Cisco XDR

Cisco XDR V2 API

The v2 API from Cisco XDR — 75 operation(s) for v2.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 85

POST /v2/casebook Adds a new Casebook
GET /v2/casebook/external_id/{external-id} List Casebook by external id
GET /v2/casebook/search Search casebooks
GET /v2/casebook/{casebook-id} Get one casebook by id
PUT /v2/casebook/{casebook-id} Updates a Casebook
DELETE /v2/casebook/{casebook-id} Deletes a Casebook
PATCH /v2/casebook/{casebook-id} Partially Update a Casebook
GET /v2/casebook/{casebook-id}/summary Returns a casebook and it's related incidents.
POST /v2/casebook/{casebook-id}/observables Updates a casebook's observables
POST /v2/casebook/{casebook-id}/bundle Updates a casebook's bundle
POST /v2/casebook/{casebook-id}/texts Updates a casebook's texts
POST /v2/investigation Create Investigation
POST /v2/investigation/bundle Create Investigation from Snapshot
POST /v2/investigation/snapshot Create Investigation from Snapshot
GET /v2/investigation/{investigation-id}/snapshot Create Investigation from Investigation Id
GET /v2/investigation/{investigation-id}/errors Investigation Errors
GET /v2/investigation/{investigation-id}/entities Investigation Entities
GET /v2/investigation/{investigation-id}/events Investigation Events
GET /v2/investigation/{investigation-id}/verdicts Investigation Verdicts
GET /v2/investigation/{investigation-id}/graph Investigation Relation Graph
GET /v2/investigation/{investigation-id}/indicators Returns a list of indicators attached to this investigation
GET /v2/investigation/{investigation-id}/observables Returns a list of observables attached to this investigation
GET /v2/investigation/{investigation-id}/overview Returns metadata about the investigation
GET /v2/investigation/{investigation-id}/status Investigation Status
GET /v2/investigation/{investigation-id}/summary Returns a Summary of the Investigation
GET /v2/investigation/{investigation-id}/targets Returns a list of targets attached to this investigation
POST /v2/investigation/{investigation-id}/bundle Add Threat context to an investigation
POST /v2/investigation/{investigation-id}/observable/add Add observables to an investigation
POST /v2/investigation/{investigation-id}/observable/remove Remove observables from an investigation.
POST /v2/investigation/{investigation-id}/task Run a task
PUT /v2/investigation/{investigation-id}/edit Saves an investigation in place.
POST /v2/investigation/{investigation-id}/copy Create a copy of an investigation.
DELETE /v2/investigation/{investigation-id}/delete
POST /v2/investigation/{investigation-id}/save-as Saves an investigation as a new entity.
POST /v2/incident Create New Incident
POST /v2/incident/delete Delete Bulk Incidents
GET /v2/incident/search Search incidents
GET /v2/incident/search/count Get Count of Incidents by Search
GET /v2/incident/{incident-id} Get one incident.
PUT /v2/incident/{incident-id} Update one incident.
DELETE /v2/incident/{incident-id} Delete one incident.
PATCH /v2/incident/{incident-id} Patch one incident.
POST /v2/incident/{incident-id}/actions-taken Post actions taken for an incident
POST /v2/incident/{incident-id}/link/{entity-type}/{entity-id} Link incident and entity (investigation | casebook | incident)
DELETE /v2/incident/{incident-id}/link/{entity-type}/{entity-id} Unlink incident and entity. (investigation | casebook | incident)
POST /v2/incident/{incident-id}/update-context Process an incident update by invalidating the cache and finding reputations as well as resolving assets.
GET /v2/incident/{incident-id}/report Incident Report
GET /v2/incident/{incident-id}/report/{section-id} Incident Report Section
POST /v2/incident/{incident-id}/report/{section-id} Update Report Section
POST /v2/incident/{incident-id}/report/{section-id}/regenerate Regenerate a Report Section
GET /v2/incident/{incident-id}/summary Full Incident Summary. Equivalent Data to v1 summary endpoints.
GET /v2/incident/{incident-id}/mitre Mitre tactics, techniques, and subtechniques found in an incident
GET /v2/incident/{incident-id}/targets Incident Assets
GET /v2/incident/{incident-id}/observables Returns a list of observables linked to this incident.
GET /v2/incident/{incident-id}/indicators Returns a list of indicators linked to this incident.
GET /v2/incident/{incident-id}/entities Returns a list of entities associated with this incident.
GET /v2/incident/{incident-id}/events Returns a list of events linked to this incident.
POST /v2/incident/{incident-id}/events Returns a list of events linked to this incident.
GET /v2/incident/{incident-id}/status Returns the underlying incident's investigation status with surrounding threat context.
POST /v2/incident/{incident-id}/status Update an incident status.
GET /v2/incident/{incident-id}/event-filters Returns the available filter params for this incident's events
GET /v2/incident/{incident-id}/verdicts Returns a list of events linked to this incident.
GET /v2/incident/{incident-id}/graph Returns a graph representation of this incident.
GET /v2/incident/{incident-id}/linked-casebooks Return Linked Casebooks
GET /v2/incident/{incident-id}/linked-incidents Returns linked incidents
GET /v2/incident/{incident-id}/primary-investigation Returns linked investigations
GET /v2/incident/{incident-id}/errors Returns a list of errors reported by the attached investigations
GET /v2/incident/{incident-id}/overview Returns baseline incident information
GET /v2/incident/{incident-id}/recommend Recommend actions for an incident.
GET /v2/incident/{incident-id}/export Get a full summary of the incident, everything seen in XDR
POST /v2/incident/{incident-id}/import Import Incident and all its surrounding threat context from CTIA
GET /v2/sighting/{sighting-id}/findings Get the findings for a sighting ID
GET /v2/report/incident-status-by-assignment Incident counts by status and assignment bucket
GET /v2/report/mitre-attack-incidents Non-closed incident counts by MITRE tactic and technique
GET /v2/report/top-seen-techniques Top seen techniques across incidents
GET /v2/report/detection-sources-histogram Daily incident counts per detection source
GET /v2/report/top-targeted-devices Top targeted devices across incidents
GET /v2/report/top-targeted-users Top targeted users across incidents
GET /v2/report/top-targeted-assets Top targeted assets across incidents
GET /v2/report/team-mean-time-to-engage Team mean time to engage over the period
GET /v2/report/user-mean-time-to-engage Requesting user's mean time to engage over the period
GET /v2/report/team-mean-time-to-contain Team mean time to contain over the period
GET /v2/report/user-mean-time-to-contain User mean time to contain over the period
GET /v2/report/team-mean-time-to-resolve Team mean time to resolve over the period
GET /v2/report/user-mean-time-to-resolve Requesting user's mean time to resolve over the period

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-v2-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/cisco-xdr-v2-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

cisco-xdr-v2-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Conure V2 API
  version: conure-218-1-ee422dee
  license:
    name: All Rights Reserved
    url: https://www.cisco.com
  contact:
    name: Cisco Security Business Group -- Advanced Threat
    email: cisco-intel-api-support@cisco.com
  description: XDR High Priority Incident and Investigation API
  x-provenance:
    method: harvested
    authored_by: Cisco XDR
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: visibility.amp.cisco.com
    note: Anonymously fetchable Swagger 2.0 for nine IROH services plus the CTIA threat-intelligence API. The host returns real 404s on invented paths, so the 200s are genuine.
  x-evidence:
  - type: source
    url: https://visibility.amp.cisco.com/iroh/iroh-int/swagger.json
  - type: source
    url: https://private.intel.amp.cisco.com/swagger.json
tags:
- name: v2
paths:
  /v2/casebook:
    post:
      responses:
        '405':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Method Not Allowed
                required:
                - message
            application/transit+msgpack:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Method Not Allowed
                required:
                - message
            application/transit+json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Method Not Allowed
                required:
                - message
            application/edn:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Method Not Allowed
                required:
                - message
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - unspecified status
                required:
                - message
            application/transit+msgpack:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - unspecified status
                required:
                - message
            application/transit+json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - unspecified status
                required:
                - message
            application/edn:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - unspecified status
                required:
                - message
        '429':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Too many requests
                required:
                - message
            application/transit+msgpack:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Too many requests
                required:
                - message
            application/transit+json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Too many requests
                required:
                - message
            application/edn:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Too many requests
                required:
                - message
        '401':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Unauthorized
                required:
                - message
            application/transit+msgpack:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Unauthorized
                required:
                - message
            application/transit+json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Unauthorized
                required:
                - message
            application/edn:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - Unauthorized
                required:
                - message
        '500':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - exception
                    - default exception
                    - sql exception
                    - JSON too large
                    - schema
                    - external_request
                  exception:
                    type: string
                    example: SqlException
                  data:
                    example:
                      example: Bad Request
                    description: Any specific error information passed by custom errors.
                  uri:
                    type: string
                    example: /global/v1/incident/?/incident-summary
                    description: The URI the error was seen at
                required:
                - message
            application/transit+msgpack:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - exception
                    - default exception
                    - sql exception
                    - JSON too large
                    - schema
                    - external_request
                  exception:
                    type: string
                    example: SqlException
                  data:
                    example:
                      example: Bad Request
                    description: Any specific error information passed by custom errors.
                  uri:
                    type: string
                    example: /global/v1/incident/?/incident-summary
                    description: The URI the error was seen at
                required:
                - message
            application/transit+json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - exception
                    - default exception
                    - sql exception
                    - JSON too large
                    - schema
                    - external_request
                  exception:
                    type: string
                    example: SqlException
                  data:
                    example:
                      example: Bad Request
                    description: Any specific error information passed by custom errors.
                  uri:
                    type: string
                    example: /global/v1/incident/?/incident-summary
                    description: The URI the error was seen at
                required:
                - message
            application/edn:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    enum:
                    - exception
                    - default exception
                    - sql exception
                    - JSON too large
                    - schema
                    - external_request
                  exception:
                    type: string
                    example: SqlException
                  data:
                    example:
                      example: Bad Request
                    description: Any specific error information passed by custom errors.
                  uri:
                    type: string
                    example: /global/v1/incident/?/incident-summary
                    description: The URI the error was seen at
                required:
                - message
        '201':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  bundle:
                    type: object
                    properties:
                      id:
                        type: string
                      description:
                        type: string
                      attack_patterns:
                        type: array
                        items:
                          type: object
                          properties: {}
                      assets:
                        type: array
                        items:
                          type: object
                          properties: {}
                      asset_properties:
                        type: array
                        items:
                          type: object
                          properties: {}
                      asset_mappings:
                        type: array
                        items:
                          type: object
                          properties: {}
                      casebooks:
                        type: array
                        items:
                          type: object
                          properties: {}
                      indicators:
                        type: array
                        items:
                          type: object
                          properties: {}
                      judgements:
                        type: array
                        items:
                          type: object
                          properties: {}
                      malwares:
                        type: array
                        items:
                          type: object
                          properties: {}
                      modules:
                        type: array
                        items:
                          type: object
                          properties: {}
                      relationships:
                        type: array
                        items:
                          type: object
                          properties: {}
                      sightings:
                        type: array
                        items:
                          type: object
                          properties: {}
                      verdicts:
                        type: array
                        items:
                          type: object
                          properties: {}
                      tools:
                        type: array
                        items:
                          type: object
                          properties: {}
                  texts:
                    type: array
                    items:
                      type: object
                      properties:
                        text:
                          type: string
                        type:
                          type: string
                      required:
                      - text
                      - type
                  observables:
                    type: array
                    items:
                      type: object
                      properties:
                        type:
                          title: ObservableType
                          type: string
                          enum:
                          - none
                          - file_path
                          - mac_address
                          - trend_micro_id
                          - cybereason_id
                          - process_args
                          - s1_agent_id
                          - device
                          - hostname
                          - certificate_common_name
                          - serial_number
                          - meraki_network_id
                          - url
                          - jamf_management_id
                          - certificate_serial
                          - intune_id
                          - meraki_org_id
                          - cisco_cm_id
                          - registry_key
                          - process_path
                          - darktrace_id
                          - process_username
                          - cortex_agent_id
                          - orbital_node_id
                          - process_uid
                          - ngfw_name
                          - user
                          - certificate_issuer
                          - ipv6
                          - email
                          - cisco_uc_id
                          - cvm_id
                          - sha256
                          - crowdstrike_id
                          - google_cloud_id
                          - google_chromebook_id
                          - acudid
                          - sha1
                          - registry_name
                          - md5
                          - service_now_id
                          - ip
                          - domain
                          - email_subject
                          - imei
                          - ngfw_id
                          - amp_computer_guid
                          - ms_machine_id
                          - secure_access_id
                          - mutex
                          - processor_id
                          - swc_device_id
                          - registry_path
                          - odns_identity
                          - odns_identity_label
                          - cisco_mid
                          - process_name
                          - pki_serial
                          - meraki_node_sn
                          - email_messageid
                          - imsi
                          - user_agent
                          - process_hash
                          - file_name
                          description: The type of the observable
                          example: domain
                        value:
                          title: Observable.Value
                          type: string
                          example: ilo.brenz.pl
                          description: The value of the observable.
                      required:
                      - type
                      - value
                  description:
                    type: string
                  short_description:
                    type: string
                  source:
                    type: string
                  source_uri:
                    type: string
                  title:
                    type: string
                  language:
                    type: string
                  external_references:
                    type: array
                    items:
                      type: object
                      properties:
                        source_name:
                          type: string
                        hashes:
                          type: array
                          items:
                            type: string
                        url:
                          type: string
                        description:
                          type: string
                        external_id:
                          type: string
                      required:
                      - source_name
                  external_ids:
                    type: array
                    items:
                      type: string
                  tlp:
                    type: string
                    enum:
                    - amber
                    - green
                    - red
                    - white
                  id:
                    type: string
                  client_id:
                    type: string
                  modified:
                    type: string
                    format: date-time
                    x-anyOf:
                    - type: string
                      format: date-time
                    - type: string
                  created:
                    type: string
                    format: date-time
                    x-anyOf:
                    - type: string
                      format: date-time
                    - type: string
                  owner:
                    type:
                    - string
                    - 'null'
                    x-anyOf:
                    - type: string
                    - type: boolean
                  groups:
                    type: array
                    items:
                      type: string
                  schema_version:
                    type: string
                  revision:
                    title: PositiveInteger
                    type: integer
                    format: int64
                    minimum: 0
                    description: A integer greater than 0.
                    example: 2
                  type:
                    type: string
                    enum:
                    - casebook
                  timestamp:
                    type: string
                    format: date-time
                    x-anyOf:
                    - type: string
                      format: date-time
                    - type: string
                required:
                - id
                - groups
                - schema_version
                - type
            application/transit+msgpack:
              schema:
                type: object
                properties:
                  bundle:
                    type: object
                    properties:
                      id:
                        type: string
                      description:
                        type: string
                      attack_patterns:
                        type: array
                        items:
                          type: object
                          properties: {}
                      assets:
                        type: array
                        items:
                          type: object
                          properties: {}
                      asset_properties:
                        type: array
                        items:
                          type: object
                          properties: {}
                      asset_mappings:
                        type: array
                        items:
                          type: object
                          properties: {}
                      casebooks:
                        type: array
                        items:
                          type: object
                          properties: {}
                      indicators:
                        type: array
                        items:
                          type: object
                          properties: {}
                      judgements:
                        type: array
                        items:
                          type: object
                          properties: {}
                      malwares:
                        type: array
                        items:
                          type: object
                          properties: {}
                      modules:
                        type: array
                        items:
                          type: object
                          properties: {}
                      relationships:
                        type: array
                        items:
                          type: object
                          properties: {}
                      sightings:
                        type: array
                        items:
                          type: object
                          properties: {}
                      verdicts:
                        type: array
                        items:
                          type: object
                          properties: {}
                      tools:
                        type: array
                        items:
                          type: object
                          properties: {}
                  texts:
                    type: array
                    items:
                      type: object
                      properties:
                        text:
                          type: string
                        type:
                          type: string
                      required:
                      - text
                      - type
                  observables:
                    type: array
                    items:
                      type: object
                      properties:
                        type:
                          title: ObservableType
                          type: string
                          enum:
                          - none
                          - file_path
                          - mac_address
                          - trend_micro_id
                          - cybereason_id
                          - process_args
                          - s1_agent_id
                          - device
                          - hostname
                          - certificate_common_name
                          - serial_number
                          - meraki_network_id
                          - url
                          - jamf_management_id
                          - certificate_serial
                          - intune_id
                          - meraki_org_id
                          - cisco_cm_id
                          - registry_key
                          - process_path
                          - darktrace_id
                          - process_username
                          - cortex_agent_id
                          - orbital_node_id
                          - process_uid
                          - ngfw_name
                          - user
                          - certificate_issuer
                          - ipv6
                          - email
                          - cisco_uc_id
                          - cvm_id
                          - sha256
                          - crowdstrike_id
                          - google_cloud_id
                          - google_chromebook_id
                          - acudid
                          - sha1
                          - registry_name
                          - md5
                          - service_now_id
                          - ip
                          - domain
                          - email_subject
                          - imei
                          - ngfw_id
                          - amp_computer_guid
                          - ms_machine_id
                          - secure_access_id
                          - mutex
                          - processor_id
                          - swc_device_id
                          - registry_path
                          - odns_identity
                          - odns_identity_label
                          - cisco_mid
                          - process_name
                          - pki_serial
                          - meraki_node_sn
                          - email_messageid
                          - imsi
                          - user_agent
                          - process_hash
                          - file_name
                          description: The type of the observable
                          example: domain
                        value:
                          title: Observable.Value
                          type: string
                          example: ilo.brenz.pl
                          description: The value of the observable.
                      required:
                      - type
                      - value
                  description:
                    type: string
                  short_description:
                    type: string
                  source:
                    type: string
                  source_uri:
                    type: string
                  title:
                    type: string
                  language:
                    type: string
                  external_references:
                    type: array
                    items:
                      type: object
                      properties:
                        source_name:
                          type: string
                        hashes:
                          type: array
                          items:
                            type: string
                        url:
                          type: string
                        description:
                          type: string
                        external_id:
                          type: string
                      required:
                      - source_name
                  external_ids:
                    type: array
                    items:
                      type: string
                  tlp:
                    type: string
                    enum:
                    - amber
                    - green
                    - red
                    - white
                  id:
                    type: string
                  client_id:
                    type: string
                  modified:
                    type: string
                    format: date-time
                    x-anyOf:
                    - type: string
                      format: date-time
                    - type: string
                  created:
                    type: string
                    format: date-time
                    x-anyOf:
                    - type: string
                      format: date-time
                    - type: string
                  owner:
                    type:
                    - string
                    - 'null'
                    x-anyOf:
                    - type: string
                    - type: boolean
                  groups:
                    type: array
                    items:
                      type: string
                  schema_version:
                    type: string
                  revision:
                    title: PositiveInteger
                    type: integer
                    format: int64
                    minimum: 0
                    description: A integer greater than 0.
                    example: 2
                  type:
                    type: string
                    enum:
                    - casebook
                  timestamp:
                    type: string
                    format: date-time
                    x-anyOf:
                    - type: string
                      format: date-time
                    - type: string
                required:
                - id
                - groups
                - schema_version
                - type
            application/transit+json:
              schema:
                type: object
                properties:
                  bundle:
                    type: object
                    properties:
                      id:
                        type: string
                      description:
                        type: string
                      attack_patterns:
                        type: array
                        items:
                          type: object
                          properties: {}
                      assets:
                        type: array
                        items:
                          type: object
                          properties: {}
                      asset_properties:
                        type: array
                        items:
                          type: object
                          properties: {}
                      asset_mappings:
                        type: array
                        items:
                          type: object
                          properties: {}
                      casebooks:
                        type: array
                        items:
                          type: object
                          properties: {}
                      indicators:
                        type: array
                        items:
                          type: object
                          properties: {}
                      judgements:
                        type: array
                        items:
                          type: object
                          properties: {}
                      malwares:
                        type: array
                        items:
                          type: object
                          properties: {}
                      modules:
                        type: array
                        items:
                          type: object
                          properties: {}
                      relationships:
                        type: array
                        items:
                          type: object
                          properties: {}
                      sightings:
                        type: array
                        items:
                          type: object
                          properties: {}
                      verdicts:
                        type: array
                        items:
                          type: object
                          properties: {}
                      tools:
                        type: array
                        items:
                          type: object
                          properties: {}
                  texts:
                    type: array
                    items:
                      type: object
                      properties:
                        text:
                          type: string
                        type:
                          type: string
                      required:
                      - text
                      - type
                  observables:
                    type: array
                    items:
                      type: object
                      properties:
                        type:
                          title: ObservableType
                          type: string
                          enum:
                          - none
                          - file_path
                          - mac_address
                          - trend_micro_id
                          - cybereason_id
                          - process_args
                          - s1_agent_id
                          - device
                          - hostname
                          - certificate_common_name
                          - serial_number
                          - meraki_network_id
                          - url
                          - jamf_management_id
                          - certificate_serial
                          - intune_id
                          - mera

# --- truncated at 32 KB (13948 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cisco-xdr/refs/heads/main/openapi/cisco-xdr-v2-api-openapi.yml