated", "cloud_provider": "AWS", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED", "data_events": true } }, "scope_modifications": { "organizational_units": { "enabled": true, "type": "EXCLUDE", "organizational_unit_ids": [ "ou-ab12-xxxxxxxx", "ou-cd34-yyyyyyyy" ] }, "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-east-1", "us-west-2" ] } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ECR" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": true, "automation": true, "automation_log_level": "Verbose" } } } }, "Azure COMMERCIAL, update management group exclusions": { "value": { "request_data": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "scan_env_id": "", "instance_name": "Azure Tenant Instance Updated", "cloud_provider": "AZURE", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED" } }, "scope_modifications": { "management_groups": { "enabled": true, "type": "EXCLUDE", "management_group_ids": [ "mg-sandbox", "mg-dev" ] }, "regions": { "enabled": false, "type": null, "regions": null } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": false, "automation": false } } } }, "Azure GOV, update region filter, no DSPM": { "value": { "request_data": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "scan_env_id": "", "instance_name": "Azure GOV Instance Updated", "cloud_provider": "AZURE", "cloud_partition": "GOV", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "AUTOMATED" } }, "scope_modifications": { "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "usgovvirginia", "usgovtexas", "usgovarizona" ] } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": false, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": false, "automation": false } } } }, "GCP, update folder exclusions and enable Workspace": { "value": { "request_data": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "scan_env_id": "", "instance_name": "GCP Org Instance Updated", "cloud_provider": "GCP", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true } }, "scope_modifications": { "folders": { "enabled": true, "type": "EXCLUDE", "folder_ids": [ "123456789012", "987654321098" ] }, "regions": { "enabled": false, "type": null, "regions": null } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "kubernetes_security": true, "automation": true, "automation_log_level": "Debug" }, "gcp_workspace": { "enabled": true, "customer_ids": [ "C0xxxxxxxxx" ] } } } }, "OCI, update compartment filter and custom collectors": { "value": { "request_data": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "scan_env_id": "", "instance_name": "OCI Org Instance Updated", "cloud_provider": "OCI", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "collection_configuration": { "audit_logs": { "enabled": true, "collection_method": "CUSTOM", "custom_collectors": [ { "region": "us-ashburn-1", "bucket_name": "updated-audit-logs", "compartment_ocid": "ocid1.compartment.oc1..xxxxxxxxxxxxxx" } ] } }, "scope_modifications": { "compartments": { "enabled": false, "type": null, "compartment_ids": null }, "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-ashburn-1", "us-phoenix-1" ] } }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": false, "agentless_disk_scanning": true, "kubernetes_security": false, "automation": false } } } }, "Alibaba Cloud, update region filter": { "value": { "request_data": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "scan_env_id": "", "instance_name": "Alibaba Cloud Instance Updated", "cloud_provider": "ALIBABA_CLOUD", "cloud_partition": "COMMERCIAL", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "scope_modifications": { "accounts": { "enabled": true, "type": "INCLUDE", "account_ids": [ "1234567890123456", "6543210987654321" ] }, "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "cn-hangzhou", "cn-shanghai", "cn-beijing" ] } }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": false, "registry_scanning": false, "serverless_scanning": false, "agentless_disk_scanning": true } } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EditInstanceResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud instance management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/enable_disable_instance": { "post": { "summary": "Enable or disable cloud instances", "operationId": "postEnableDisableInstance", "description": "Enable or disable the cloud instances specified by their instance IDs. To obtain the instance IDs, use [Get Instances](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/cloud-instance-management#post-public_api-v1-cloud_onboarding-get_instances).\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnableDisableInstanceRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnableDisableInstancesResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud instance management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/delete_instance": { "post": { "summary": "Delete the specified cloud instances", "operationId": "postDeleteInstance", "description": "Delete the specified cloud instances.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteInstanceRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BaseResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud instance management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/get_accounts": { "post": { "summary": "Get accounts in the specified cloud instances", "operationId": "postGetAccounts", "description": "List accounts and their details for the specified cloud instance.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAccountsRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAccountsResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud account management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/enable_disable_account": { "post": { "summary": "Enable or disable cloud accounts", "operationId": "postEnableDisableAccount", "description": "Enable or disable the specified cloud accounts within a specific cloud instance.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnableDisableAccountRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EnableDisableAccountResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Cloud account management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/create_outpost_template": { "post": { "summary": "Create an outpost template", "operationId": "postCreateOutpostTemplate", "description": "Create a template to onboard an outpost. Define the custom resource tags you want associated with the outpost and Cortex generates an authentication template to establish trust to the CSP and grant permissions to Cortex.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOutpostTemplateRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOutpostResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Outpost management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/edit_outpost": { "post": { "summary": "Edit an outpost", "operationId": "postEditOutpost", "description": "Edit the custom resource tags of the specified outpost. The template must be applied in the CSP after editing.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EditOutpostRequest" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EditOutpostResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "Outpost management" ] }, "parameters": [] }, "/public_api/v1/cloud_onboarding/list_regions": { "parameters": [], "post": { "summary": "Get available regions for a CSP", "operationId": "postListRegions", "description": "Get a list of all available regions for the specified cloud service provider.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListCloudProviderRegionsRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListCloudProviderRegionsResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "General" ] } }, "/public_api/v1/cloud_onboarding/get_azure_approved_tenants": { "parameters": [], "post": { "summary": "Get approved Azure tenants", "operationId": "postGetAzureApprovedTenants", "description": "In order to onboard an Azure tenant to Cortex, Cortex must first be added as an enterprise-approved application on the tenant. Get a list of all the Azure tenants that are already enterprise-approved.\n\n**Required license:** Cortex Cloud Posture Management", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAzureApprovedTenantsResponse" } } } }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "tags": [ "General" ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "request_data": { "cloud_partition": "GOV" } } }, "properties": { "request_data": { "type": "object", "properties": { "cloud_partition": { "enum": [ "COMMERCIAL", "GOV" ], "description": "Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants." } } } } } } } } } }, "/public_api/v1/cloud_onboarding/get_outposts": { "post": { "summary": "Get all or filtered outposts", "tags": [ "Outpost management" ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "type": "object", "x-examples": { "Example 1": { "reply": { "DATA": [ { "cloud_provider": "string", "outpost_id": "string", "created_at": "string", "type": "string" } ], "FILTER_COUNT": 2, "TOTAL_COUNT": 7 } } }, "properties": { "reply": { "type": "object", "properties": { "DATA": { "type": "array", "items": { "type": "object", "properties": { "cloud_provider": { "type": "string" }, "outpost_id": { "type": "string" }, "created_at": { "type": "string" }, "type": { "type": "string" }, "cloud_partition": { "type": "string" } } } }, "FILTER_COUNT": { "type": "integer" }, "TOTAL_COUNT": { "type": "integer" } } } } }, "examples": { "Example 1": { "value": { "reply": { "DATA": [ { "cloud_provider": "AWS", "outpost_id": "094935393dcf46128e5a2138a51bd54a", "created_at": "1748309918599", "type": "MANAGED" } ], "FILTER_COUNT": 1, "TOTAL_COUNT": 1 } } } } } } } }, "operationId": "postGetOutposts", "parameters": [ { "schema": { "type": "string", "example": "UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP " }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "241" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "filter_data": { "type": "object", "properties": { "sort": { "type": "array", "items": { "type": "object", "properties": { "FIELD": { "type": "string" }, "ORDER": { "type": "string" } } } }, "filter": { "type": "object", "properties": { "OR": { "type": "array", "items": { "type": "object", "properties": { "SEARCH_FIELD": { "type": "string" }, "SEARCH_TYPE": { "type": "string" }, "SEARCH_VALUE": { "type": "string" } } } } } }, "paging": { "type": "object", "properties": { "from": { "type": "integer" }, "to": { "type": "integer" } } } } } } } }, "x-examples": { "Example 1": { "request_data": { "filter_data": { "sort": [ { "FIELD": "CREATED_AT", "ORDER": "ASC" } ], "filter": { "OR": [ { "SEARCH_FIELD": "CLOUD_PROVIDER", "SEARCH_TYPE": "CONTAINS", "SEARCH_VALUE": "AWS" }, { "SEARCH_FIELD": "CLOUD_PROVIDER", "SEARCH_TYPE": "CONTAINS", "SEARCH_VALUE": "GCP" } ] }, "paging": { "from": 0, "to": 20 } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "filter_data": { "sort": [ { "FIELD": "CREATED_AT", "ORDER": "ASC" } ], "filter": { "OR": [ { "SEARCH_FIELD": "CLOUD_PROVIDER", "SEARCH_TYPE": "CONTAINS", "SEARCH_VALUE": "AWS" }, { "SEARCH_FIELD": "CLOUD_PROVIDER", "SEARCH_TYPE": "CONTAINS", "SEARCH_VALUE": "GCP" } ] }, "paging": { "from": 0, "to": 20 } } } } } } } } }, "description": "Get a list of all or filtered outposts.\n\n**Required license:** Cortex Cloud Posture Management" } }, "/public_api/v1/cloud_onboarding/get_identifiers": { "post": { "operationId": "post-public_api-v1-cloud_onboarding-get_identifiers", "tags": [ "Cloud instance management" ], "summary": "Get identifier roles for cloud instance", "description": "List all of the identifiers roles for the cloud instance. In the UI, these details are listed under **Authorization details** of the cloud instance.\n\n**Required license:** In Cortex XSIAM Premium, Cortex XSIAM Enterprise, or Cortex XSIAM NG SIEM, requires the Cortex Cloud Posture Management add-on. In Cortex XSIAM Enterprise Plus, requires the Data Collection add-on.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetIdentifiersRequestData", "properties": { "request_data": { "type": "object", "description": "Request data wrapper" } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetIdentifiersResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/cloud_onboarding/create_instance": { "post": { "tags": [ "Manual onboarding" ], "summary": "Create a manually provisioned cloud integration instance", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nCreate a cloud integration instance from manually provisioned CSP resources. Use this endpoint after you have:\n\n1. Called `POST /public_api/v1/cloud_onboarding/get_manual_connector_identifiers` to obtain the identifiers file.\n2. Created all required CSP resources (IAM roles, service accounts, audit-log infrastructure) using the values in the `identifiers` section.\n3. Populated the `manual_details` section of the identifiers file with the values retrieved from your CSP environment.\n\nProvide the same `cloud_provider`, `scope`, `scan_mode`, and capability configuration used when generating the identifiers, together with the completed `manual_details` object.\n\n**CSP support:** AWS, Azure, and GCP only.\n\n**Scan modes:** `MANAGED` (recommended) or `OUTPOST`. When `scan_mode` is `OUTPOST`, `outpost_id` is required — retrieve the outpost ID from `POST /public_api/v1/cloud_onboarding/get_outposts`.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateInstanceRequestData" }, "examples": { "AWS, account scope, with audit logs": { "value": { "request_data": { "cloud_provider": "AWS", "scope": "ACCOUNT", "scan_mode": "MANAGED", "instance_name": "AWS Account Instance", "manual_details": { "organization_id": "r-d03p", "account_id": "783764590904", "account_name": "my-aws-account", "role_arn": "arn:aws:iam::783764590904:role/CortexPlatformRole-m-a-9994395176702", "external_id": "320ee22d-a0dc-4104-a4ed-6b3b93e2b543", "cloudtrail_role": "arn:aws:iam::783764590904:role/cortex-logs-ingestion-access-m-a-9994395176702", "sqs_url": "https://sqs.us-east-1.amazonaws.com/783764590904/cortex-ct-logs-queue-783764590904-m-a-9994395176702" }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": false, "registry_scanning": false, "serverless_scanning": false, "automation": false, "agentless_disk_scanning": false, "kubernetes_security": false }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "AUTOMATED" } }, "scope_modifications": { "regions": { "enabled": false } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } }, "AWS, organization scope, no audit logs": { "value": { "request_data": { "cloud_provider": "AWS", "scope": "ORGANIZATION", "scan_mode": "MANAGED", "instance_name": "AWS Org Instance", "manual_details": { "organization_id": "r-d03p", "account_id": "783764590904", "account_name": "", "role_arn": "arn:aws:iam::783764590904:role/CortexPlatformRole-m-a-9994395176702", "external_id": "320ee22d-a0dc-4104-a4ed-6b3b93e2b543" }, "additional_capabilities": { "xsiam_analytics": false }, "collection_configuration": { "audit_logs": { "enabled": false, "data_events": false } }, "scope_modifications": { "regions": { "enabled": false }, "accounts": { "enabled": false } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } }, "AWS, account group scope, all capabilities": { "value": { "request_data": { "cloud_provider": "AWS", "scope": "ACCOUNT_GROUP", "scan_mode": "MANAGED", "instance_name": "AWS Account Group Instance", "manual_details": { "organization_id": "r-d03p", "account_id": "180294190420", "account_name": "cortex-platform-labs", "role_arn": "arn:aws:iam::180294190420:role/CortexPlatformRole-m-ag-9996373889750-ou-d03p-ydtd5f2g", "external_id": "0d771024-fe37-4f8f-8085-c400acb68bbb", "account_group": "ou-d03p-ydtd5f2g", "outpost_scanner_role_arn": "arn:aws:iam::180294190420:role/CortexPlatformScannerRole-m-ag-9996373889750-ou-d03p-ydtd5f2g", "cloudtrail_role": "arn:aws:iam::180294190420:role/cortex-logs-ingestion-access-m-ag-9996373889750-ou-d03p-ydtd5f2g", "sqs_url": "https://sqs.us-east-1.amazonaws.com/180294190420/cortex-ct-logs-queue-180294190420-m-ag-9996373889750-ou-d03p-ydtd5f2g" }, "additional_capabilities": { "xsiam_analytics": false, "data_security_posture_management": false, "registry_scanning": false, "serverless_scanning": false, "automation": false, "agentless_disk_scanning": false, "kubernetes_security": false }, "collection_configuration": { "audit_logs": { "enabled": false, "data_events": false } }, "scope_modifications": { "regions": { "enabled": false }, "accounts": { "enabled": false } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } }, "Azure, account scope, all capabilities enabled": { "value": { "request_data": { "cloud_provider": "AZURE", "scope": "ACCOUNT", "scan_mode": "MANAGED", "manual_details": { "tenant_id": "194cfdc7-41f0-4eec-8bfb-1b805cf74f53", "client_id": "3a3f8838-b1b3-4494-9bc0-6c9bd87017cb", "subscription_id": "a00175b3-230f-49db-b68f-0b35f61bf305", "resource_group_name": "cortex-platform-rg", "resource_group_location": "eastus", "ads_image_gallery_resource_id": "/subscriptions/a00175b3-230f-49db-b68f-0b35f61bf305/resourceGroups/cortex-platform-rg/providers/Microsoft.Compute/galleries/CortexAdsGallery", "eventhub_name": "cortex-eventhub", "eventhub_resource_group_name": "cortex-platform-rg", "eventhub_namespace": "cortex-eh-namespace", "azure_audit_eventhub_consumer_group_name": "cortex-cg", "storage_account_name": "cortexstorageaccount", "eventhub_audit_client_id": "c4e5b52a-c846-486c-a2ba-66254ad37eb0" }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "automation": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "kubernetes_security": true, "upload_files_to_wildfire": false }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "AUTOMATED" } }, "scope_modifications": { "regions": { "enabled": false } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } }, "Azure, organization scope, all capabilities enabled": { "value": { "request_data": { "cloud_provider": "AZURE", "scope": "ORGANIZATION", "scan_mode": "MANAGED", "manual_details": { "tenant_id": "194cfdc7-41f0-4eec-8bfb-1b805cf74f53", "resource_group_name": "cortex-platform-rg2", "resource_group_location": "eastus", "ads_image_gallery_resource_id": "/subscriptions/c04e24d1-f0a9-4025-9b54-dc9c81294d3b/resourceGroups/cortex-platform-rg2/providers/Microsoft.Compute/galleries/CortexAdsGallery2", "eventhub_name": "cortex-eventhub2", "eventhub_resource_group_name": "cortex-platform-rg2", "eventhub_namespace": "cortex-eh-namespace2", "azure_audit_eventhub_consumer_group_name": "cortex-cg2", "storage_account_name": "cortexstorageaccount2", "eventhub_audit_client_id": "40b77f9c-d1a5-44a8-8dc3-0faba3cfa1cb" }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "automation": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "kubernetes_security": true, "upload_files_to_wildfire": false }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "AUTOMATED" } }, "scope_modifications": { "regions": { "enabled": false }, "subscriptions": { "enabled": false } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } }, "GCP, account scope, all capabilities enabled": { "value": { "request_data": { "cloud_provider": "GCP", "scope": "ACCOUNT", "scan_mode": "MANAGED", "instance_name": "GCP Account Instance", "manual_details": { "account_id": "my-gcp-project", "organization_id": "1088839764044", "service_account_email": "cortex-platform@my-gcp-project.iam.gserviceaccount.com", "audit_service_account_email": "cortex-audit@my-gcp-project.iam.gserviceaccount.com", "outpost_scanner_service_account_email": "cortex-scanner@my-gcp-project.iam.gserviceaccount.com", "audit_pubsub_subscription_id": "projects/my-gcp-project/subscriptions/cortex-subscription" }, "additional_capabilities": { "automation": true, "xsiam_analytics": true, "registry_scanning": true, "kubernetes_security": true, "serverless_scanning": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "registry_scanning_options": { "type": "ALL" } }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false } }, "scope_modifications": { "regions": { "enabled": true, "type": "INCLUDE", "regions": [ "us-east1" ] } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } }, "GCP, organization scope": { "value": { "request_data": { "cloud_provider": "GCP", "scope": "ORGANIZATION", "scan_mode": "MANAGED", "instance_name": "GCP Org Instance", "manual_details": { "account_id": "my-gcp-project", "organization_id": "1088839764044", "service_account_email": "cortex-platform@my-gcp-project.iam.gserviceaccount.com", "audit_service_account_email": "cortex-audit@my-gcp-project.iam.gserviceaccount.com", "outpost_scanner_service_account_email": "cortex-scanner@my-gcp-project.iam.gserviceaccount.com", "audit_pubsub_subscription_id": "projects/my-gcp-project/subscriptions/cortex-subscription" }, "additional_capabilities": { "automation": true, "xsiam_analytics": true, "registry_scanning": true, "kubernetes_security": true, "serverless_scanning": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "registry_scanning_options": { "type": "ALL" } }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false } }, "scope_modifications": { "regions": { "enabled": false }, "projects": { "enabled": false } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateInstanceResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "operationId": "createInstance" } }, "/public_api/v1/cloud_onboarding/delete_instance_template": { "post": { "tags": [ "Manual onboarding" ], "summary": "Delete the specified integration instance template", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nDelete the specified integration instance template by its template ID. Templates are generated when you call the onboarding or edit endpoints and are used to deploy CSP resources. A single pending instance can produce multiple templates.\n\nDeleting a template does not delete the cloud instance itself, nor does it remove any resources already deployed in your CSP. To remove the cloud instance, use `POST /public_api/v1/cloud_onboarding/delete_instance`.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeleteInstanceTemplateRequestData" }, "examples": { "Delete a template by ID": { "value": { "request_data": { "template_id": "5396d8d68fd3464790afbbbbb25cce9b" } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BaseResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "400": { "$ref": "#/components/responses/BadRequest" } }, "operationId": "deleteInstanceTemplate" } }, "/public_api/v1/cloud_onboarding/edit_manual_instance": { "post": { "tags": [ "Manual onboarding" ], "summary": "Edit a manually provisioned cloud integration instance", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nEdit an existing manually-onboarded cloud integration instance. Provide the connector ID together with the updated configuration and the refreshed `manual_details`.\n\n**Immutable fields:** `scope`, `scan_mode`, and `manual_details.account_id` (or equivalent root account identifier) cannot be changed after onboarding. To change these, delete the instance and create a new one.\n\n**Mutable fields:** security capabilities (`additional_capabilities`), scope filters (`scope_modifications`), audit log configuration (`collection_configuration`), instance name, and custom resource tags.\n\nAfter editing, Cortex regenerates the authentication template. Re-deploy the updated template in your CSP to apply the changes. Until the template is re-deployed, the instance remains in a pending-update state.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EditManualConnectorInstanceRequestData" }, "examples": { "AWS, enable all capabilities": { "value": { "request_data": { "id": "150401c7f0254616a6db08127e0f479e", "cloud_provider": "AWS", "scope": "ACCOUNT", "scan_mode": "MANAGED", "manual_details": { "organization_id": "r-d03p", "account_id": "783764590904", "account_name": "my-aws-account", "role_arn": "arn:aws:iam::783764590904:role/CortexPlatformRole-m-a-9994395176702", "outpost_scanner_role_arn": "arn:aws:iam::783764590904:role/CortexPlatformScannerRole-m-a-9994395176702", "external_id": "320ee22d-a0dc-4104-a4ed-6b3b93e2b543", "cloudtrail_role": "arn:aws:iam::783764590904:role/cortex-logs-ingestion-access-m-a-9994395176702", "sqs_url": "https://sqs.us-east-1.amazonaws.com/783764590904/cortex-ct-logs-queue-783764590904-m-a-9994395176702" }, "additional_capabilities": { "automation": true, "xsiam_analytics": true, "registry_scanning": true, "kubernetes_security": true, "serverless_scanning": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "upload_files_to_wildfire": false, "registry_scanning_options": { "type": "ALL" } }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "CUSTOM" } }, "scope_modifications": { "regions": { "enabled": false } }, "custom_resources_tags": [ { "key": "edit", "value": "edit" } ] } } }, "AWS, exclude region": { "value": { "request_data": { "id": "2674a4092ed74f9aae604e296dcedc15", "cloud_provider": "AWS", "scope": "ACCOUNT", "scan_mode": "MANAGED", "manual_details": { "organization_id": "r-d03p", "account_id": "783764590904", "account_name": "my-aws-account", "role_arn": "arn:aws:iam::783764590904:role/CortexPlatformRole-m-a-9994395176702", "external_id": "320ee22d-a0dc-4104-a4ed-6b3b93e2b543", "cloudtrail_role": "arn:aws:iam::783764590904:role/cortex-logs-ingestion-access-m-a-9994395176702", "sqs_url": "https://sqs.us-east-1.amazonaws.com/783764590904/cortex-ct-logs-queue-783764590904-m-a-9994395176702" }, "additional_capabilities": { "automation": false, "xsiam_analytics": false, "registry_scanning": false, "kubernetes_security": false, "serverless_scanning": false, "agentless_disk_scanning": false, "upload_files_to_wildfire": false }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "CUSTOM" } }, "scope_modifications": { "regions": { "enabled": true, "type": "EXCLUDE", "regions": [ "us-east-1" ] } }, "custom_resources_tags": [ { "key": "env", "value": "prod" } ] } } }, "Azure, enable all capabilities": { "value": { "request_data": { "id": "73de84ed30cf41f1838bdc176ab490be", "cloud_provider": "AZURE", "scope": "ACCOUNT", "scan_mode": "MANAGED", "manual_details": { "tenant_id": "194cfdc7-41f0-4eec-8bfb-1b805cf74f53", "client_id": "3a3f8838-b1b3-4494-9bc0-6c9bd87017cb", "subscription_id": "a00175b3-230f-49db-b68f-0b35f61bf305", "resource_group_name": "cortex-platform-rg", "ads_image_gallery_resource_id": "/subscriptions/a00175b3-230f-49db-b68f-0b35f61bf305/resourceGroups/cortex-platform-rg/providers/Microsoft.Compute/galleries/CortexAdsGallery", "resource_group_location": "eastus", "eventhub_name": "cortex-eventhub", "eventhub_resource_group_name": "cortex-platform-rg", "eventhub_namespace": "cortex-eh-namespace", "azure_audit_eventhub_consumer_group_name": "cortex-cg", "storage_account_name": "cortexstorageaccount", "eventhub_audit_client_id": "c4e5b52a-c846-486c-a2ba-66254ad37eb0" }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "automation": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "kubernetes_security": true, "upload_files_to_wildfire": false }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "CUSTOM" } }, "scope_modifications": { "regions": { "enabled": false } } } } }, "GCP, enable capabilities": { "value": { "request_data": { "id": "6975cbaef05d40e9a65237f8b39a652a", "cloud_provider": "GCP", "scope": "ACCOUNT", "scan_mode": "MANAGED", "manual_details": { "account_id": "my-gcp-project", "organization_id": "1088839764044", "service_account_email": "cortex-platform@my-gcp-project.iam.gserviceaccount.com", "audit_service_account_email": "cortex-audit@my-gcp-project.iam.gserviceaccount.com", "outpost_scanner_service_account_email": "cortex-scanner@my-gcp-project.iam.gserviceaccount.com", "audit_pubsub_subscription_id": "projects/my-gcp-project/subscriptions/cortex-subscription" }, "additional_capabilities": { "automation": true, "xsiam_analytics": true, "registry_scanning": true, "kubernetes_security": true, "serverless_scanning": true, "automation_log_level": "OFF", "agentless_disk_scanning": false, "upload_files_to_wildfire": false, "registry_scanning_options": { "type": "ALL" } }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "CUSTOM" } }, "scope_modifications": { "regions": { "enabled": false } }, "custom_resources_tags": [ { "key": "edit", "value": "edit" } ] } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BaseResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "operationId": "editManualInstance" } }, "/public_api/v1/cloud_onboarding/get_account_scanning_configuration": { "post": { "tags": [ "Manual onboarding" ], "summary": "Get the scanning scope of a cloud account", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nRetrieve the current per-account scanning scope for a single cloud account, along with the account's environment. The response returns the entire stored scanning scope object as-is.\n\nPer-account scanning scope controls which security capabilities are active for individual accounts within a cloud instance. Use `POST /public_api/v1/cloud_onboarding/set_account_scanning_scope` to update the scope.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAccountScanningConfigurationRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAccountScanningConfigurationResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "400": { "$ref": "#/components/responses/BadRequest" } }, "operationId": "getAccountScanningConfiguration" } }, "/public_api/v1/cloud_onboarding/get_edit_instance_details": { "post": { "tags": [ "Manual onboarding" ], "summary": "Get the specified integration instance edit details", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nRetrieve the current editable configuration of the specified integration instance, including any pending (not-yet-applied) changes. Use this endpoint before calling `POST /public_api/v1/cloud_onboarding/edit_manual_instance` to inspect the current state and identify which fields can be modified.\n\nThe response contains two objects:\n\n- `fields` — the current live configuration of the instance.\n- `pending_changes` — configuration changes that have been submitted but not yet applied (for example, because the updated authentication template has not been re-deployed in the CSP).\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetInstanceRequestData" }, "examples": { "Get edit details for an instance": { "value": { "request_data": { "id": "2674a4092ed74f9aae604e296dcedc15" } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetEditInstanceDetailsResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "400": { "$ref": "#/components/responses/BadRequest" } }, "operationId": "getEditInstanceDetails" } }, "/public_api/v1/cloud_onboarding/get_manual_connector_identifiers": { "post": { "tags": [ "Manual onboarding" ], "summary": "Get identifiers for manual integration instance provisioning", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nGenerate the cloud service provider identifiers and `manual_details` template needed to manually provision a cloud integration instance. This call does not persist any data — it returns a customized identifiers JSON file based on the scope, scan mode, and security capabilities you specify.\n\n**Manual onboarding workflow**\n\n1. Call this endpoint to obtain the identifiers file.\n2. Use the `identifiers` section as a reference when creating CSP resources (IAM roles, service accounts, audit-log infrastructure, etc.).\n3. Fill in the `manual_details` section with the values retrieved from your CSP environment (for example, Role ARN, External ID, SQS URL for AWS; tenant ID and managed identity details for Azure).\n4. Call `POST /public_api/v1/cloud_onboarding/create_instance` with the completed `manual_details` to finalize onboarding.\n\n**CSP support:** AWS, Azure, and GCP only. OCI and Alibaba Cloud do not support manual provisioning.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetManualConnectorIdentifiersRequestData" }, "examples": { "AWS, organization scope, all capabilities enabled": { "value": { "request_data": { "cloud_partition": "COMMERCIAL", "cloud_provider": "AWS", "scope": "ORGANIZATION", "scan_mode": "MANAGED", "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "automation": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "kubernetes_security": true }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "AUTOMATED" } } } } }, "AWS, account scope": { "value": { "request_data": { "cloud_partition": "COMMERCIAL", "cloud_provider": "AWS", "scope": "ACCOUNT", "scan_mode": "MANAGED", "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "serverless_scanning": true, "automation": true, "agentless_disk_scanning": true, "kubernetes_security": false }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "AUTOMATED" } } } } }, "AWS, account group scope": { "value": { "request_data": { "cloud_partition": "COMMERCIAL", "cloud_provider": "AWS", "scope": "ACCOUNT_GROUP", "scan_mode": "MANAGED", "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "automation": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "kubernetes_security": true }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "AUTOMATED" } } } } }, "Azure, organization scope, all capabilities enabled": { "value": { "request_data": { "cloud_partition": "COMMERCIAL", "cloud_provider": "AZURE", "scope": "ORGANIZATION", "account_details": { "organization_id": "194cfdc7-41f0-4eec-8bfb-1b805cf74f53" }, "scan_mode": "MANAGED", "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": true, "registry_scanning_options": { "type": "ALL" }, "serverless_scanning": true, "automation": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "kubernetes_security": true }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": false, "collection_method": "AUTOMATED" } } } } }, "Azure, account scope": { "value": { "request_data": { "cloud_partition": "COMMERCIAL", "cloud_provider": "AZURE", "scope": "ACCOUNT", "account_details": { "organization_id": "194cfdc7-41f0-4eec-8bfb-1b805cf74f53" }, "scan_mode": "MANAGED", "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": true, "registry_scanning": false, "serverless_scanning": true, "automation": false, "agentless_disk_scanning": true, "kubernetes_security": true }, "collection_configuration": { "audit_logs": { "enabled": false, "data_events": false } } } } }, "GCP, organization scope, all capabilities enabled": { "value": { "request_data": { "cloud_partition": "COMMERCIAL", "cloud_provider": "GCP", "scope": "ORGANIZATION", "scan_mode": "MANAGED", "additional_capabilities": { "automation": true, "xsiam_analytics": true, "registry_scanning": true, "kubernetes_security": true, "serverless_scanning": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "registry_scanning_options": { "type": "ALL" } }, "collection_configuration": { "audit_logs": { "enabled": true, "data_events": true } } } } }, "GCP, account scope": { "value": { "request_data": { "cloud_partition": "COMMERCIAL", "cloud_provider": "GCP", "scope": "ACCOUNT", "scan_mode": "MANAGED", "additional_capabilities": { "automation": true, "xsiam_analytics": true, "registry_scanning": true, "kubernetes_security": true, "serverless_scanning": true, "automation_log_level": "OFF", "agentless_disk_scanning": true, "upload_files_to_wildfire": true, "registry_scanning_options": { "type": "ALL" } }, "collection_configuration": { "audit_logs": { "enabled": false, "data_events": false } } } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetManualConnectorIdentifiersResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "400": { "$ref": "#/components/responses/BadRequest" } }, "operationId": "getManualConnectorIdentifiers" } }, "/public_api/v1/cloud_onboarding/manual_update_and_resolve": { "post": { "tags": [ "Manual onboarding" ], "summary": "Mark a manual connector as updated/resolved", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nMark a manually-onboarded connector as updated and resolved by its connector ID. Call this endpoint after you have re-deployed the updated authentication template in your CSP following an edit operation. This signals to Cortex that the manual changes have been applied and clears the pending-update state on the connector.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ManualUpdateAndResolveRequestData" }, "examples": { "Mark connector as resolved": { "value": { "request_data": { "instance_id": "150401c7f0254616a6db08127e0f479e" } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BaseResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "operationId": "manualUpdateAndResolve" } }, "/public_api/v1/cloud_onboarding/resolve_connector_security_capabilities": { "post": { "tags": [ "Manual onboarding" ], "summary": "Resolve the relevant additional security capabilities for a connector", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nResolve the additional security capabilities available for a given cloud provider, scope, and partition combination, based on your tenant's license. Use this endpoint before onboarding to determine which `additional_capabilities` fields are valid for your configuration.\n\nThe response returns two lists:\n\n- `additional_capabilities` — capability keys you can set to `true` in `InstanceAdditionalCapabilities` (for example `agentless_disk_scanning`, `registry_scanning`).\n- `collection_configuration` — collection-configuration keys available for the connector (for example `audit_logs`).\n\n**CSP and license constraints apply.** For example, DSPM is not available in GOV partitions; OCI Standard license restricts which capabilities are allowed. See the overview for the full capability matrix.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetRelevantAdditionalCapabilitiesRequestData" }, "examples": { "AWS, organization scope": { "value": { "request_data": { "cloud_provider": "AWS", "scope": "ORGANIZATION", "cloud_partition": "COMMERCIAL" } } }, "AWS, account scope": { "value": { "request_data": { "cloud_provider": "AWS", "scope": "ACCOUNT", "cloud_partition": "COMMERCIAL" } } }, "Azure, organization scope": { "value": { "request_data": { "cloud_provider": "AZURE", "scope": "ORGANIZATION", "cloud_partition": "COMMERCIAL" } } }, "Azure, account scope": { "value": { "request_data": { "cloud_provider": "AZURE", "scope": "ACCOUNT", "cloud_partition": "COMMERCIAL" } } }, "GCP, organization scope": { "value": { "request_data": { "cloud_provider": "GCP", "scope": "ORGANIZATION", "cloud_partition": "COMMERCIAL" } } }, "GCP, account scope": { "value": { "request_data": { "cloud_provider": "GCP", "scope": "ACCOUNT", "cloud_partition": "COMMERCIAL" } } } } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetRelevantAdditionalCapabilitiesResponse" } } } }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" }, "400": { "$ref": "#/components/responses/BadRequest" } }, "operationId": "resolveConnectorSecurityCapabilities" } }, "/public_api/v1/cloud_onboarding/set_account_scanning_scope": { "post": { "tags": [ "Manual onboarding" ], "summary": "Set the scanning scope of a cloud account", "description": "{% hint style=\"info\" %}\nThis endpoint is currently available as a hotfix and will be generally available in the next release.\n{% endhint %}\n\nUpdate the per-account scanning scope for a single cloud account. Provided keys are deep-merged (RFC 7386) onto the stored scanning scope — keys that are not provided are preserved. Only ADS and DSPM scan gates and the ADS tag-based host filter are currently supported.\n\n**ADS (`ads_scan_enabled`):** Enable or disable Agentless Disk Scanning for this account. Enabling requires the `agentless_disk_scanning` capability to be active on the parent connector.\n\n**DSPM (`dspm_scan_enabled`):** Enable or disable Data Security Posture Management scanning for this account. Enabling requires the `data_security_posture_management` capability to be active on the parent connector.\n\n**ADS tag filter (`agentless_disk_scanning_scope`):** Narrow which hosts ADS scans using INCLUDE or EXCLUDE tag rules. When `enabled: true`, both `type` and `tags` are required.\n\n**Required license:** Cortex Cloud Posture Management.", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetAccountScanningScopeRequestData" } } } }, "responses": { "200": { "description": "Successful Response", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetAccountScanningScopeResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "operationId": "setAccountScanningScope" } } }, "tags": [ { "name": "Cloud instance management", "description": "These APIs enable you to create a cloud instance in pending state and provide a link to download the authentication template to be executed in your CSP. You can get details on the cloud instances currently in Cortex XDR and you can enable, disable, or delete them. You can also edit the cloud instance configuration." }, { "name": "Manual onboarding", "description": "APIs for manually provisioning cloud instances without deploying a Cortex-generated template." }, { "name": "Cloud account management", "description": "The cloud account APIs allow you to manage accounts within a specific cloud instance. You can have multiple cloud accounts within one cloud instance. Use these APIs to get the cloud accounts in the specified cloud instance and to enable or disable cloud accounts." }, { "name": "Outpost management", "description": "Use these APIs to create or edit templates for onboarding outposts." }, { "name": "General", "description": "These APIs are for general management." } ], "components": { "securitySchemes": { "Authorization": { "type": "apiKey", "name": "x-api-key", "in": "header" }, "x-xdr-auth-id": { "type": "apiKey", "name": "x-api-key-id", "in": "header" } }, "responses": { "ValidationError": { "description": "Invalid Client Request Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BaseError" } } } }, "InternalServerError": { "description": "Internal Server Error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BaseError" } } } }, "BadRequest": { "description": "Bad Request", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BaseError" } } } } }, "schemas": { "AccountItem": { "type": "object", "description": "A single cloud account in the list response.", "properties": { "account_name": { "type": "string" }, "cloud_account_id": { "type": "string", "description": "The cloud service provider account identifier" }, "account_type": { "type": "string", "description": "Type of the account", "enum": [ "ACCOUNT", "ORGANIZATION", "MANAGEMENT_GROUP", "TENANT", "WORKSPACE_DOMAIN", "PROJECT", "ORGANIZATIONAL_UNIT" ] }, "status": { "type": "string", "enum": [ "ENABLED", "DISABLED", "DELETED" ] }, "environment": { "type": "string", "enum": [ "NONE", "DEVELOPMENT", "STAGING", "TESTING", "PRODUCTION" ] }, "created_at": { "type": "integer", "format": "int64", "description": "Account creation timestamp" } } }, "GetIdentifiersRequestData": { "type": "object", "required": [ "instance_id", "cloud_provider" ], "properties": { "instance_id": { "type": "string", "description": "The cloud instance ID for which you want to list the authorization details." }, "cloud_provider": { "type": "string", "enum": [ "GCP" ], "description": "The cloud service provider for which you want to list the authorization details." } } }, "GetIdentifiersResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "cortex_discovery_role": { "type": "string", "description": "The Cortex discovery role identifier" }, "cortex_scan_platform_role": { "type": "string", "description": "The Cortex scan platform role identifier" }, "cortex_log_collection_role": { "type": "string", "description": "The Cortex log collection role identifier" }, "cortex_outpost_role": { "type": "string", "description": "The Cortex outpost role identifier" } } } }, "x-examples": { "Example 1": { "reply": { "cortex_discovery_role": "crtx-m-a-9991392015320@env.iam.gserviceaccount.com", "cortex_scan_platform_role": "cortex-engine@env-9991392015320.iam.gserviceaccount.com", "cortex_log_collection_role": "string", "cortex_outpost_role": "ctsc-m-a-9991392015320@env1.iam.gserviceaccount.com" } } } }, "ListCloudProviderRegionsRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "example": { "cloud_provider": "AWS" }, "properties": { "cloud_provider": { "type": "string", "enum": [ "AWS", "AZURE", "GCP", "OCI", "ALIBABA_CLOUD" ], "description": "The cloud service provider for which you want to list the regions." }, "cloud_partition": { "description": "Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants.", "default": "COMMERCIAL", "enum": [ "COMMERCIAL", "GOV" ] } } } }, "x-examples": { "Example 1": { "request_data": { "cloud_provider": "AWS", "cloud_partition": "GOV" } } } }, "ListCloudProviderRegionsResponse": { "type": "object", "x-examples": { "Example 1": { "reply": [ { "name": "AWS GovCloud (US-East)", "value": "us-gov-east-1", "type": "single" }, { "name": "AWS GovCloud (US-West)", "value": "us-gov-west-1", "type": "single" } ] } }, "properties": { "reply": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Name of the CSP region." }, "value": { "type": "string" }, "type": { "type": "string" } } } } } }, "EnableDisableInstanceRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "ids", "enable" ], "example": { "ids": [ "e22b3a29260c404183d1a0ea6cbd4418", "d32d3b19730d414387d2a3ea7eac4218" ], "enable": true }, "properties": { "ids": { "type": "array", "description": "List of cloud instance IDs to enable/disable/", "items": { "type": "string", "example": "e22b3a29260c404183d1a0ea6cbd4418" } }, "enable": { "type": "boolean", "description": "Whether to enable the cloud instances (`true`) or disable (`false`)." } } } } }, "EnableDisableInstancesResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The main payload of the response, containing operation-specific data." } }, "example": { "reply": {} } }, "DeleteInstanceRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "ids" ], "properties": { "ids": { "type": "array", "description": "List of cloud instance IDs to delete.", "items": { "type": "string" } } }, "example": { "ids": [ "instance-1", "instance-2" ] } } } }, "EditOutpostRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "id": { "type": "string", "description": "The outpost ID to edit.", "minLength": 1 }, "custom_resources_tags": { "type": "array", "items": { "$ref": "#/components/schemas/CustomResourceTag" } } }, "required": [ "id", "custom_resources_tags" ], "example": { "id": "094935393dcf46128e5a2138a51bd54a", "custom_resources_tags": [ { "key": "environment", "value": "production" } ] } } } }, "BaseResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The main payload of the response, containing operation-specific data." } } }, "CreateInstanceTemplateRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "scope", "scan_mode", "cloud_provider", "custom_resources_tags", "collection_configuration", "scope_modifications", "additional_capabilities" ], "properties": { "scope": { "type": "string", "enum": [ "ORGANIZATION", "ACCOUNT_GROUP", "ACCOUNT" ], "description": "Define the scope for this cloud instance. Valid values include:\n\n- `ORGANIZATION`: Use this to indicate an AWS organization, GCP organization, or Azure tenant.\n- `ACCOUNT_GROUP`: Use this to indicate an AWS account group, GCP folder, or Azure management group.\n- `ACCOUNT`: Use this to indicate an AWS account, GCP project, or Azure subscription." }, "scan_mode": { "type": "string", "enum": [ "MANAGED", "OUTPOST" ], "description": "Define the scan mode. Valid values include:\n\n- `MANAGED`: (Recommended) Security scanning is performed in the Cortex cloud environment.\n- `OUTPOST`: Security scanning is performed on infrastructure deployed to a cloud account owned by you.\n\n**Note: ** Scanning with an outpost may require additional CSP permissions and may incur additional CSP costs." }, "scan_env_id": { "type": "string", "minLength": 1, "description": "When the scan mode is `OUTPOST`, you must include the `scan_env_id` field with the outpost ID as the value.\nTo obtain the outpost ID, call [Get Outposts](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/outpost-management#post-public_api-v1-cloud_onboarding-get_outposts). The value of `outpost_id` in the response is the outpost ID." }, "account_details": { "$ref": "#/components/schemas/AccountDetails" }, "instance_name": { "type": "string" }, "cloud_provider": { "type": "string", "enum": [ "AWS", "AZURE", "GCP", "OCI", "ALIBABA_CLOUD" ], "description": "The cloud service provider. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`\n- `ALIBABA_CLOUD`" }, "custom_resources_tags": { "type": "array", "items": { "$ref": "#/components/schemas/CustomResourceTag" } }, "collection_configuration": { "$ref": "#/components/schemas/InstanceCollectionConfiguration" }, "scope_modifications": { "$ref": "#/components/schemas/InstanceScopeModifications" }, "additional_capabilities": { "$ref": "#/components/schemas/InstanceAdditionalCapabilities" }, "cloud_partition": { "description": "Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants.", "enum": [ "COMMERCIAL", "GOV" ] }, "gcp_workspace": { "type": "object", "description": "GCP Workspace configuration (GCP only).", "properties": { "customer_ids": { "type": "array", "items": { "type": "string" }, "nullable": true }, "enabled": { "type": "boolean", "default": false } } } } } } }, "AccountDetails": { "type": "object", "example": { "organization_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" }, "description": "`account_details` is required for onboarding Azure and is not used for onboarding AWS or GCP.", "properties": { "organization_id": { "type": "string", "description": "Azure tenant ID", "minLength": 1 } } }, "CustomResourceTag": { "type": "object", "properties": { "key": { "type": "string", "description": "The key of the custom resource tag.", "minLength": 1 }, "value": { "type": "string", "description": "The value of the custom resource tag." } }, "example": { "key": "environment", "value": "production" } }, "InstanceCollectionConfiguration": { "type": "object", "description": "This field is optional when onboarding or editing Alibaba Cloud.", "properties": { "audit_logs": { "$ref": "#/components/schemas/InstanceAuditLogsConfig" } }, "example": { "audit_logs": { "enabled": true } } }, "InstanceAuditLogsConfig": { "type": "object", "description": "To maximize security coverage, include collection of logs. This may require additional cloud service provider permissions. \nFor detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).", "example": { "enabled": true }, "required": [ "enabled" ], "properties": { "enabled": { "type": "boolean", "description": "Whether to enable audit log collection. If this is `false`, then the other fields in this object should not be used." }, "collection_method": { "enum": [ "CUSTOM", "AUTOMATED" ], "description": "Indicates whether to use automated or custom log collection. \n**Note:** `collection_method` is only relevant for AWS or OCI. For OCI, the value of `collection_method` must be `CUSTOM` and you must include `custom_collectors` with the details of the existing buckets. In AWS, if `collection_method` is `CUSTOM`, you need to update the bucket information when you manually upload the template to AWS CloudFormation.\n" }, "data_events": { "type": "boolean", "description": "The `data_events` field is only relevant when `cloud_provider` is `AWS` and `collection_method` is `AUTOMATED`. Currently supports AWS Lambda and Amazon S3." }, "custom_collectors": { "type": "array", "description": "A list of OCI bucket configurations for collecting logs.\n**Note:** This is only relevant for OCI when `collection_method` is `CUSTOM`.", "items": { "type": "object", "properties": { "region": { "type": "string", "description": "The geographic region where the collection bucket is located." }, "bucket_name": { "type": "string", "description": "The name of the storage bucket where the log collection data will be collected and stored." }, "compartment_ocid": { "type": "string", "description": "The unique OCID (Oracle Cloud Identifier) of the compartment that owns the specified bucket." } } } }, "is_control_tower_byob": { "type": "boolean", "default": false, "description": "When `true`, configures the cloud instance to use AWS Control Tower Bring Your Own Bucket (BYOB) for audit log collection. This allows Cortex to collect audit logs from an existing S3 bucket managed by AWS Control Tower, rather than creating a new one.\n\n**Requirements:**\n- Only applicable when `cloud_provider` is `AWS`.\n- Requires `collection_method` to be set to `CUSTOM`.\n- Requires the cloud instance scope to be `ORGANIZATION`.\n- The Control Tower BYOB feature must be enabled for your tenant." } } }, "InstanceScopeModifications": { "type": "object", "description": "Defines which accounts, regions, and organizational groupings Cortex should include in or exclude from security scanning for this cloud instance. The fields you use depend on the cloud provider:\n\n- **AWS**: Use `accounts` to filter individual AWS accounts, `organizational_units` to filter AWS organizational units, and `regions` to restrict scanning to specific AWS regions.\n- **GCP**: Use `projects` to filter individual GCP projects, `folders` to filter GCP folders, and `regions` to restrict scanning to specific GCP regions.\n- **Azure**: Use `subscriptions` to filter individual Azure subscriptions, `management_groups` to filter Azure management groups, and `regions` to restrict scanning to specific Azure regions.\n- **OCI**: Use `compartments` to filter OCI compartments and `regions` to restrict scanning to specific OCI regions.\n- **Alibaba Cloud**: Use `accounts` to filter individual Alibaba Cloud accounts and `regions` to restrict scanning to specific regions.\n\nOnly one account-level bucket (`accounts`, `projects`, `subscriptions`, or `compartments`) and one organizational-level bucket (`organizational_units`, `management_groups`, or `folders`) may be enabled at a time.", "required": [ "regions" ], "properties": { "accounts": { "$ref": "#/components/schemas/InstanceAccountsConfig", "description": "Filters individual AWS or Alibaba Cloud accounts within the cloud instance scope. Use this to include or exclude specific AWS account IDs or Alibaba Cloud account IDs from security scanning. Not applicable for GCP, Azure, or OCI." }, "projects": { "$ref": "#/components/schemas/InstanceAccountsConfig", "description": "Filters individual GCP projects within the cloud instance scope. Use this to include or exclude specific GCP project IDs from security scanning. Not applicable for AWS, Azure, OCI, or Alibaba Cloud." }, "subscriptions": { "$ref": "#/components/schemas/InstanceAccountsConfig", "description": "Filters individual Azure subscriptions within the cloud instance scope. Use this to include or exclude specific Azure subscription IDs from security scanning. Not applicable for AWS, GCP, OCI, or Alibaba Cloud." }, "compartments": { "$ref": "#/components/schemas/InstanceAccountsConfig", "description": "Filters OCI compartments within the cloud instance scope. Use this to include or exclude specific OCI compartment IDs from security scanning. Not applicable for AWS, GCP, Azure, or Alibaba Cloud." }, "organizational_units": { "$ref": "#/components/schemas/InstanceOUConfig", "description": "Filters AWS organizational units (OUs) within the cloud instance scope. Use this to include or exclude entire OUs — and all accounts within them — from security scanning. Only valid for AWS with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time." }, "management_groups": { "$ref": "#/components/schemas/InstanceOUConfig", "description": "Filters Azure management groups within the cloud instance scope. Use this to include or exclude entire management groups — and all subscriptions within them — from security scanning. Only valid for Azure with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time." }, "folders": { "$ref": "#/components/schemas/InstanceOUConfig", "description": "Filters GCP folders within the cloud instance scope. Use this to include or exclude entire GCP folders — and all projects within them — from security scanning. Only valid for GCP with `ORGANIZATION` scope. Only one of `organizational_units`, `management_groups`, or `folders` may be enabled at a time." }, "regions": { "$ref": "#/components/schemas/InstanceRegionsConfig", "description": "Restricts security scanning to specific geographic regions within the cloud provider. When `enabled` is `true`, Cortex scans only the regions listed (if `type` is `INCLUDE`) or scans all regions except those listed (if `type` is `EXCLUDE`). This field is required." } } }, "InstanceOUConfig": { "type": "object", "description": "Configuration for filtering an organizational grouping within a cloud instance scope. Organizational groupings let you include or exclude entire subtrees of your cloud hierarchy — such as all accounts under an AWS organizational unit, all subscriptions under an Azure management group, or all projects under a GCP folder — rather than listing individual account IDs.\n\nProvide the IDs that match your cloud provider:\n- **AWS**: Use `organizational_unit_ids`\n- **Azure**: Use `management_group_ids`\n- **GCP**: Use `folder_ids`\n\nOnly one ID list may be populated at a time. When `enabled` is `false`, no other fields should be set.", "properties": { "enabled": { "type": "boolean", "description": "Whether to activate this organizational-level scope filter. When `true`, Cortex applies the `type` and the corresponding ID list to determine which organizational groupings to include or exclude. When `false`, no organizational filtering is applied and no other fields in this object should be set." }, "type": { "type": "string", "enum": [ "INCLUDE", "EXCLUDE" ], "nullable": true, "description": "Determines how the provided ID list is applied to the scope. Required when `enabled` is `true`. Valid values include:\n\n- `INCLUDE`: Cortex scans only the organizational groupings listed in the ID list, and all accounts, subscriptions, or projects that belong to them.\n- `EXCLUDE`: Cortex scans all organizational groupings except those listed in the ID list." }, "organizational_unit_ids": { "type": "array", "nullable": true, "description": "A list of AWS organizational unit (OU) IDs to include in or exclude from security scanning. Each OU ID must be a non-empty string in the format `ou-xxxx-xxxxxxxx`. All AWS accounts that are members of the specified OUs are affected. Use only when the cloud provider is `AWS`.", "items": { "type": "string", "minLength": 1 } }, "management_group_ids": { "type": "array", "nullable": true, "description": "A list of Azure management group IDs to include in or exclude from security scanning. Each management group ID must be a non-empty string. All Azure subscriptions that belong to the specified management groups are affected. Use only when the cloud provider is `AZURE`.", "items": { "type": "string", "minLength": 1 } }, "folder_ids": { "type": "array", "nullable": true, "description": "A list of GCP folder IDs to include in or exclude from security scanning. Each folder ID must be a non-empty string (numeric GCP folder ID). All GCP projects that reside under the specified folders are affected. Use only when the cloud provider is `GCP`.", "items": { "type": "string", "minLength": 1 } } }, "required": [ "enabled" ] }, "InstanceAccountsConfig": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Whether to enable (`true`) or disable (`false`) this scope modification." }, "type": { "type": "string", "description": "Define whether the account IDs/project IDs/subscription IDs specified should be included in the scope or excluded from the scope. Valid values include:\n\n- `INCLUDE`\n- `EXCLUDE`", "nullable": true }, "account_ids": { "type": "array", "description": "The list of account IDs to include or exclude (for AWS).", "nullable": true, "items": { "type": "string", "minLength": 1 } }, "project_ids": { "type": "array", "description": "The list of account IDs to include or exclude (for GCP).", "nullable": true, "items": { "type": "string", "minLength": 1 } }, "subscription_ids": { "type": "array", "description": "The list of account IDs to include or exclude (for Azure).", "nullable": true, "items": { "type": "string", "minLength": 1 } }, "compartment_ids": { "type": "array", "nullable": true, "description": "The list of compartment IDs to include or exclude (for OCI).", "items": { "type": "string" } } } }, "InstanceRegionsConfig": { "type": "object", "properties": { "enabled": { "type": "boolean", "description": "Flag to enable or disable region configuration" }, "type": { "type": "string", "nullable": true, "description": "Type of region configuration (e.g., INCLUDE, EXCLUDE)" }, "regions": { "type": "array", "nullable": true, "description": "List of regions to include or exclude", "items": { "type": "string", "minLength": 1 } } }, "example": { "enabled": true, "type": "INCLUDE", "regions": [ "us-east-1", "eu-west-1" ] } }, "InstanceAdditionalCapabilities": { "type": "object", "description": "Define which security capabilities you want to benefit from. All fields default to `false` and are optional. This field is optional when `cloud_provider` is `ALIBABA_CLOUD`; for all other providers it is required.\n\n**Note:** Adding a security capability typically requires additional cloud provider permissions. For detailed information on the permissions required, see [Cloud service provider permissions](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/reference-and-developer-docs/cloud-service-provider-permissions).", "example": { "xsiam_analytics": true, "data_security_posture_management": false, "registry_scanning": true, "registry_scanning_options": { "type": "FULL_SCAN" }, "serverless_scanning": true, "agentless_disk_scanning": true }, "properties": { "xsiam_analytics": { "type": "boolean", "description": "Whether to enable XSIAM analytics to analyze your endpoint data to develop a baseline and raise Analytics and Analytics BIOC alerts when anomalies and malicious behaviors are detected." }, "data_security_posture_management": { "type": "boolean", "description": "Whether to enable data security posture management, an agentless data security scanner that discovers, classifies, protects, and governs sensitive data.", "nullable": true }, "registry_scanning": { "type": "boolean", "description": "Whether to enable registry scanning, a container registry scanner that scans registry images for vulnerabilities, malware, and secrets." }, "registry_scanning_options": { "$ref": "#/components/schemas/RegistryScanningOptions" }, "serverless_scanning": { "type": "boolean", "description": "Whether to enable serverless scanning to detect and remediate vulnerabilities within serverless functions during the development lifecycle. Seamless integration into CI/CD pipelines enables automated security scans for a continuously secure pre-production environment." }, "agentless_disk_scanning": { "type": "boolean", "description": "Whether to enable agentless disk scanning to remotely detect and remediate vulnerabilities during the development lifecycle." }, "upload_files_to_wildfire": { "type": "boolean", "description": "Whether to enable uploading files extracted from registry images to WildFire for malware analysis. If WildFire identifies a file as malicious, the associated registry image is re-evaluated and a malware finding is created." }, "kubernetes_security": { "type": "boolean", "default": false, "description": "Whether to enable Kubernetes security." }, "automation": { "type": "boolean", "default": false, "description": "Whether to enable automation." }, "automation_log_level": { "description": "Automation log level", "enum": [ "OFF", "Debug", "Verbose" ], "nullable": true } } }, "RegistryScanningOptions": { "type": "object", "example": { "type": "FULL_SCAN" }, "properties": { "type": { "type": "string", "description": "Type of registry scanning." }, "last_days": { "type": "integer", "description": "Number of days to scan back.", "nullable": true } } }, "CreateInstanceResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The main payload of the response, containing instance information data. It includes a link to download the template file from your tenant.\nIf you use automated upload (only for AWS), the link will take you directly to AWS CloudFormation to create the stack.\nOtherwise, download the template and upload it in your CSP and follow the instructions to manually upload the template:\n- [AWS](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/amazon-web-services-cloud-onboarding/deploy-the-cloudformation-template-in-aws)\n- [GCP](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/onboard-google-cloud-platform)\n- [Azure](https://app.gitbook.com/s/cyIgISZgANJYkmLlnwdK/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/microsoft-azure-cloud-onboarding/finalize-microsoft-azure-onboarding-by-executing-the-authentication-template)" } }, "example": { "reply": { "automated": { "link": "string", "tracking_guid": "string" }, "manual": { "TF/ARM": "string" } } } }, "EditInstanceRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "id", "scan_env_id", "instance_name", "cloud_provider", "custom_resources_tags", "scope_modifications" ], "properties": { "id": { "type": "string", "description": "The ID of the cloud instance to edit. To obtain instance IDs, use [Get Instances](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/cloud-instance-management#post-public_api-v1-cloud_onboarding-get_instances).", "minLength": 1 }, "scan_env_id": { "type": "string", "description": "The outpost ID to use for security scanning. Required even when the scan mode is `MANAGED` \u2014 pass the current outpost ID or an empty string if no outpost is configured.\nTo obtain the outpost ID, call [Get Outposts](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/outpost-management#post-public_api-v1-cloud_onboarding-get_outposts). The value of `outpost_id` in the response is the outpost ID.", "minLength": 1 }, "instance_name": { "type": "string", "description": "The display name of the cloud instance." }, "cloud_provider": { "type": "string", "enum": [ "AWS", "AZURE", "GCP", "OCI", "ALIBABA_CLOUD" ], "description": "The cloud service provider of the instance being edited. Must match the provider used when the instance was created. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`\n- `ALIBABA_CLOUD`" }, "custom_resources_tags": { "type": "array", "description": "A list of key-value tags applied to the cloud resources that Cortex creates in your CSP account (such as IAM roles and CloudFormation stacks). Updating these tags requires re-executing the authentication template in the CSP.", "items": { "$ref": "#/components/schemas/CustomResourceTag" } }, "scope_modifications": { "$ref": "#/components/schemas/InstanceScopeModifications" }, "additional_capabilities": { "$ref": "#/components/schemas/InstanceAdditionalCapabilities" }, "collection_configuration": { "$ref": "#/components/schemas/InstanceCollectionConfiguration" }, "gcp_workspace": { "type": "object", "description": "GCP Workspace configuration. Use this to connect a Google Workspace domain to the GCP cloud instance, enabling Cortex to collect Workspace audit logs and assess Workspace security posture. Only applicable when `cloud_provider` is `GCP`.", "properties": { "customer_ids": { "type": "array", "nullable": true, "description": "A list of Google Workspace customer IDs to associate with this GCP cloud instance.", "items": { "type": "string" } }, "enabled": { "type": "boolean", "default": false, "description": "Whether to enable Google Workspace integration for this GCP cloud instance." } } } } } } }, "EditInstanceResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "automated": { "type": "object", "properties": { "link": { "type": "string" }, "tracking_guid": { "type": "string" } } }, "manual": { "type": "object", "properties": { "TF/ARM": { "type": "string" } } } } } }, "x-examples": { "Example 1": { "reply": { "automated": { "link": "string", "tracking_guid": "string" }, "manual": { "TF/ARM": "string" } } } } }, "EnableDisableAccountRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "ids", "instance_id", "enable" ], "properties": { "ids": { "type": "array", "description": "List of account IDs to enable or disable.", "items": { "type": "string" } }, "instance_id": { "type": "string", "description": "The cloud instance ID where the cloud accounts should be disabled." }, "enable": { "type": "boolean", "description": "Whether to enable (`true`) or disable (`false`) to specified accounts." } }, "example": { "ids": [ "account-1", "account-2" ], "instance_id": "instance-1", "enable": true } } } }, "EnableDisableAccountResponse": { "type": "object", "example": { "reply": {} }, "properties": { "reply": { "type": "object" } } }, "GetAzureApprovedTenantsResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The main payload of the response, containing the Azure tenant ID and whether the tenant is approved." } }, "example": { "reply": { "tenants": [ { "tenant_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "is_still_approved": true } ] } } }, "CreateOutpostTemplateRequestData": { "type": "object", "x-examples": { "Example 1": { "cloud_provider": "AWS", "cloud_partition": "GOV", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ] } }, "properties": { "request_data": { "type": "object", "required": [ "cloud_provider", "custom_resources_tags" ], "example": { "cloud_provider": "AWS", "custom_resources_tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ] }, "properties": { "cloud_provider": { "type": "string", "enum": [ "AWS", "AZURE", "GCP", "OCI" ], "description": "The cloud service provider for which to create the outpost template. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`\n- `OCI`" }, "cloud_partition": { "type": "string", "enum": [ "COMMERCIAL", "GOV" ], "default": "COMMERCIAL", "description": "Whether the CSP environment is `COMMERCIAL` or `GOV`:\n- `COMMERCIAL`: (Default) Standard cloud deployment typically used for private and public sector organizations that do not require isolated government-specific infrastructure.\n- `GOV`: Government cloud environments for compatibility with FedRAMP-certified tenants." }, "custom_resources_tags": { "type": "array", "description": "A list of key-value tags applied to the cloud resources that Cortex creates in your CSP account as part of the outpost deployment (such as IAM roles and storage resources). These tags help you identify and manage Cortex-managed resources in your cloud environment.", "items": { "$ref": "#/components/schemas/CustomResourceTag" } }, "instance_name": { "type": "string", "maxLength": 255, "default": "", "description": "An optional display name for the outpost. If not provided, Cortex auto-generates a name based on the account details. Maximum 255 characters." }, "app_registration_mode": { "type": "string", "enum": [ "cortex_managed", "customer_managed" ], "default": "cortex_managed", "description": "Controls whether Cortex creates and manages the Azure AD app registration used by the outpost, or whether you provide your own. Only applicable when `cloud_provider` is `AZURE`.\n\n- `cortex_managed`: (Default) Cortex automatically creates and manages the Azure AD app registration required for the outpost to authenticate with Azure.\n- `customer_managed`: You provide an existing Azure AD app registration. Use this when your organization's security policies require you to control app registrations. When set to `customer_managed`, you must also provide `customer_app_client_id` and `customer_sp_object_id`." }, "customer_app_client_id": { "type": "string", "default": "", "description": "The client ID (application ID) of your existing Azure AD app registration to use for the outpost. Required when `app_registration_mode` is `customer_managed`. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`." }, "customer_sp_object_id": { "type": "string", "default": "", "description": "The object ID of the service principal associated with your Azure AD app registration. Required when `app_registration_mode` is `customer_managed`. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`." }, "uami_mode": { "type": "string", "enum": [ "cortex_managed", "customer_managed" ], "default": "cortex_managed", "description": "Controls whether Cortex creates and manages the User-Assigned Managed Identities (UAMIs) used by the outpost for each security capability, or whether you provide your own. Only applicable when `cloud_provider` is `AZURE`.\n\n- `cortex_managed`: (Default) Cortex automatically creates and manages the UAMIs required for each enabled security capability.\n- `customer_managed`: You provide existing UAMIs for each capability. Use this when your organization requires control over managed identity assignments. When set to `customer_managed`, provide the relevant `customer_uami_*` fields for each capability you want to enable." }, "customer_uami_agentless_id": { "type": "string", "default": "", "description": "The resource ID of your existing Azure User-Assigned Managed Identity to use for agentless disk scanning. Required when `uami_mode` is `customer_managed` and agentless disk scanning is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`." }, "customer_uami_dspm_id": { "type": "string", "default": "", "description": "The resource ID of your existing Azure User-Assigned Managed Identity to use for Data Security Posture Management (DSPM) scanning. Required when `uami_mode` is `customer_managed` and DSPM is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`." }, "customer_uami_registry_id": { "type": "string", "default": "", "description": "The resource ID of your existing Azure User-Assigned Managed Identity to use for container registry scanning. Required when `uami_mode` is `customer_managed` and registry scanning is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`." }, "customer_uami_serverless_id": { "type": "string", "default": "", "description": "The resource ID of your existing Azure User-Assigned Managed Identity to use for serverless function scanning. Required when `uami_mode` is `customer_managed` and serverless scanning is enabled. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`." }, "customer_uami_proxy_id": { "type": "string", "default": "", "description": "The resource ID of your existing Azure User-Assigned Managed Identity to use for the outpost proxy component, which handles secure communication between the outpost and Cortex. Required when `uami_mode` is `customer_managed`. Must be a valid Azure GUID in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. Only applicable when `cloud_provider` is `AZURE`." } } } } }, "CreateOutpostResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The main payload of the response, containing a link to download the outpost template" } }, "example": { "reply": { "automated": {}, "manual": { "TF": "https://qa2-test-9999219916297-cloud-onboarding-templates.storage.googleapis.com/outposts/aws/tf-12711a531d51412d930a647ed2fdacdf-1743447640.tar.gz?Expires=1744052440&GoogleAccessId=api-pod%40qa2-test-9999219916297.iam.gserviceaccount.com&Signature=&response-content-disposition=attachment%3Bfilename%3Doutposts_aws_tf-12711a531d51412d930a647ed2fdacdf-1743447640.tar.gz" } } } }, "EditOutpostRequest": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "id": { "type": "string" }, "custom_resources_tags": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "string" } } } } } } }, "x-examples": { "Example 1": { "request_data": { "id": "094935393dcf46128e5a2138a51bd54a", "custom_resources_tags": [ { "key": "environment", "value": "production" } ] } } } }, "GetInstanceRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "example": { "id": "instance-1" }, "required": [ "id" ], "properties": { "id": { "type": "string", "description": "The ID of the cloud instance of which you want to get the details.", "example": "e22b3a29260c404183d1a0ea6cbd4418" } } } } }, "GetInstanceDetailsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "id": { "type": "string" }, "collector": { "type": "string" }, "instance_name": { "type": "string" }, "scope": { "type": "string" }, "tags": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "string" } } } }, "status": { "type": "string", "description": "Overall status of the cloud instance.", "enum": [ "CONNECTED", "WARNING", "ERROR", "DISABLED", "PENDING" ] }, "cloud_provider": { "type": "string", "description": "The cloud service provider.", "enum": [ "AWS", "AZURE", "GCP", "OCI", "ALIBABA_CLOUD" ] }, "scan": { "type": "object", "properties": { "scan_method": { "type": "string", "description": "The scan method used.", "enum": [ "MANAGED", "OUTPOST" ] }, "outpost_id": { "type": "string", "description": "The outpost ID. Only present when `scan_method` is `OUTPOST`." } } }, "security_capabilities": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" }, "status": { "type": "integer", "description": "Status of the security capability. One of: `0` (CONNECTED), `1` (WARNING), `2` (DISABLED), `3` (ERROR), `4` (NA).", "enum": [ 0, 1, 2, 3, 4 ] } } } }, "upgrade_available": { "type": "boolean" }, "cloud_partition": { "type": "string", "enum": [ "COMMERCIAL", "GOV" ] }, "collection_configuration": { "type": "string", "description": "JSON-encoded string of the collection configuration for this cloud instance." }, "additional_capabilities": { "type": "string", "description": "JSON-encoded string of the additional capabilities enabled for this cloud instance." } } } }, "x-examples": { "Example 1": { "reply": { "id": "e21d20cc3cad49d79fffa968c64d688d", "collector": "AWS", "instance_name": "AWS-1", "scope": "ACCOUNT", "tags": [ { "key": "managed_by", "value": "paloaltonetworks" } ], "status": "ENABLED", "cloud_provider": "AWS", "scan": { "scan_method": "MANAGED" }, "security_capabilities": [ { "name": "PERMISSIONS", "description": "Permissions", "status": 1 }, { "name": "DISCOVERY", "description": "Discovery Engine", "status": 0 }, { "name": "ADS", "description": "Agentless Disk Scanning", "status": 2 }, { "name": "DSPM", "description": "Data Security Scanning", "status": 2 }, { "name": "AUDIT_LOGS", "description": "Audit Logs", "status": 2 }, { "name": "REGISTRY", "description": "Registry Scanning", "status": 2 }, { "name": "SERVERLESS", "description": "Serverless Scanning", "status": 2 }, { "name": "IDENTITY_SECURITY", "description": "Identity Security", "status": 0 }, { "name": "AUTOMATION", "description": "Automation", "status": 2 }, { "name": "KUBERNETES_SECURITY", "description": "Kubernetes Security", "status": 2 } ], "upgrade_available": true, "cloud_partition": "COMMERCIAL", "collection_configuration": "{\"audit_logs\": {\"enabled\": false, \"data_events\": false}}", "additional_capabilities": "{\"automation\": false, \"xsiam_analytics\": false, \"registry_scanning\": false, \"kubernetes_security\": false, \"serverless_scanning\": false, \"automation_log_level\": \"OFF\", \"agentless_disk_scanning\": false, \"upload_files_to_wildfire\": false, \"registry_scanning_options\": {\"type\": \"ALL\"}, \"data_security_posture_management\": false}" } } } }, "InstanceListItem": { "type": "object", "description": "A single cloud instance in the list response.", "properties": { "instance_id": { "type": "string", "description": "Unique identifier of the cloud instance" }, "cloud_provider": { "type": "string", "enum": [ "AWS", "GCP", "AZURE", "OCI", "ALIBABA_CLOUD" ] }, "instance_name": { "type": "string", "description": "Display name of the cloud instance" }, "account_name": { "type": "string", "nullable": true, "description": "The display name of the primary account associated with this cloud instance. For organization and organizational unit scopes, this field may be empty if no account name association is found." }, "accounts": { "type": "integer", "nullable": true, "description": "Count of non-deleted accounts (integer, not an object)" }, "scope": { "type": "string", "enum": [ "ORGANIZATION", "ACCOUNT_GROUP", "ACCOUNT" ] }, "scan_mode": { "type": "string", "enum": [ "MANAGED", "OUTPOST" ] }, "cloud_partition": { "type": "string", "enum": [ "COMMERCIAL", "GOV" ], "nullable": true }, "creation_time": { "type": "integer", "format": "int64", "nullable": true, "description": "Creation timestamp in epoch milliseconds" }, "custom_resources_tags": { "type": "string", "description": "JSON-encoded string of custom resource tags" }, "provisioning_method": { "type": "string", "nullable": true, "enum": [ "TF", "TF_M", "CF", "CF_M", "GCDM", "ARM", "BICEP_M", "MANUAL" ] }, "additional_capabilities": { "type": "string", "description": "JSON-encoded string of additional capabilities" }, "update_status": { "type": "string", "nullable": true, "enum": [ "UP_TO_DATE", "UPDATE_AVAILABLE" ] }, "is_pending_changes": { "type": "integer", "nullable": true, "description": "0 (no pending changes) or 1 (has pending changes)" }, "status": { "type": "string", "enum": [ "CONNECTED", "WARNING", "ERROR", "DISABLED", "PENDING" ] }, "outpost_id": { "type": "string", "nullable": true, "description": "ID of the associated outpost" } } }, "ListInstancesRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "description": "Valid values for the sort field `FIELD` the filter field `SEARCH_FIELD` include:\n\n- `STATUS` \n- `PROVIDER` \n- `INSTANCE_NAME` \n- `SCOPE` \n- `SCAN_MODE` \n- `CREATION_TIME` \n- `OUTPOST_ID` \n- `AUTHENTICATION_METHOD` \n- `ID`", "properties": { "filter_data": { "$ref": "#/components/schemas/FilterData" } }, "example": { "filter_data": { "sort": [ { "FIELD": "STATUS", "ORDER": "DESC" } ], "paging": { "from": 0, "to": 50 }, "filter": { "AND": [ { "SEARCH_FIELD": "CLOUD_PROVIDER", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "AWS" } ] } } } } } }, "FilterData": { "type": "object", "properties": { "sort": { "type": "array", "description": "Sorting criteria for the results", "items": { "$ref": "#/components/schemas/SortCriteria" } }, "paging": { "$ref": "#/components/schemas/Paging" }, "filter": { "description": "Filter criteria for the results.", "oneOf": [ { "$ref": "#/components/schemas/AndPredicate" }, { "$ref": "#/components/schemas/OrPredicate" }, { "type": "object" } ] } }, "example": { "sort": [ { "FIELD": "STATUS", "ORDER": "DESC" } ], "paging": { "from": 0, "to": 50 }, "filter": { "AND": [ { "SEARCH_FIELD": "STATUS", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "ENABLED" } ] } } }, "SortCriteria": { "type": "object", "properties": { "FIELD": { "type": "string", "description": "The field to sort by." }, "ORDER": { "type": "string", "enum": [ "ASC", "DESC" ], "description": "Whether to sort in ascending (`ASC`) order or descending (`DESC`) order." } }, "example": { "FIELD": "STATUS", "ORDER": "DESC" } }, "Paging": { "type": "object", "properties": { "from": { "type": "integer", "description": "The starting index for pagination.", "minimum": 0 }, "to": { "type": "integer", "description": "The ending index for pagination.", "minimum": 1 } }, "example": { "from": 0, "to": 50 } }, "AndPredicate": { "type": "object", "properties": { "AND": { "type": "array", "description": "A list of filter criteria to be combined with AND logic", "items": { "$ref": "#/components/schemas/FilterCriteria" } } } }, "FilterCriteria": { "type": "object", "properties": { "SEARCH_FIELD": { "type": "string", "description": "Specifies the field to filter by. " }, "SEARCH_TYPE": { "type": "string", "description": "Comparison operator to use with the filter." }, "SEARCH_VALUE": { "description": "The value to filter by.", "oneOf": [ { "type": "string" }, { "type": "array", "items": { "type": "string" } } ] } }, "example": { "SEARCH_FIELD": "STATUS", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "ENABLED" } }, "OrPredicate": { "type": "object", "properties": { "OR": { "type": "array", "description": "A list of filter criteria to be combined with OR logic", "items": { "$ref": "#/components/schemas/FilterCriteria" } } } }, "GetInstancesResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "DATA": { "type": "array", "items": { "$ref": "#/components/schemas/InstanceListItem" } }, "FILTER_COUNT": { "type": "integer" }, "TOTAL_COUNT": { "type": "integer" } } } }, "example": { "reply": { "DATA": [ { "instance_id": "716e6a20f1ca41efb966bd9fa486fb60", "cloud_provider": "AWS", "instance_name": "aws-expanse-afr-sbx", "account_name": "", "accounts": 1, "scope": "ACCOUNT", "scan_mode": "MANAGED", "cloud_partition": "COMMERCIAL", "creation_time": 1768333922750, "custom_resources_tags": "[{\"key\": \"managed_by\", \"value\": \"paloaltonetworks\"}]", "provisioning_method": "CF", "additional_capabilities": "{\"automation\": true, \"xsiam_analytics\": true, \"registry_scanning\": true}", "update_status": "UPDATE_AVAILABLE", "is_pending_changes": 0, "status": "DISABLED", "outpost_id": "6e1e2eb8fce34c6e889538ea177644f7" } ], "FILTER_COUNT": 1, "TOTAL_COUNT": 1 } } }, "GetAccountsRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "instance_id" ], "description": "Valid values for the filter field `SEARCH_FIELD` include:\n\n- `STATUS`\n- `ACCOUNT_NAME`\n- `CLOUD_ACCOUNT_ID`\n- `ENVIRONMENT`\n- `TYPE`\n- `CREATED_AT`", "properties": { "instance_id": { "type": "string", "description": "The ID of the cloud instance for which to list accounts. To obtain instance IDs, use [Get Instances](https://app.gitbook.com/s/FK89utN7l3ilSek2DmU5/cloud-onboarding/cloud-instance-management#post-public_api-v1-cloud_onboarding-get_instances)." }, "filter_data": { "$ref": "#/components/schemas/FilterData" } } } } }, "GetAccountsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "DATA": { "type": "array", "items": { "$ref": "#/components/schemas/AccountItem" } }, "FILTER_COUNT": { "type": "integer" }, "TOTAL_COUNT": { "type": "integer" } } } }, "example": { "reply": { "DATA": [ { "account_name": "546064730288", "cloud_account_id": "546064730288", "account_type": "ORGANIZATION", "status": "ENABLED", "environment": "NONE", "created_at": 1775686847489 } ], "FILTER_COUNT": 1, "TOTAL_COUNT": 1 } } }, "BaseError": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "string", "description": "Error code" }, "err_msg": { "type": "string", "description": "Error message" }, "err_extra": { "type": "string", "description": "Extra information about the error" } } } } }, "EditOutpostResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "automated": { "type": "object", "properties": { "link": { "type": "string" }, "tracking_guid": { "type": "string" } } }, "manual": { "type": "object", "properties": { "TF/ARM": { "type": "string" } } } } } }, "x-examples": { "Example 1": { "reply": { "automated": { "link": "string", "tracking_guid": "string" }, "manual": { "TF/ARM": "string" } } } } }, "CreateInstanceRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "cloud_provider": { "type": "string", "enum": [ "AWS", "AZURE", "GCP" ], "description": "The cloud service provider. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`" }, "scope": { "type": "string", "enum": [ "ACCOUNT", "ORGANIZATION", "ACCOUNT_GROUP" ], "description": "Define the scope for this integration instance. Valid values include:\n\n- `ACCOUNT`\n- `ORGANIZATION`\n- `ACCOUNT_GROUP`" }, "scan_mode": { "type": "string", "enum": [ "MANAGED", "OUTPOST" ], "description": "Define the scan mode. Valid values include:\n\n- `MANAGED`: Security scanning is performed in the Cortex cloud environment.\n- `OUTPOST`: Security scanning is performed on infrastructure deployed to a cloud account owned by you. When set to `OUTPOST`, `outpost_id` is required." }, "manual_details": { "type": "object", "description": "The manually provisioned CSP resource details collected from your cloud environment. Fill in the `manual_details` section of the identifiers JSON file downloaded from the Cortex onboarding wizard (or returned by `get_manual_connector_identifiers`) with the values retrieved from your CSP — for example, Role ARN and External ID for AWS, or tenant ID and managed identity details for Azure — then pass the completed object here.", "additionalProperties": true }, "outpost_id": { "type": "string", "description": "The ID of the outpost to use for scanning. Required when `scan_mode` is `OUTPOST`. Retrieve available outpost IDs from `POST /public_api/v1/cloud_onboarding/get_outposts`.", "minLength": 1 }, "instance_name": { "type": "string", "description": "Optional display name for the integration instance. If omitted, Cortex auto-generates a name using the convention `-` or `-`. Instance names are not required to be unique, but using a unique name per instance is strongly recommended." }, "custom_resources_tags": { "type": "array", "items": { "$ref": "#/components/schemas/CustomResourceTag" } }, "collection_configuration": { "$ref": "#/components/schemas/InstanceCollectionConfiguration" }, "scope_modifications": { "$ref": "#/components/schemas/InstanceScopeModifications" }, "additional_capabilities": { "$ref": "#/components/schemas/InstanceAdditionalCapabilities" } }, "required": [ "cloud_provider", "scope", "scan_mode", "manual_details" ], "example": { "cloud_provider": "AWS", "scope": "ORGANIZATION", "scan_mode": "MANAGED", "manual_details": { "account_id": "123456789012" }, "custom_resources_tags": [ { "key": "environment", "value": "production" } ], "collection_configuration": { "audit_logs": { "enabled": false } }, "scope_modifications": { "accounts": { "enabled": true, "type": "INCLUDE", "account_ids": [ "123456789012" ] }, "regions": { "enabled": false } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": false } }, "description": "Request body for creating a manually provisioned cloud integration instance. Provide the same `cloud_provider`, `scope`, `scan_mode`, and capability configuration used when calling `get_manual_connector_identifiers`, together with the completed `manual_details` object returned from your CSP environment." } } }, "DeleteInstanceTemplateRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "template_id": { "type": "string", "description": "The ID of the integration instance template to delete.", "minLength": 1 } }, "required": [ "template_id" ], "example": { "template_id": "template-1" }, "description": "Request body for deleting an integration instance template. Templates are generated when you call the onboarding or edit endpoints. Deleting a template does not delete the cloud instance or any deployed CSP resources." } } }, "EditManualConnectorInstanceRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "id": { "type": "string", "description": "The ID of the connector instance to edit.", "minLength": 1 }, "cloud_provider": { "type": "string", "enum": [ "AWS", "AZURE", "GCP" ], "description": "The cloud service provider. Only AWS, AZURE, and GCP are supported." }, "scope": { "type": "string", "enum": [ "ACCOUNT", "ORGANIZATION", "ACCOUNT_GROUP" ], "description": "The connector scope. Cannot be changed; must match the value used at creation." }, "scan_mode": { "type": "string", "enum": [ "MANAGED", "OUTPOST" ], "description": "The scan mode. Cannot be changed; must match the value used at creation. When OUTPOST, outpost_id is required." }, "manual_details": { "type": "object", "description": "Updated provider-specific manual details. account_id cannot be changed and must be provided exactly as it was at creation.", "additionalProperties": true }, "outpost_id": { "type": "string", "description": "The ID of the outpost. Required when scan_mode is OUTPOST.", "minLength": 1 }, "instance_name": { "type": "string", "description": "Optional display name for the integration instance." }, "cloud_partition": { "type": "string", "enum": [ "COMMERCIAL", "GOV" ], "description": "The cloud partition. Defaults to COMMERCIAL.", "default": "COMMERCIAL" }, "custom_resources_tags": { "type": "array", "items": { "$ref": "#/components/schemas/CustomResourceTag" } }, "additional_capabilities": { "$ref": "#/components/schemas/InstanceAdditionalCapabilities" }, "collection_configuration": { "$ref": "#/components/schemas/InstanceCollectionConfiguration" }, "scope_modifications": { "$ref": "#/components/schemas/InstanceScopeModifications" } }, "required": [ "id", "cloud_provider", "scope", "scan_mode", "manual_details", "additional_capabilities" ], "example": { "id": "b4a8001bf82744f9855a6d1aa083e53c", "cloud_provider": "AWS", "scope": "ACCOUNT", "scan_mode": "MANAGED", "manual_details": { "account_id": "123456789012" }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": false }, "collection_configuration": { "audit_logs": { "enabled": false, "data_events": false, "collection_method": "CUSTOM" } }, "scope_modifications": { "regions": { "enabled": false } } } } }, "description": "Request body for editing a manually-onboarded cloud integration instance. Immutable fields (`scope`, `scan_mode`, root account identifier) cannot be changed — delete and re-create the instance to change these. After editing, re-deploy the updated authentication template in your CSP to apply the changes." }, "GetAccountScanningConfigurationRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "account_id": { "type": "string", "description": "The cloud account ID whose scanning scope should be retrieved." }, "instance_id": { "type": "string", "description": "The integration instance ID that owns the account." } }, "example": { "account_id": "783764579631", "instance_id": "e3294d92e7764074aaff98f3db7eb588" }, "description": "Identifies the cloud account whose scanning scope should be retrieved. Both `account_id` and `instance_id` are required." } } }, "GetAccountScanningConfigurationResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The account's environment and its entire stored scanning scope object.", "properties": { "environment": { "type": "string", "description": "The environment of the cloud account." }, "scanning_scope": { "type": "object", "description": "The entire stored scanning scope object for the account, returned as-is. Empty when no scanning scope is set." } } } }, "example": { "reply": { "environment": "prod", "scanning_scope": { "ads_scan_enabled": true, "dspm_scan_enabled": false, "agentless_disk_scanning_scope": { "enabled": true, "type": "EXCLUDE", "tags": [ { "key": "env", "value": "prod" } ] } } } }, "description": "Response containing the account's environment and its entire stored scanning scope object." }, "GetEditInstanceDetailsResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The editable configuration of the integration instance, containing the current fields and any pending changes.", "properties": { "fields": { "type": "object", "description": "The current editable configuration fields of the integration instance." }, "pending_changes": { "type": "object", "description": "Pending (not-yet-applied) configuration changes for the integration instance." } } } }, "example": { "reply": { "fields": { "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", "instance_name": "instance-1", "cloud_provider": "AZURE" }, "pending_changes": {} } }, "description": "Response containing the current editable configuration of the integration instance and any pending (not-yet-applied) changes." }, "GetManualConnectorIdentifiersRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "cloud_provider": { "type": "string", "enum": [ "AWS", "AZURE", "GCP" ], "description": "The cloud service provider. Valid values include:\n\n- `AWS`\n- `AZURE`\n- `GCP`" }, "scope": { "type": "string", "enum": [ "ACCOUNT", "ORGANIZATION", "ACCOUNT_GROUP" ], "description": "Define the scope for this integration instance. Valid values include:\n\n- `ACCOUNT`\n- `ORGANIZATION`\n- `ACCOUNT_GROUP`" }, "scan_mode": { "type": "string", "enum": [ "MANAGED", "OUTPOST" ], "description": "Define the scan mode. Valid values include:\n\n- `MANAGED`: Security scanning is performed in the Cortex cloud environment.\n- `OUTPOST`: Security scanning is performed on infrastructure deployed to a cloud account owned by you. When set to `OUTPOST`, `outpost_id` is required." }, "outpost_id": { "type": "string", "description": "The ID of the outpost. Required when scan_mode is OUTPOST.", "minLength": 1 }, "custom_resources_tags": { "type": "array", "items": { "$ref": "#/components/schemas/CustomResourceTag" } }, "collection_configuration": { "$ref": "#/components/schemas/InstanceCollectionConfiguration" }, "scope_modifications": { "$ref": "#/components/schemas/InstanceScopeModifications" }, "additional_capabilities": { "$ref": "#/components/schemas/InstanceAdditionalCapabilities" }, "account_details": { "allOf": [ { "$ref": "#/components/schemas/AccountDetails" } ], "description": "Required for Azure only. Provide the Azure tenant ID as organization_id (for example {\"organization_id\": \"\"}). The Service Principal (SP) must already exist in the tenant before calling this endpoint. Must not be sent for non-Azure providers." } }, "required": [ "cloud_provider", "scope", "scan_mode" ], "example": { "cloud_provider": "AWS", "scope": "ORGANIZATION", "scan_mode": "MANAGED", "custom_resources_tags": [ { "key": "environment", "value": "production" } ], "collection_configuration": { "audit_logs": { "enabled": false } }, "scope_modifications": { "accounts": { "enabled": true, "type": "INCLUDE", "account_ids": [ "123456789012" ] }, "regions": { "enabled": false } }, "additional_capabilities": { "xsiam_analytics": true, "data_security_posture_management": false } }, "description": "Parameters that define the identifiers to generate. Must match the `cloud_provider`, `scope`, `scan_mode`, and capability configuration you intend to use when calling `create_instance`. Only AWS, Azure, and GCP are supported." } } }, "GetManualConnectorIdentifiersResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The cloud service provider identifiers and manual_details template used to manually provision the integration instance.", "additionalProperties": true } }, "description": "Response containing the generated identifiers file. The `reply` object has two sections:\n\n- `identifiers` — pre-populated CSP-specific values (role names, external IDs, OIDC audience, etc.) to reference when creating CSP resources.\n- `manual_details` — initially empty fields that you populate with values retrieved from your CSP environment, then pass to `create_instance`." }, "GetRelevantAdditionalCapabilitiesRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "cloud_provider": { "type": "string", "enum": [ "AWS", "GCP", "AZURE", "OCI", "ALIBABA_CLOUD" ], "description": "The cloud service provider." }, "scope": { "type": "string", "enum": [ "ORGANIZATION", "ACCOUNT_GROUP", "ACCOUNT" ], "description": "The connector scope." }, "cloud_partition": { "type": "string", "enum": [ "COMMERCIAL", "GOV" ], "description": "The cloud partition. Defaults to COMMERCIAL.", "default": "COMMERCIAL" } }, "required": [ "cloud_provider", "scope" ], "example": { "cloud_provider": "AWS", "scope": "ORGANIZATION", "cloud_partition": "COMMERCIAL" }, "description": "Parameters that define the connector configuration to resolve capabilities for. The returned capability list is filtered by your tenant's license and the CSP/partition/scope combination." } } }, "GetRelevantAdditionalCapabilitiesResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The available additional capabilities and collection-configuration keys for the given provider/scope, based on the tenant's license.", "properties": { "additional_capabilities": { "type": "array", "description": "List of available capability keys.", "items": { "type": "string" } }, "collection_configuration": { "type": "array", "description": "List of available collection-configuration keys (for example audit_logs). Omitted when none are available.", "items": { "type": "string" } } } } }, "example": { "reply": { "additional_capabilities": [ "agentless_disk_scanning", "data_security_posture_management", "registry_scanning", "serverless_scanning", "automation", "kubernetes_security" ], "collection_configuration": [ "audit_logs" ] } } }, "ManualUpdateAndResolveRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "instance_id": { "type": "string", "description": "The connector GUID. Must be exactly 32 characters.", "minLength": 32, "maxLength": 32 } }, "required": [ "instance_id" ], "example": { "instance_id": "b4a8001bf82744f9855a6d1aa083e53c" }, "description": "Identifies the manually-onboarded connector to mark as updated/resolved. Call this after re-deploying the updated authentication template in your CSP." } } }, "SetAccountScanningScopeRequestData": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "account_id": { "type": "string", "description": "The cloud account ID whose scanning scope should be updated." }, "instance_id": { "type": "string", "description": "The integration instance ID that owns the account." }, "ads_scan_enabled": { "type": "boolean", "description": "Enable (`true`) or disable (`false`) Agentless Disk Scanning for this account. Enabling requires the ADS capability to be active on the connector." }, "dspm_scan_enabled": { "type": "boolean", "description": "Enable (`true`) or disable (`false`) Data Security Posture Management scanning for this account. Enabling requires the DSPM capability to be active on the connector." }, "agentless_disk_scanning_scope": { "type": "object", "description": "The ADS tag-based host filter. When enabled, both type and tags are required.", "properties": { "enabled": { "type": "boolean" }, "type": { "type": "string", "enum": [ "INCLUDE", "EXCLUDE" ], "nullable": true }, "tags": { "type": "array", "nullable": true, "items": { "type": "object", "properties": { "key": { "type": "string" }, "value": { "type": "string" } } } } } } }, "example": { "account_id": "783764579631", "instance_id": "e3294d92e7764074aaff98f3db7eb588", "ads_scan_enabled": false, "agentless_disk_scanning_scope": { "enabled": true, "type": "EXCLUDE", "tags": [ { "key": "env", "value": "prod" } ] } }, "description": "Per-account scanning scope update. Provided keys are deep-merged onto the stored scope; omitted keys are preserved. Only ADS and DSPM scan gates and the ADS tag-based host filter are currently supported." } } }, "SetAccountScanningScopeResponse": { "type": "object", "properties": { "reply": { "type": "object", "description": "The main payload of the response, containing operation-specific data." } }, "example": { "reply": {} } } } } }