lahell/pscortex

Get endpoints, incidents and alerts from the Cortex XDR API

PSCortex

Get endpoints, incidents and alerts from the Cortex XDR API.

Important

This module is no longer maintained.

Before you begin

First of all you have to obtain a API Key and API Key ID: Get Started with Cortex XDR APIs

Installation

Install-Module -Name PSCortex

Usage

Below are some examples of how you can use this module. Please use Get-Help for more details about each function.

Store API Key ID and API Key as $Credential and pass it to Initialize-CortexConfig.

$Credential = Get-Credential
Initialize-CortexConfig -TenantName yourcompany -SecurityLevel Advanced -Region EU -Credential $Credential

Get All Endpoints. Returns a list of all endpoints with a limited number of properties.

Get-CortexEndpointList

Get Endpoint where status is lost and Delete Endpoints. Running Get-CortexEndpoint without parameters will return all endpoints.

$LostEndpoints = Get-CortexEndpoint -EndpointStatus Lost
Remove-CortexEndpoint -EndpointId $LostEndpoints.EndpointId -WhatIf

Get Incidents. Running Get-CortexIncident without parameters will return all incidents.

Get-CortexIncident -Status New

Get Alerts. Running Get-CortexAlert without parameters will return all alerts.

Get-CortexAlert -Severity High

Get Audit Agent Report. Running Get-CortexAuditAgentReport without parameters will return all reports.

Get-CortexAuditAgentReport -Category Status

Get Audit Management Log. Running Get-CortexAuditManagementLog without parameters will return all logs.

Get-CortexAuditManagementLog -CreatedAfter (Get-Date).AddDays(-7)

Get Violations. Running Get-CortexViolation without parameters will return all violations.

Get-CortexViolation -CreatedAfter (Get-Date).AddDays(-7) -Type PortableDevice

Use Case: Find Duplicates

If a computer is reinstalled you could end up with duplicates in Cortex XDR.

Get-CortexEndpointList | Group-Object HostName | Where-Object Count -gt 1 | Select-Object -ExpandProperty Group

Use Case: Delete Endpoints that do not exist in AD

If the endpoint is uninstalled or lost and the computer no longer exist in AD you probably want to remove it from Cortex XDR.

$Endpoints = Get-CortexEndpointList -InactiveOnly | Where-Object HostName -notin (Get-ADComputer -Filter *).Name
Remove-CortexEndpoint -EndpointId $Endpoints.AgentId -WhatIf